from pathlib import Path


def test_addon_does_not_expose_internal_learning_parameters() -> None:
    config = Path("addon/config.yaml").read_text(encoding="utf-8")

    assert "\noptions:" not in config
    assert "\nschema:" not in config
    assert "prediction_confidence" not in config
    assert "execution_cooldown_seconds" not in config


def test_addon_version_invalidates_application_build_layer() -> None:
    dockerfile = Path("addon/Dockerfile").read_text(encoding="utf-8")

    config_copy = dockerfile.index("COPY config.yaml /tmp/addon-config.yaml")
    repository_clone = dockerfile.index("git clone --depth 1 --branch main")
    assert config_copy < repository_clone


def test_addon_does_not_trust_forwarded_lan_ips() -> None:
    run_script = Path("addon/run.sh").read_text(encoding="utf-8")

    assert "--proxy-headers" not in run_script
    assert "--forwarded-allow-ips" not in run_script