"""Non-destructive tests for firewall helpers.

These DO NOT call netsh — they only exercise pure functions / branches that
should never modify the system firewall state.
"""
from __future__ import annotations

import sys
import unittest
from unittest.mock import patch

from proxy_chain_manager import firewall


@unittest.skipUnless(sys.platform == "win32", "Windows-only firewall API")
class TestEmergencyDisengageGuard(unittest.TestCase):
    def test_no_op_when_not_engaged(self) -> None:
        """emergency_disengage() must NOT touch firewall state when our rules
        are not present (the audit fix to C-08)."""
        called = []
        with patch.object(firewall, "is_engaged", return_value=False), \
             patch.object(firewall, "_set_outbound_policy",
                          side_effect=lambda *_a, **_k: called.append("policy")), \
             patch.object(firewall, "_delete_rules",
                          side_effect=lambda *_a, **_k: called.append("delete")):
            firewall.emergency_disengage()
        self.assertEqual(called, [])

    def test_runs_disengage_when_engaged(self) -> None:
        called = []
        with patch.object(firewall, "is_engaged", return_value=True), \
             patch.object(firewall, "_set_outbound_policy",
                          side_effect=lambda *_a, **_k: called.append("policy")), \
             patch.object(firewall, "_delete_rules",
                          side_effect=lambda *_a, **_k: called.append("delete")):
            firewall.emergency_disengage()
        self.assertIn("policy", called)
        self.assertIn("delete", called)


if __name__ == "__main__":
    unittest.main()