#!/usr/bin/env python3

import base64
import hashlib
import re
from pathlib import Path
import unittest
import zlib


ROOT = Path(__file__).resolve().parents[1]
POLICY = ROOT / "variants/sensecap_indicator-espnow/IndicatorFontRecoveryPolicy.h"
CLIENT = ROOT / "variants/sensecap_indicator-espnow/IndicatorFontClient.cpp"
DISPLAY = ROOT / "variants/sensecap_indicator-espnow/SCIndicatorDisplay.h"
PROFILE = ROOT / "variants/sensecap_indicator-espnow/platformio.ini"
RP2040 = ROOT / "tools/sensecap_indicator_rp2040/src/main.cpp"
STAGE_V2_PROTOCOL = ROOT / "src/helpers/IndicatorFontStageV2Protocol.h"
ASSET = ROOT / "variants/sensecap_indicator-espnow/sd/ui-font.vlw"


def source(path: Path) -> str:
    return path.read_text()


def function_body(text: str, signature: str, next_signature: str) -> str:
    start = text.index(signature)
    end = text.index(next_signature, start)
    return text[start:end]


def profile_section(name: str) -> str:
    text = source(PROFILE)
    match = re.search(
        rf"^\[{re.escape(name)}\]\n(?P<body>.*?)(?=^\[|\Z)",
        text,
        re.MULTILINE | re.DOTALL,
    )
    if match is None:
        raise AssertionError(f"missing profile section {name}")
    return match.group("body")


class IndicatorFontRecoveryTest(unittest.TestCase):
    def test_compiled_asset_identity_matches_checked_in_file(self):
        policy = source(POLICY)
        client = source(CLIENT)
        data = ASSET.read_bytes()

        size = int(re.search(r"kAssetSize = (\d+)", policy).group(1))
        crc = int(re.search(r"kAssetCrc32 = 0x([0-9a-f]+)", policy).group(1), 16)
        sha = re.search(r'kAssetSha256\[\] =\s*"([0-9a-f]{64})"', policy).group(1)

        self.assertEqual(len(data), size)
        self.assertEqual(zlib.crc32(data) & 0xFFFFFFFF, crc)
        self.assertEqual(hashlib.sha256(data).hexdigest(), sha)
        digest_initializer = client[
            client.index("EXPECTED_SHA256[32]") : client.index(
                "enum class FontInfoResult"
            )
        ]
        compiled_digest = bytes(
            int(value, 16)
            for value in re.findall(r"0x([0-9a-f]{2})", digest_initializer)
        )
        self.assertEqual(compiled_digest.hex(), sha)

    def test_source_is_immutable_https_and_tls_is_never_disabled(self):
        policy = source(POLICY)
        client = source(CLIENT)
        url_literals = re.findall(
            r'"([^"]*)"',
            policy[policy.index("kAssetUrl") : policy.index("kAssetSize")],
        )
        url = "".join(url_literals)

        self.assertRegex(
            url,
            r"^https://api\.github\.com/repos/mikecarper/MeshCore/git/blobs/"
            r"[0-9a-f]{40}$",
        )
        self.assertNotIn("setInsecure", client)
        self.assertNotIn("client.setCACertBundle(", client)
        self.assertIn("client.setCACert(FONT_TLS_GITHUB_ROOT_CA)", client)
        self.assertIn("Accept: application/vnd.github.raw+json", client)
        self.assertIn("X-GitHub-Api-Version: 2026-03-10", client)
        self.assertIn("parseHttpStatusCode(line, status_code)", client)

        pem_match = re.search(
            r'FONT_TLS_GITHUB_ROOT_CA\[\].*?R"CERT\((.*?)\)CERT";',
            client,
            re.DOTALL,
        )
        self.assertIsNotNone(pem_match)
        pem_lines = [
            line.strip() for line in pem_match.group(1).strip().splitlines()
        ]
        self.assertEqual(pem_lines[0], "-----BEGIN CERTIFICATE-----")
        self.assertEqual(pem_lines[-1], "-----END CERTIFICATE-----")
        der = base64.b64decode("".join(pem_lines[1:-1]), validate=True)
        self.assertEqual(
            hashlib.sha256(der).hexdigest(),
            "c90f26f0fb1b4018b22227519b5ca2b53e2ca5b3be5cf18efe1bef47380c5383",
        )

