test_nixprovider.py

import json
import tempfile
from pathlib import Path
import logging
from typing import cast

import pytest

from abxpkg import Binary, NixProvider, SemVer
from abxpkg.binprovider_nix import (
    NIX_INSTALLER_VERSION,
    nix_installer_artifact,
)
from abxpkg.binprovider import BinProvider


class TestNixProvider:
    @pytest.mark.parametrize(
        ("system", "machine", "artifact_name", "sha256"),
        (
            (
                "linux",
                "x86_64",
                "nix-installer-x86_64-linux",
                "eecf66f62b044f40b0632d8e9ea72ffc3bd3214357d09317117febff748e71b3",
            ),
            (
                "darwin",
                "arm64",
                "nix-installer-aarch64-darwin",
                "f22909a4a816710dddd813bb5ad5958bb2ed100549c9d0edb535bfee8d252e48",
            ),
        ),
    )
    def test_supported_ci_targets_select_pinned_nix_installer_artifact(
        self,
        system,
        machine,
        artifact_name,
        sha256,
    ):
        artifact = nix_installer_artifact(system=system, machine=machine)

        assert artifact.name == artifact_name
        assert artifact.sha256 == sha256
        assert artifact.url == (
            "https://github.com/DeterminateSystems/nix-installer/releases/download/"
            f"v{NIX_INSTALLER_VERSION}/{artifact_name}"
        )

    def test_unsupported_nix_installer_target_fails_explicitly(self):
        with pytest.raises(
            RuntimeError,
            match=(
                "does not support plan9/mips64; supported targets are "
                "linux/x86_64 and darwin/arm64"
            ),
        ):
            nix_installer_artifact(system="plan9", machine="mips64")

    def test_managed_nix_installer_artifact_is_verified_and_executable(self, tmp_path):
        provider = NixProvider(install_root=tmp_path / "nix-profile")
        artifact = nix_installer_artifact()
        installer_path = provider.download_nix_installer()

        assert installer_path.is_file()
        assert (
            provider.get_sha256(
                "nix-installer",
                abspath=installer_path,
                no_cache=True,
            )
            == artifact.sha256
        )
        proc = provider.exec(
            bin_name=installer_path,
            cmd=["--version"],
            quiet=True,
        )
        assert proc.returncode == 0, proc.stderr or proc.stdout
        assert proc.stdout.strip() == f"nix-installer {NIX_INSTALLER_VERSION}"

        installer_path.write_bytes(b"corrupt cached installer")
        repaired_path = provider.download_nix_installer()

        assert repaired_path == installer_path
        assert (
            provider.get_sha256(
                "nix-installer",
                abspath=repaired_path,
                no_cache=True,
            )
            == artifact.sha256
        )

    def test_nix_installer_command_is_noninteractive_and_disables_diagnostics(self):
        assert NixProvider.nix_installer_install_command() == (
            "install",
            "--no-confirm",
            "--diagnostic-endpoint",
            "",
        )

    def test_installer_binary_is_projected_through_env_bin(self, test_machine):
        provider = NixProvider()
        installer = provider.INSTALLER_BINARY(no_cache=True)

        test_machine.assert_shallow_binary_loaded(
            installer,
            assert_version_command=True,
        )
        assert installer.loaded_binprovider.name == "env"
        assert installer.loaded_abspath is not None
        assert installer.loaded_abspath.parent.name == "bin"
        assert installer.loaded_abspath.parent.parent.name == "env"

    def test_install_root_alias_installs_into_the_requested_profile(self, test_machine):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            install_root = Path(temp_dir) / "nix-profile"
            provider = NixProvider.model_validate(
                {
                    "install_root": install_root,
                    "postinstall_scripts": True,
                    "min_release_age": 0,
                    "install_timeout": 300,
                },
            )

            installed = provider.install("hello")

            test_machine.assert_shallow_binary_loaded(installed)
            assert installed is not None
            assert installed.loaded_abspath is not None
            assert provider.install_root == Path(temp_dir).resolve() / "nix-profile"
            assert provider.bin_dir == Path(temp_dir).resolve() / "nix-profile" / "bin"
            assert installed.loaded_abspath.parent == provider.bin_dir

    def test_provider_direct_methods_exercise_real_lifecycle(self, test_machine):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            provider = NixProvider(
                install_root=Path(temp_dir) / "nix-profile",
                postinstall_scripts=True,
                min_release_age=3,
            )
            test_machine.exercise_provider_lifecycle(provider, bin_name="hello")

    def test_repeated_install_does_not_duplicate_profile_entries(self, test_machine):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            provider = NixProvider(
                install_root=Path(temp_dir) / "nix-profile",
                postinstall_scripts=True,
                min_release_age=3,
            )

            first = provider.install("hello", no_cache=True)
            second = provider.install("hello", no_cache=True)

            test_machine.assert_shallow_binary_loaded(first)
            test_machine.assert_shallow_binary_loaded(second)

            installer_bin = provider.INSTALLER_BINARY(no_cache=True).loaded_abspath
            assert installer_bin is not None
            proc = provider.exec(
                bin_name=installer_bin,
                cmd=[
                    "profile",
                    "list",
                    "--json",
                    "--extra-experimental-features",
                    "nix-command",
                    "--extra-experimental-features",
                    "flakes",
                    "--profile",
                    str(provider.install_root),
                ],
                quiet=True,
            )
            assert proc.returncode == 0, proc.stderr or proc.stdout
            assert set(json.loads(proc.stdout).get("elements", {})) == {"hello"}

