import unittest
from unittest.mock import patch

from librenet_scanner.privileged_helper import command_for, validate_target


class PrivilegedHelperTests(unittest.TestCase):
    def test_authorize_exposes_no_command(self):
        self.assertEqual(command_for("authorize", []), [])
        with self.assertRaises(ValueError):
            command_for("authorize", ["unexpected"])

    def test_deep_scan_is_fixed_and_validated(self):
        with patch("librenet_scanner.privileged_helper._trusted_binary", return_value="/usr/bin/nmap"):
            cmd = command_for("nmap-deep", ["192.168.10.0/24"])
        self.assertEqual(cmd[0], "/usr/bin/nmap")
        self.assertIn("-sS", cmd)
        self.assertIn("-O", cmd)
        self.assertEqual(cmd[-1], "192.168.10.0/24")

    def test_standard_scan_rejects_option_injection(self):
        with self.assertRaises(ValueError):
            command_for("nmap-standard", ["--script", "192.168.1.1"])

    def test_unknown_operation_is_rejected(self):
        with self.assertRaises(ValueError):
            command_for("shell", ["/bin/sh"])

    def test_target_limit(self):
        self.assertEqual(validate_target("192.168.1.42/24"), "192.168.1.0/24")
        with self.assertRaises(ValueError):
            validate_target("10.0.0.0/8")

    def test_arp_scan_uses_validated_interface_and_fixed_binary(self):
        with patch("librenet_scanner.privileged_helper.validate_interface", return_value="enp42s0"), \
             patch("librenet_scanner.privileged_helper._trusted_binary", return_value="/usr/sbin/arp-scan"):
            cmd = command_for("arp-scan", ["enp42s0", "192.168.10.0/24"])
        self.assertEqual(cmd, ["/usr/sbin/arp-scan", "--interface", "enp42s0", "192.168.10.0/24"])


if __name__ == "__main__":
    unittest.main()