    def test_wifi_only_recovery_bootstraps_a_bounded_tls_clock(self):
        policy = source(POLICY)
        client = source(CLIENT)
        proof = function_body(
            client, "bool fontTlsClockProofValid", "bool prepareTlsClock"
        )
        callback = function_body(
            client, "void clearFontNtpCallback", "bool fontTlsClockProofValid"
        )
        clock = function_body(
            client, "bool prepareTlsClock", "uint32_t remainingHttpHeaderTimeout"
        )
        response = function_body(
            client, "RecoveryAttemptOutcome openAssetResponse", "bool writeAll"
        )
        transfer = function_body(
            client,
            "RecoveryAttemptOutcome downloadAndInstallAsset",
            "void finishRecoveryFailure",
        )

        self.assertIn("kAssetPublishedEpoch = 1787708237UL", policy)
        self.assertIn("kNtpSyncWaitMillis = 15000UL", policy)
        self.assertIn(
            "fontNtpTimeReceived.store(false, std::memory_order_release)",
            clock,
        )
        self.assertIn("sntp_set_time_sync_notification_cb(noteFontNtpTime)", clock)
        self.assertIn("sntp_set_sync_status(SNTP_SYNC_STATUS_RESET)", clock)
        self.assertIn('configTime(0, 0, "time.cloudflare.com"', clock)
        self.assertIn("OperationLease sntp_operation", clock)
        self.assertIn("processWideCoordinator()", clock)
        self.assertIn("if (!sntp_operation.tryAcquire())", clock)
        self.assertNotIn("sntp_set_time_sync_notification_cb(nullptr)", clock)
        self.assertIn("sntp_set_time_sync_notification_cb(nullptr)", callback)
        self.assertIn("processWideCoordinator().owns(generation)", callback)
        self.assertIn(
            "fontNtpTimeReceived.load(std::memory_order_acquire)", proof
        )
        self.assertIn("WiFi.status() == WL_CONNECTED", proof)
        self.assertIn("mesh::tls_clock::proofIsValid", proof)
        self.assertIn("mesh::tls_clock::proofAgeIsValid", proof)
        self.assertIn("mesh::tls_clock::proofGenerationIsValid", proof)
        self.assertIn("FONT_TLS_PROOF_MAX_AGE_MS = 300000UL", client)
        self.assertIn("const time_t now = time(nullptr)", clock)
        self.assertIn("fontTlsClockProofValid(now)", clock)
        self.assertIn(
            "now >= (time_t)mesh::indicator_font::kAssetPublishedEpoch", clock
        )
        self.assertNotIn("(uint32_t)time(nullptr)", clock)
        self.assertIn("WiFi.status() != WL_CONNECTED", clock)
        self.assertNotIn("alreadyPlausible", clock)
        self.assertTrue(clock.rstrip().endswith("}"))
        self.assertIn("return false;", clock)
        self.assertIn("prepareTlsClock()", transfer)
        self.assertLess(
            transfer.index("prepareTlsClock()"),
            transfer.index("openAssetResponse("),
        )
        self.assertIn("const time_t tls_now = time(nullptr)", response)
        proof_check = response.index("fontTlsClockProofValid(tls_now)")
        tls_connect = response.index("client.connect(host, 443)")
        self.assertLess(proof_check, tls_connect)
        self.assertIn(
            "std::atomic<bool> fontNtpTimeReceived{false}", client
        )
        self.assertIn(
            "fontNtpTimeReceived.store(true, std::memory_order_release)",
            client,
        )

    def test_release_source_has_no_forced_download_interruption(self):
        client = source(CLIENT)
        self.assertNotIn("DOWNLOAD_TEST_INTERRUPT_AT", client)
        self.assertNotIn("test hook: closing initial HTTP response", client)

