import subprocess

import pytest
from scripts.prepare_four_file_run import prepare


def test_preparation_fails_closed_on_dirty_source_checkout(tmp_path):
    repo = tmp_path / "source"
    repo.mkdir()
    subprocess.run(["git", "init", str(repo)], check=True, capture_output=True)
    subprocess.run(
        ["git", "-C", str(repo), "config", "user.email", "benchmark@example.invalid"],
        check=True,
    )
    subprocess.run(
        ["git", "-C", str(repo), "config", "user.name", "Benchmark Test"], check=True
    )
    (repo / "tracked.txt").write_text("baseline\n")
    subprocess.run(["git", "-C", str(repo), "add", "tracked.txt"], check=True)
    subprocess.run(["git", "-C", str(repo), "commit", "-m", "baseline"], check=True)
    (repo / "untracked.txt").write_text("dirty\n")

    with pytest.raises(ValueError, match="must be clean"):
        prepare(
            repo=repo,
            source_data=tmp_path / "source-data",
            sources=[],
            reference=tmp_path / "reference.json",
            extractions=tmp_path / "extractions",
            model_id="pinned-model@revision",
            search_mode="keyword",
            budget_tokens=8000,
            output_root=tmp_path / "run",
            commit="HEAD",
        )

    assert not (tmp_path / "run").exists()


def test_private_tree_removes_group_and_world_permissions(tmp_path):
    from scripts.prepare_four_file_run import private_tree

    root = tmp_path / "private"
    root.mkdir(mode=0o755)
    child = root / "data.txt"
    child.write_text("private")
    child.chmod(0o644)

    private_tree(root)

    assert root.stat().st_mode & 0o077 == 0
    assert child.stat().st_mode & 0o077 == 0