import unittest
from pathlib import Path

from policyfaultbench.safety import (
    SafetyViolation,
    assert_sandbox_path,
    contains_credential_like_value,
    validate_host_is_non_public,
)


class SafetyTests(unittest.TestCase):
    def test_reserved_and_private_hosts_are_allowed(self):
        for host in ("localhost", "service.test", "192.168.1.10"):
            validate_host_is_non_public(host)

    def test_public_host_is_rejected(self):
        with self.assertRaises(SafetyViolation):
            validate_host_is_non_public("example.org")

    def test_path_escape_is_rejected(self):
        with self.assertRaises(SafetyViolation):
            assert_sandbox_path(Path("/tmp/pfb-root"), Path("../outside"))

    def test_credential_markers_are_detected(self):
        self.assertTrue(contains_credential_like_value({"x": "sk-proj-example"}))
        self.assertFalse(contains_credential_like_value({"x": "PFB-CANARY-NONSECRET"}))


if __name__ == "__main__":
    unittest.main()