    def test_http_headers_have_one_total_deadline(self):
        client = source(CLIENT)
        response = function_body(
            client, "RecoveryAttemptOutcome openAssetResponse", "bool writeAll"
        )
        self.assertIn("HTTP_HEADER_TOTAL_TIMEOUT_MS = 30000UL", client)
        self.assertIn("remainingHttpHeaderTimeout(headerStarted)", response)
        self.assertNotIn(
            "readHttpLine(client, line, sizeof(line), HTTP_LINE_TIMEOUT_MS)",
            response,
        )

    def test_http_wire_parser_is_bounded_and_rejects_ambiguous_framing(self):
        client = source(CLIENT)
        reader = function_body(
            client, "HttpLineResult readHttpLine", "bool isSecurityCriticalHttpHeader"
        )
        decimal = function_body(
            client, "bool parseUnsignedDecimalHeader", "bool parseHttpStatusCode"
        )
        response = function_body(
            client, "RecoveryAttemptOutcome openAssetResponse", "bool writeAll"
        )

        self.assertRegex(client, r"HTTP_HEADER_LIMIT = (?:6[4-9]|[7-9][0-9]|\d{3,})")
        self.assertIn("HTTP_WIRE_LINE_LIMIT = 2048", client)
        drain = reader.index("while (client.available())")
        self.assertIn(
            "millis() - started >= timeout_millis", reader[drain:]
        )
        self.assertIn("++wire_length > HTTP_WIRE_LINE_LIMIT", reader)
        self.assertIn("HttpLineResult::TooLong", reader)

        # Decimal framing accepts digits only, with optional surrounding OWS;
        # strtoul-style signs and overflow are not accepted.
        self.assertIn("*value < '0' || *value > '9'", decimal)
        self.assertIn("UINT64_MAX - digit", decimal)
        self.assertNotIn("strtoul", response)
        self.assertIn("parsed > MAX_FONT_BYTES", response)

        # Reject every obsolete folded field before handling either retained
        # or overflowed extension headers.
        obs_fold = response.index("if (line[0] == ' ' || line[0] == '\\t')")
        overflow = response.index("if (line_result == HttpLineResult::Overflow)")
        self.assertLess(obs_fold, overflow)

    def test_non_200_headers_are_parsed_and_failures_are_classified(self):
        client = source(CLIENT)
        response = function_body(
            client, "RecoveryAttemptOutcome openAssetResponse", "bool writeAll"
        )
        classify = function_body(
            client, "RecoveryAttemptOutcome classifyHttpResponse", "bool splitHttpsUrl"
        )
        finish = function_body(
            client,
            "void finishRecoveryFailure(const RecoveryAttemptOutcome& outcome)",
            "void finishRecoveryFailure()",
        )

        # The status is recorded first, but classification happens only after
        # Retry-After and X-RateLimit-Reset have been read from the full block.
        self.assertIn('"Retry-After:"', response)
        self.assertIn('"X-RateLimit-Reset:"', response)
        self.assertGreater(
            response.index("classifyHttpResponse("),
            response.index("while (header_count <= HTTP_HEADER_LIMIT)"),
        )
        self.assertNotIn("status_code != 200", response)

        self.assertIn("status_code == 403 || status_code == 429", classify)
        self.assertIn("retry_after_seconds", classify)
        self.assertIn("rate_reset_epoch", classify)
        self.assertIn("HTTP_RATE_LIMIT_MIN_DELAY_MS", classify)
        self.assertIn("HTTP_RATE_LIMIT_FALLBACK_DELAY_MS", classify)
        self.assertIn("RecoveryAttemptDisposition::RateLimited", classify)
        self.assertIn("status_code >= 500 && status_code <= 599", classify)
        self.assertIn("RecoveryAttemptDisposition::RetryableFailure", classify)
        self.assertTrue(
            classify.rstrip().endswith(
                "return recoveryOutcome(RecoveryAttemptDisposition::PermanentFailure);\n}"
            )
        )

        self.assertIn("outcome.retryDelayMillis > delay_millis", finish)
        self.assertIn("outcome.retryDelayMillis", finish)
        self.assertIn(
            "outcome.disposition == RecoveryAttemptDisposition::PermanentFailure",
            finish,
        )
        self.assertIn("recoveryState = RecoveryState::Exhausted", finish)

