"""synapse/curry_core.py (vendored) + synapse/curry_store.py (NexusOS's preload).

Two concerns: the vendor sync didn't silently drop the sandbox fix from
https://github.com/Athena-Pro/Curry/pull/4, and curry_store gives NexusOS a
live instance for the registered chat tools.
"""
import pytest

from synapse.curry_core import Curry, TypeSignature
from synapse import curry_store


def test_curry_store_is_preloaded_and_open():
    # curry_store.curry_db is a module-level singleton constructed at import
    # time (mirrors synapse.memory.store.store / synapse.playbooks.store.playbook_store)
    # - by the time this test runs, it has already opened its database file.
    assert isinstance(curry_store.curry_db, Curry)
    assert curry_store.curry_db.conn.execute("SELECT 1").fetchone()[0] == 1


def test_curry_db_path_matches_nexus_config(tmp_path, monkeypatch):
    from synapse import nexus_config
    assert str(curry_store.curry_db.db_path) == str(nexus_config.CURRY_DB)


def test_vendored_sandbox_fix_rejects_format_dunder_escape(tmp_path):
    # Regression test for the vendored fix: a body that hides dunder-attribute
    # traversal inside a str.format() field spec must still be rejected at
    # declare time, not just the literal '.__class__' form. If a future
    # re-vendor from upstream drops the fix, this is what catches it.
    db = Curry(str(tmp_path / "sandbox_check.db"))
    db.declare_function("helper", 1, "1")

    exploit = "'{0.__globals__}'.format(helper)"
    with pytest.raises(ValueError, match="format"):
        db.declare_function("evil", 1, exploit, function_bindings={"helper": 1})

    # the original, always-caught dunder-attribute form stays blocked too
    with pytest.raises(ValueError):
        db.declare_function("evil2", 1, "x.__class__", expected_args=["x"])

    db.close()


def test_vendored_curry_basic_versioning_roundtrip(tmp_path):
    db = Curry(str(tmp_path / "roundtrip.db"))
    db.declare_constant("rate", 1, 0.1, TypeSignature.FLOAT64.value)
    db.declare_function(
        "apply_rate", 1, "amount * (1 + rate)",
        constant_bindings={"rate": 1}, expected_args=["amount"],
    )
    assert db.call_function("apply_rate", 1, {"amount": 100}) == 110.00000000000001
    db.close()