"""Fail-closed leak-detection contract tests."""
from __future__ import annotations

import unittest

from proxy_chain_manager.leak_detect import is_chain_leak, leak_reason


class TestFailClosed(unittest.TestCase):
    def test_unknown_real_ip_is_leak(self) -> None:
        """When the direct IP could not be determined we cannot prove the
        chain is forwarding — the README promises fail-closed behavior."""
        self.assertTrue(is_chain_leak("5.6.7.8", None, vpn_active=False))
        self.assertTrue(is_chain_leak("5.6.7.8", None, vpn_active=True))

    def test_unknown_exit_ip_is_leak(self) -> None:
        self.assertTrue(is_chain_leak(None, "1.2.3.4", vpn_active=False))

    def test_leak_reason_explains_unknown_direct_ip(self) -> None:
        msg = leak_reason("5.6.7.8", None, vpn_active=False)
        self.assertIn("direct IP", msg)
        self.assertIn("fail-closed", msg.lower())


if __name__ == "__main__":
    unittest.main()