    def test_valid_current_font_does_not_arm_download(self):
        client = source(CLIENT)
        load = client[client.index("uint8_t* IndicatorFontClient::load") :]
        self.assertIn("if (!loaded.currentAsset)", load)
        self.assertNotIn(
            "armRecovery(mesh::indicator_font::RecoveryNeed::None)", load
        )
        self.assertIn("loaded.currentAsset = loaded.size ==", client)
        self.assertIn("memcmp(digest, EXPECTED_SHA256", client)

    def test_length_and_digest_fail_before_commit(self):
        client = source(CLIENT)
        response = function_body(
            client, "RecoveryAttemptOutcome openAssetResponse", "bool writeAll"
        )
        transfer = function_body(
            client,
            "RecoveryAttemptOutcome downloadAndInstallAsset",
            "void finishRecoveryFailure",
        )

        self.assertIn("mesh::indicator_font::kAssetSize - requested_offset", response)
        self.assertIn("content_length != expected_content_length", response)
        self.assertIn("Transfer-Encoding:", response)
        self.assertIn("Content-Encoding:", response)
        self.assertIn("HTTP_HEADER_LIMIT", response)
        self.assertIn("DOWNLOAD_TOTAL_TIMEOUT_MS", transfer)
        self.assertIn("DOWNLOAD_IDLE_TIMEOUT_MS", transfer)
        self.assertLess(transfer.index("digest_ok"), transfer.index("MCFONT COMMIT"))
        self.assertLess(transfer.index("if (!digest_ok)"), transfer.index("Serial2.begin"))

    def test_range_resume_keeps_one_buffer_and_sha_stream_and_is_strict(self):
        client = source(CLIENT)
        response = function_body(
            client, "RecoveryAttemptOutcome openAssetResponse", "bool writeAll"
        )
        transfer = function_body(
            client,
            "RecoveryAttemptOutcome downloadAndInstallAsset",
            "void finishRecoveryFailure",
        )
        content_range = function_body(
            client, "bool parseContentRangeHeader", "bool parseStrongEtagHeader"
        )
        strong_etag = function_body(
            client, "bool parseStrongEtagHeader", "bool parseHttpStatusCode"
        )

        self.assertIn("DOWNLOAD_MAX_RESUME_RECONNECTS = 2", client)
        self.assertIn("const bool is_resume = expected_etag != nullptr", response)
        self.assertIn('"Range: bytes=%lu-%lu\\r\\nIf-Range: %s\\r\\n"', response)
        self.assertIn("const int expected_status = is_resume ? 206 : 200", response)
        self.assertIn("status_code != expected_status", response)
        self.assertIn("content_length != expected_content_length", response)
        self.assertIn("parseContentRangeHeader", response)
        self.assertIn("parseStrongEtagHeader", response)
        self.assertIn("content_range_first != requested_offset", response)
        self.assertIn(
            "content_range_last != mesh::indicator_font::kAssetSize - 1",
            response,
        )
        self.assertIn(
            "content_range_total != mesh::indicator_font::kAssetSize", response
        )
        self.assertIn("strcmp(response_etag, expected_etag) != 0", response)
        self.assertIn("if (content_range_seen)", response)
        self.assertIn("!etag_seen || !etag_valid", response)
        self.assertIn("transfer_encoding_seen", response)
        self.assertIn("!content_encoding_identity", response)

        # Content-Range and reflected If-Range inputs use strict decimal and
        # quoted-tag grammars; signs, overflow, weak tags, control bytes, and
        # embedded quotes cannot pass or inject another request field.
        self.assertIn('strncasecmp(value, "bytes ", 6)', content_range)
        self.assertIn("parsed_first > parsed_last", content_range)
        self.assertIn("parsed_last >= parsed_total", content_range)
        self.assertIn("parsed_total > MAX_FONT_BYTES", content_range)
        self.assertIn("value[0] != '\"'", strong_etag)
        self.assertIn("value[length - 1] != '\"'", strong_etag)
        self.assertIn("byte < 0x21 || byte > 0x7e || byte == '\"'", strong_etag)