    def test_provider_direct_min_version_revalidates_final_installed_package(
        self,
        test_machine,
    ):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            provider = NixProvider(
                install_root=Path(temp_dir) / "nix-profile",
                postinstall_scripts=True,
                min_release_age=3,
            )
            with pytest.raises(ValueError):
                provider.install("hello", min_version=SemVer("999.0.0"))

            loaded = provider.load("hello", quiet=True, no_cache=True)
            test_machine.assert_shallow_binary_loaded(loaded)
            assert loaded is not None
            assert loaded.loaded_version is not None
            required_version = SemVer.parse("999.0.0")
            assert required_version is not None
            assert loaded.loaded_version < required_version

    def test_nix_profile_bin_dir_takes_precedence_over_existing_PATH_entries(
        self,
        test_machine,
    ):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            temp_dir_path = Path(temp_dir)
            ambient_provider = NixProvider(
                install_root=temp_dir_path / "ambient-profile",
                postinstall_scripts=True,
                min_release_age=3,
            )
            ambient_installed = ambient_provider.install("hello")
            assert ambient_installed is not None

            nix_profile = temp_dir_path / "nix-profile"
            provider = NixProvider(
                PATH=f"{ambient_provider.bin_dir}:{NixProvider().PATH}",
                install_root=nix_profile,
                postinstall_scripts=True,
                min_release_age=3,
            )

            installed = provider.install("hello")

            test_machine.assert_shallow_binary_loaded(installed)
            assert installed is not None
            assert installed.loaded_abspath is not None
            assert provider.install_root == temp_dir_path.resolve() / "nix-profile"
            assert provider.bin_dir == temp_dir_path.resolve() / "nix-profile" / "bin"
            assert installed.loaded_abspath.parent == provider.bin_dir
            assert ambient_installed.loaded_abspath is not None
            assert ambient_installed.loaded_abspath.parent == ambient_provider.bin_dir

    def test_uninstall_preserves_other_profile_entries(self, test_machine):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            provider = NixProvider(
                install_root=Path(temp_dir) / "nix-profile",
                postinstall_scripts=True,
                min_release_age=3,
            ).get_provider_with_overrides(
                overrides={
                    "hello": {"install_args": ["hello", "figlet"]},
                },
            )

            installed = provider.install("hello")
            test_machine.assert_shallow_binary_loaded(installed)
            assert provider.load("figlet", quiet=True, no_cache=True) is not None

            assert provider.uninstall("hello")
            assert provider.load("hello", quiet=True, no_cache=True) is None
            assert provider.load("figlet", quiet=True, no_cache=True) is not None

    def test_unsupported_security_controls_warn_and_continue(
        self,
        test_machine,
        caplog,
    ):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            with caplog.at_level(logging.WARNING, logger="abxpkg.binprovider"):
                installed = NixProvider(
                    install_root=Path(temp_dir) / "bad-profile",
                    postinstall_scripts=False,
                    min_release_age=1,
                ).install("hello")
            test_machine.assert_shallow_binary_loaded(installed)
            assert "ignoring unsupported min_release_age=1" in caplog.text
            assert "ignoring unsupported postinstall_scripts=False" in caplog.text

            caplog.clear()
            binary = Binary(
                name="hello",
                binproviders=cast(
                    list[BinProvider],
                    [
                        NixProvider(
                            install_root=Path(temp_dir) / "ok-profile",
                            postinstall_scripts=False,
                            min_release_age=1,
                        ),
                    ],
                ),
                postinstall_scripts=False,
                min_release_age=1,
            )
            with caplog.at_level(logging.WARNING, logger="abxpkg.binprovider"):
                installed = binary.install()
            test_machine.assert_shallow_binary_loaded(installed)
            assert "ignoring unsupported min_release_age=1" in caplog.text
            assert "ignoring unsupported postinstall_scripts=False" in caplog.text

    def test_binary_direct_methods_exercise_real_lifecycle(self, test_machine):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            binary = Binary(
                name="hello",
                binproviders=cast(
                    list[BinProvider],
                    [
                        NixProvider(
                            install_root=Path(temp_dir) / "nix-profile",
                            postinstall_scripts=True,
                            min_release_age=3,
                        ),
                    ],
                ),
                postinstall_scripts=True,
                min_release_age=3,
            )
            test_machine.exercise_binary_lifecycle(binary)

    def test_provider_dry_run_does_not_install_hello(self, test_machine):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"

        with tempfile.TemporaryDirectory() as temp_dir:
            provider = NixProvider(
                install_root=Path(temp_dir) / "nix-profile",
                postinstall_scripts=True,
                min_release_age=3,
            )
            test_machine.exercise_provider_dry_run(provider, bin_name="hello")

    def test_search_finds_real_nixpkgs_attr_and_install_works(self, test_machine):
        assert NixProvider().INSTALLER_BINARY(), "nix is required on this host"
        with tempfile.TemporaryDirectory() as temp_dir:
            provider = NixProvider(
                install_root=Path(temp_dir) / "nix-profile",
                postinstall_scripts=True,
                min_release_age=3,
            )
            results = provider.search("hello")
            assert results, "nix search nixpkgs hello should return matches"
            names = [r.name for r in results]
            assert "hello" in names
            match = next(r for r in results if r.name == "hello")
            assert match.overrides == {
                "nix": {
                    "install_args": [
                        "https://channels.nixos.org/nixpkgs-unstable/"
                        "nixexprs.tar.xz#hello",
                    ],
                },
            }
            assert match.loaded_abspath is None
            assert match.loaded_version is None
            installed = match.install()
            test_machine.assert_shallow_binary_loaded(installed)
            assert installed.name == "hello"