#!/usr/bin/env python3
"""Real, unprivileged loopback-only OpenSSH fixture on macOS/Linux. No Docker required."""
import argparse,base64,getpass,json,os,pathlib,shutil,socket,subprocess,tempfile,time
root=pathlib.Path(__file__).resolve().parents[1]
p=argparse.ArgumentParser()
p.add_argument('--device',help='Flutter device id; omitted runs host network tests')
p.add_argument('--android',action='store_true',help='Use emulator host address 10.0.2.2')
p.add_argument('--integration',default='integration_test/device_test.dart',help='Integration test file for --device')
p.add_argument('--define',action='append',default=[],help='Extra NAME=VALUE dart define for --device')
args=p.parse_args()
sshd=shutil.which('sshd') or '/usr/sbin/sshd'
# StrictModes requires a non-world-writable parent, unlike /tmp on macOS.
cache=pathlib.Path.home()/'.cache/sm-mobile-tests';cache.mkdir(parents=True,exist_ok=True);cache.chmod(0o700)
with tempfile.TemporaryDirectory(prefix='openssh-',dir=cache) as temporary:
    fixture=pathlib.Path(temporary)
    for name,phrase in [('host_key',''),('client_key','isolated-test-passphrase')]:
        subprocess.run(['ssh-keygen','-q','-t','ed25519','-N',phrase,'-f',str(fixture/name)],check=True)
    shutil.copy(fixture/'client_key.pub',fixture/'authorized_keys')
    (fixture/'authorized_keys').chmod(0o600)
    (fixture/'remote').mkdir()
    (fixture/'sshd_config').write_text(f'''Port 22229
ListenAddress 127.0.0.1
HostKey {fixture}/host_key
PidFile {fixture}/pid
AuthorizedKeysFile {fixture}/authorized_keys
StrictModes yes
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
UsePAM no
AllowUsers {getpass.getuser()}
Subsystem sftp internal-sftp
LogLevel ERROR
''')
    with (fixture/'server.log').open('w') as log:
        server=subprocess.Popen([sshd,'-D','-e','-f',str(fixture/'sshd_config')],stdout=log,stderr=log)
        try:
            time.sleep(.5)
            if server.poll() is not None: raise SystemExit((fixture/'server.log').read_text())
            with socket.create_connection(('127.0.0.1',22229),timeout=3): pass
            env={**os.environ,'SM_OPENSSH_TEST':'1','SM_TEST_KEY':str(fixture/'client_key'),'SM_TEST_REMOTE_DIR':str(fixture/'remote')}
            if args.device:
                fingerprint=subprocess.check_output(['ssh-keygen','-lf',str(fixture/'host_key.pub'),'-E','sha256'],text=True).split()[1]
                defines={'SM_TEST_KEY_B64':base64.b64encode((fixture/'client_key').read_bytes()).decode(),
                  'SM_TEST_FINGERPRINT':fingerprint,'SM_TEST_USER':getpass.getuser(),'SM_TEST_HOST':'10.0.2.2' if args.android else '127.0.0.1'}
                defines.update(d.split('=',1) for d in args.define)
                (fixture/'defines.json').write_text(json.dumps(defines));(fixture/'defines.json').chmod(0o600)
                command=['flutter','test',args.integration,'-d',args.device,'--dart-define-from-file='+str(fixture/'defines.json')]
            else: command=['flutter','test','test/network/openssh_test.dart','test/network/sftp_editor_test.dart','test/network/adaptive_session_test.dart','--reporter','expanded']
            subprocess.run(command,cwd=root,env=env,check=True)
        finally:
            server.terminate()
            try: server.wait(timeout=5)
            except subprocess.TimeoutExpired: server.kill();server.wait()