from pathlib import Path

UNITS = Path(__file__).resolve().parent.parent / "systemd"

# Settings that make systemd set no_new_privs for a unit that does not run as root
# (systemd.exec(5)). sudo cannot gain root under that flag.
IMPLY_NO_NEW_PRIVILEGES = (
    "NoNewPrivileges", "SystemCallFilter", "SystemCallArchitectures", "RestrictAddressFamilies",
    "RestrictNamespaces", "PrivateDevices", "ProtectKernelTunables", "ProtectKernelModules",
    "ProtectKernelLogs", "ProtectClock", "MemoryDenyWriteExecute", "RestrictRealtime",
    "RestrictSUIDSGID", "DynamicUser", "LockPersonality",
)


def settings(unit):
    result = {}
    for line in (UNITS / unit).read_text().splitlines():
        key, sep, value = line.partition("=")
        if sep and not line.startswith("#"):
            result[key.strip()] = value.strip()
    return result


def test_manager_can_use_sudo_for_the_helper():
    unit = settings("daynivo-kiosk-manager.service")
    assert unit["User"] == "daynivo"
    for key in IMPLY_NO_NEW_PRIVILEGES:
        assert unit.get(key, "no") in ("no", "false", ""), key
    for key in ("ProtectSystem", "ProtectHome", "PrivateTmp"):
        assert key not in unit, key