"""Tests for the build-time model download (no network)."""

from __future__ import annotations

import hashlib
import sys
from pathlib import Path

import pytest

sys.path.insert(0, str(Path(__file__).resolve().parent.parent))

import fetch_model  # noqa: E402


def test_verify_accepts_the_pinned_hash(tmp_path: Path):
    file = tmp_path / "a.bin"
    file.write_bytes(b"model")
    fetch_model.verify(file, hashlib.sha256(b"model").hexdigest())


def test_verify_rejects_a_changed_file(tmp_path: Path):
    file = tmp_path / "a.bin"
    file.write_bytes(b"tampered")
    with pytest.raises(fetch_model.ChecksumMismatch):
        fetch_model.verify(file, hashlib.sha256(b"model").hexdigest())


def test_download_refuses_plain_http(tmp_path: Path):
    with pytest.raises(ValueError):
        fetch_model.download("http://example.invalid/x", tmp_path / "x")


def test_every_pinned_file_has_a_sha256_and_the_revision_is_a_commit():
    assert len(fetch_model.REVISION) == 40
    assert set(fetch_model.FILES) >= {"model.bin", "config.json", "tokenizer.json", "vocabulary.txt"}
    for digest in fetch_model.FILES.values():
        assert len(digest) == 64 and int(digest, 16) >= 0


def test_fetch_all_stops_on_a_mismatch(tmp_path: Path, monkeypatch):
    def fake_download(url: str, target: Path) -> None:
        target.write_bytes(b"evil")

    monkeypatch.setattr(fetch_model, "download", fake_download)
    with pytest.raises(fetch_model.ChecksumMismatch):
        fetch_model.fetch_all(tmp_path / "m", {"model.bin": hashlib.sha256(b"good").hexdigest()})