        # One fresh SNTP reply covers the bounded 180-second transfer. Every
        # initial/Range TLS handshake revalidates that proof and the signed
        # wall clock centrally in openAssetResponse().
        self.assertEqual(transfer.count("prepareTlsClock()"), 1)
        proof_check = response.index("fontTlsClockProofValid(tls_now)")
        tls_connect = response.index("client.connect(host, 443)")
        self.assertLess(proof_check, tls_connect)
        self.assertEqual(
            transfer.count("mbedtls_sha256_starts_ret(&sha, 0)"), 1
        )
        self.assertEqual(
            transfer.count("ps_malloc(mesh::indicator_font::kAssetSize)"), 1
        )
        initial = transfer.index("client, 0, nullptr, asset_etag")
        resume = transfer.index("client, received, asset_etag, nullptr, 0")
        self.assertLess(initial, resume)
        self.assertIn(
            "resume_reconnects >= DOWNLOAD_MAX_RESUME_RECONNECTS", transfer
        )
        self.assertIn("discarding %lu unverified bytes", transfer)
        self.assertIn("last_progress = millis()", transfer[resume:])

        # `received` moves only after the complete block has entered the one
        # SHA stream. A failed partial block is overwritten at that boundary.
        update = transfer.index("mbedtls_sha256_update_ret")
        advance = transfer.index("received += wanted", update)
        resume_call = transfer.index("openAssetResponse(", advance)
        self.assertLess(update, advance)
        self.assertLess(advance, resume_call)
        self.assertNotIn("received += filled", transfer)
        self.assertEqual(transfer.count("uint32_t started = millis();"), 1)
        self.assertNotIn("\n    started = millis();", transfer[resume:])
        self.assertLess(transfer.index("digest_ok"), transfer.index("Serial2.begin"))

    def test_download_is_buffered_before_receiver_paced_staging(self):
        client = source(CLIENT)
        protocol = source(STAGE_V2_PROTOCOL)
        transfer = function_body(
            client,
            "RecoveryAttemptOutcome downloadAndInstallAsset",
            "void finishRecoveryFailure",
        )
        self.assertIn("kStageV2ChunkBytes = 512", protocol)
        self.assertIn("ps_malloc(mesh::indicator_font::kAssetSize)", transfer)
        self.assertIn("if (wanted > 16 * 1024) wanted = 16 * 1024", transfer)
        self.assertIn("client.read(asset + received + filled", transfer)
        self.assertLess(transfer.index("client.stop()"), transfer.index("Serial2.begin"))
        self.assertLess(transfer.index("if (!digest_ok)"), transfer.index("Serial2.begin"))
        self.assertIn("free(asset)", transfer)
        self.assertIn("writeAll(Serial2, asset + staged_bytes", transfer)
        self.assertIn("stagedChunkAcknowledged(Serial2, next_staged)", transfer)
        self.assertIn("stageV2ChunkSize(", transfer)
        self.assertIn("advanceStageV2Offset(", transfer)
        self.assertIn("delay(LEGACY_STAGE_PACE_MS)", transfer)

    def test_stage_v2_is_receiver_paced_and_legacy_fallback_is_explicit(self):
        client = source(CLIENT)
        rp = source(RP2040)
        protocol = source(STAGE_V2_PROTOCOL)
        negotiate = function_body(
            client, "bool beginStagedUpload", "bool stagedChunkAcknowledged"
        )
        acknowledge = function_body(
            client,
            "bool stagedChunkAcknowledged",
            "RecoveryAttemptOutcome downloadAndInstallAsset",
        )
        receiver = function_body(
            rp, "void receiveFontStage2", "struct CommandReader"
        )

