"""Keep public package sources and release inclusion rules free of case data."""

import json
import re
import tomllib
import unittest
from importlib.resources import files
from pathlib import Path


class ReleaseHygieneTests(unittest.TestCase):
    def test_public_package_and_explicit_release_allowlist(self) -> None:
        package = files("netscaler_triage")
        personal = re.compile(
            r"/(?:Users|home)/[^\s/]+|[A-Za-z]:[\\/]Users[\\/][^\s\\/]+"
            r"|(?im:^[ \t]*(?:Bearbeitung|Prepared by|Analyst|Investigator|Customer|Case ID)\s*:)"
        )
        stack = [package]
        while stack:
            directory = stack.pop()
            for entry in directory.iterdir():
                if entry.is_dir() and entry.name != "__pycache__":
                    stack.append(entry)
                elif entry.name.endswith((".py", ".json", ".yml", ".yaml")):
                    self.assertIsNone(
                        personal.search(entry.read_text(encoding="utf-8")), entry.name
                    )
        public = json.loads(package.joinpath("data", "threat_intel.json").read_text())
        sources = {entry["id"] for entry in public["sources"]}
        for indicator in public["indicators"]:
            self.assertEqual(indicator["status"], "reference_only")
            self.assertTrue(set(indicator["source_ids"]) <= sources)

        # Installed-wheel tests lack repository metadata; package checks above still run.
        project = Path(__file__).resolve().parents[1] / "pyproject.toml"
        if project.is_file():
            config = tomllib.loads(project.read_text(encoding="utf-8"))
            allowed = {
                "src/",
                "tests/",
                "typing_stubs/",
                "examples/",
                "README.txt",
                "README.md",
                "RULES.txt",
                "VALIDATION.txt",
                "THREAT_INTELLIGENCE.txt",
                "LICENSE.txt",
                "config/threat_intel.json",
                "uv.lock",
                ".python-version",
                ".gitignore",
                "pyproject.toml",
            }
            ignore = (project.parent / ".gitignore").read_text().splitlines()
            self.assertTrue({"private/", "/private/"} & set(ignore))
            included = set(config["tool"]["hatch"]["build"]["targets"]["sdist"]["include"])
            self.assertFalse(any("private" in entry for entry in included))
            self.assertTrue(
                included <= allowed, f"Unreviewed release include entries: {included - allowed}"
            )


if __name__ == "__main__":
    unittest.main()