learningcircuit--local-deep-research/tests/hooks/test_check_env_vars.py

"""
Tests for the check-env-vars pre-commit hook.

Covers regressions for the substring-based filename exemption:
- `"test_" in filepath` matched `protest_handler.py` (contains 'test_')
- `"settings/" in filepath` matched `foo_settings_override.py`
- Segment / basename / prefix / suffix matching now used instead.
"""

import subprocess
import sys
import tempfile
from pathlib import Path


HOOK_SCRIPT = (
    Path(__file__).parent.parent.parent
    / ".pre-commit-hooks"
    / "check-env-vars.py"
)


def _run_hook(
    content: str, filename: str = "service.py"
) -> subprocess.CompletedProcess:
    with tempfile.TemporaryDirectory() as d:
        path = Path(d) / filename
        path.parent.mkdir(parents=True, exist_ok=True)
        path.write_text(content)
        return subprocess.run(
            [sys.executable, str(HOOK_SCRIPT), str(path)],
            capture_output=True,
            text=True,
        )


VIOLATION = 'import os\nx = os.environ.get("LDR_FOO")\n'


class TestSubstringExemptionBugFixed:
    """Production files whose paths merely contain an allowlist substring
    must no longer be silently exempted."""

    def test_protest_handler_scanned(self):
        """'protest_handler.py' contains substring 'test_'."""
        result = _run_hook(VIOLATION, "protest_handler.py")
        assert result.returncode == 1
        assert "LDR_FOO" in result.stdout

    def test_foo_settings_override_scanned(self):
        """'foo_settings_override.py' contains substring 'settings/' is
        false, but 'foo_settings.py' would have matched 'settings' as a
        bare string if we weren't segment-anchored. Use a path where
        'settings' is part of the basename, not a directory segment."""
        result = _run_hook(VIOLATION, "foo_settings.py")
        assert result.returncode == 1

    def test_scriptlike_basename_scanned(self):
        """A basename containing 'scripts' is not a scripts/ directory."""
        result = _run_hook(VIOLATION, "typescripts_loader.py")
        assert result.returncode == 1


class TestRealExemptionsStillApply:
    """All the genuine exemption cases must still work."""

    def test_settings_directory_exempt(self):
        result = _run_hook(VIOLATION, "src/settings/foo.py")
        assert result.returncode == 0

    def test_tests_directory_exempt(self):
        result = _run_hook(VIOLATION, "tests/helpers.py")
        assert result.returncode == 0

    def test_test_prefix_exempt(self):
        result = _run_hook(VIOLATION, "test_foo.py")
        assert result.returncode == 0

    def test_underscore_test_suffix_exempt(self):
        """Go-style *_test.py — previously this was matched as a bare
        substring which happened to work, but now is handled explicitly."""
        result = _run_hook(VIOLATION, "foo_test.py")
        assert result.returncode == 0

    def test_migrations_directory_exempt(self):
        result = _run_hook(VIOLATION, "migrations/0001_init.py")
        assert result.returncode == 0

    def test_scripts_directory_exempt(self):
        result = _run_hook(VIOLATION, "scripts/bootstrap.py")
        assert result.returncode == 0

    def test_examples_directory_exempt(self):
        result = _run_hook(VIOLATION, "examples/demo.py")
        assert result.returncode == 0

    def test_log_utils_exempt(self):
        result = _run_hook(VIOLATION, "log_utils.py")
        assert result.returncode == 0

    def test_sqlcipher_utils_exempt(self):
        result = _run_hook(VIOLATION, "sqlcipher_utils.py")
        assert result.returncode == 0

    def test_server_config_exempt(self):
        result = _run_hook(VIOLATION, "server_config.py")
        assert result.returncode == 0

    def test_security_rate_limiter_exempt(self):
        """Path-anchored entry: 'security/rate_limiter.py'."""
        result = _run_hook(VIOLATION, "security/rate_limiter.py")
        assert result.returncode == 0


class TestBareRateLimiterStillFlagged:
    """A file literally named rate_limiter.py at a different path must
    NOT be exempt (only the security/ one is)."""

    def test_rate_limiter_outside_security_flagged(self):
        result = _run_hook(VIOLATION, "other/rate_limiter.py")
        assert result.returncode == 1


class TestRealViolation:
    """Sanity check — normal production files are still flagged."""

    def test_production_module_flagged(self):
        result = _run_hook(VIOLATION, "service.py")
        assert result.returncode == 1