        self.assertIn("IndicatorFontStageV2Protocol.h", client)
        self.assertIn("IndicatorFontStageV2Protocol.h", rp)
        self.assertIn("kStageV2ChunkBytes = 512", protocol)
        self.assertIn('kStageV2ReadyReply[] = "READY 2 512"', protocol)
        self.assertIn(
            'kStageV2LegacyUnsupportedReply[] = "ERROR COMMAND"', protocol
        )
        self.assertIn('"MCFONT STAGEV2 %lu %08lx %lu"', negotiate)
        self.assertNotIn('"MCFONT STAGE2 ', negotiate)
        self.assertNotIn('"MCFONT STAGE2 ', rp)
        self.assertIn("classifyStageV2BeginReply(replied, reply)", negotiate)
        self.assertIn("StageV2BeginAction::UseAcknowledged", negotiate)
        self.assertIn("StageV2BeginAction::UseLegacy", negotiate)
        # A missing/delayed protocol-2 reply fails closed. Only the old
        # service's explicit unsupported-command response can reach STAGE.
        timeout_failure = negotiate.index("action !=")
        legacy_command = negotiate.index('"MCFONT STAGE %lu %08lx"')
        self.assertLess(timeout_failure, legacy_command)
        self.assertIn("return false;", negotiate[timeout_failure:legacy_command])
        self.assertIn("if (!replied)", negotiate[timeout_failure:legacy_command])

        self.assertIn("parseStageV2Ack(reply, expected_offset)", acknowledge)
        self.assertNotIn("strtoul", acknowledge)

        self.assertIn("RECEIVE_TOTAL_TIMEOUT_MS = 180000", rp)
        self.assertIn("output.print(mesh::indicator_font::kStageV2ReadyReply)", receiver)
        self.assertIn("stageV2ChunkSize(expectedSize, received)", receiver)
        fragment_loop = receiver.index("while (chunkReceived < chunkSize)")
        write = receiver.index("font.write(buffer, chunkSize)")
        ack = receiver.index('output.printf("ACK %lu\\n"')
        self.assertLess(fragment_loop, write)
        self.assertIn("chunkReceived += actual", receiver[fragment_loop:write])
        self.assertLess(write, ack)
        self.assertIn("advanceStageV2Offset(", receiver[write:ack])
        self.assertIn("received = nextReceived", receiver[write:ack])
        checksum = receiver.index("~crc != expectedCrc")
        metadata = receiver.index("writeMetadata(STAGED_META_PATH")
        staged = receiver.index('output.print("STAGED\\n")')
        close = receiver.index("font.close()")
        post_close_deadline = receiver.index(
            "espStage2LastElapsedMs >= RECEIVE_TOTAL_TIMEOUT_MS", close
        )
        failure_handling = receiver.index(
            "if (failure != Stage2Result::Idle)", post_close_deadline
        )
        self.assertLess(ack, checksum)
        self.assertLess(close, post_close_deadline)
        self.assertLess(post_close_deadline, failure_handling)
        self.assertLess(checksum, metadata)
        self.assertLess(metadata, staged)
        self.assertIn(
            '"MCFONT STAGEV2 %lu %lx %lu %n"',
            rp,
        )
        self.assertIn("reader.line[consumed] == 0", rp)

    def test_rp2040_retries_a_transient_sd_mount_for_a_bounded_window(self):
        rp = source(RP2040)
        mount = function_body(rp, "bool mountSdCard", "void serviceSdMount")
        service = function_body(rp, "void serviceSdMount", "void sendInfo")
        setup = function_body(rp, "void setup()", "void loop()")
        loop = rp[rp.index("void loop()") :]

        self.assertIn("SD_MOUNT_RETRY_INTERVAL_MS = 2000", rp)
        self.assertIn("SD_MOUNT_MAX_ATTEMPTS = 30", rp)
        self.assertIn("sdMountAttempts >= SD_MOUNT_MAX_ATTEMPTS", mount)
        self.assertIn("if (sdMountAttempts != 0) SD.end(false)", mount)
        self.assertLess(mount.index("++sdMountAttempts"), mount.index("SD.begin("))
        self.assertIn("sdMountNextAttempt = millis() +", mount)
        self.assertIn("sdMountAttempts >= SD_MOUNT_MAX_ATTEMPTS", service)
        self.assertIn("now - sdMountNextAttempt", service)
        self.assertIn("serviceSdMount(millis())", setup)
        self.assertIn("serviceSdMount(millis())", loop)
        self.assertNotIn("SD.begin(", setup)

