"""Namespace guards must reject unsafe handoffs before any mount operation."""
import argparse
import unittest
from unittest.mock import patch

import linux_loader_smoke


class NamespaceGuardTests(unittest.TestCase):
    def test_same_namespace_refuses_mount_before_runtime_access(self):
        args = argparse.Namespace(outer_pid=123, outer_namespace=42)
        with patch.object(linux_loader_smoke, "namespace", return_value=42), \
                patch.object(linux_loader_smoke.subprocess, "run") as run:
            with self.assertRaisesRegex(RuntimeError, "Private mount namespace"):
                linux_loader_smoke.isolated_check(args, {"mount": "mount"})
            run.assert_not_called()

    def test_changed_outer_namespace_refuses_mount(self):
        args = argparse.Namespace(outer_pid=123, outer_namespace=42)
        with patch.object(linux_loader_smoke, "namespace", return_value=43), \
                patch.object(linux_loader_smoke.subprocess, "run") as run:
            with self.assertRaisesRegex(RuntimeError, "Private mount namespace"):
                linux_loader_smoke.isolated_check(args, {"mount": "mount"})
            run.assert_not_called()


if __name__ == "__main__":
    unittest.main()