    def test_legacy_stage_and_usb_put_have_idle_and_total_deadlines(self):
        rp = source(RP2040)
        receive = function_body(rp, "void receiveFont(Stream&", "// STAGEV2")

        self.assertIn("const uint32_t started = millis()", receive)
        self.assertIn("now - started >= RECEIVE_TOTAL_TIMEOUT_MS", receive)
        self.assertIn("now - lastProgress >= RECEIVE_IDLE_TIMEOUT_MS", receive)
        self.assertIn("timedOut = true", receive)
        self.assertGreater(
            receive.index("millis() - started >= RECEIVE_TOTAL_TIMEOUT_MS"),
            receive.index("font.close()"),
        )
        self.assertIn('timedOut ? "ERROR TIMEOUT\\n"', receive)

    def test_interrupted_stage_cannot_replace_live_font(self):
        rp = source(RP2040)
        recovery = function_body(rp, "void recoverFontTransaction", "bool refreshFontInfo")
        mount = function_body(rp, "bool mountSdCard", "void serviceSdMount")
        stage_install = function_body(rp, "bool installStagedPair", "enum class ReceiveMode")
        receive = function_body(rp, "void receiveFont", "struct CommandReader")

        self.assertNotIn("STAGED_FONT_PATH", recovery)
        self.assertNotIn("STAGED_META_PATH", recovery)
        self.assertIn("cleanStagedFiles();", mount)
        self.assertLess(stage_install.index("validatePairCrc"),
                        stage_install.index("installTemporaryPair"))
        self.assertIn("removeIfPresent(destinationFont)", receive)
        self.assertIn("ReceiveMode::StageOnly", receive)
        self.assertIn('output.print("STAGED\\n")', receive)

    def test_interrupted_pair_renames_are_crc_checked_and_recoverable(self):
        rp = source(RP2040)
        validator = function_body(
            rp, "bool validateStoredPairCrc", "void removeIfPresent"
        )
        promotion = function_body(rp, "bool promotePair", "void recoverFontTransaction")
        recovery = function_body(
            rp, "void recoverFontTransaction", "bool refreshFontInfo"
        )

        self.assertIn("validatePairCrc(fontPath, metadataPath, size, crc)", validator)
        for font_path, metadata_path in (
            ("FONT_PATH", "TEMP_META_PATH"),
            ("FONT_PATH", "BACKUP_META_PATH"),
            ("BACKUP_FONT_PATH", "FONT_META_PATH"),
            ("TEMP_FONT_PATH", "TEMP_META_PATH"),
            ("BACKUP_FONT_PATH", "BACKUP_META_PATH"),
        ):
            self.assertIn(
                f"validateStoredPairCrc({font_path}, {metadata_path}", recovery
            )

        # A reset while moving the old pair to backup leaves its metadata at
        # the live name. Complete that backup before trying the new temp pair,
        # so a failed temp promotion still has a rollback candidate.
        split_backup = recovery.index(
            "validateStoredPairCrc(BACKUP_FONT_PATH, FONT_META_PATH"
        )
        temp_promotion = recovery.index(
            "validateStoredPairCrc(TEMP_FONT_PATH, TEMP_META_PATH"
        )
        self.assertLess(split_backup, temp_promotion)
        self.assertIn("SD.rename(FONT_META_PATH, BACKUP_META_PATH)", recovery)

        # Once the source font has moved, a metadata-rename failure must leave
        # the split pair intact. Recovery also stops after trying any CRC-valid
        # candidate so later fallbacks/cleanup cannot erase that retry state.
        self.assertEqual(promotion.count("removeIfPresent(FONT_PATH)"), 1)
        self.assertNotIn(
            "if (SD.rename(sourceMetadata, FONT_META_PATH)) return true;\n"
            "  removeIfPresent(FONT_PATH)",
            promotion,
        )
        self.assertIn(
            "if (validateStoredPairCrc(TEMP_FONT_PATH, TEMP_META_PATH, size, crc))",
            recovery,
        )
        self.assertIn(
            "if (validateStoredPairCrc(BACKUP_FONT_PATH, BACKUP_META_PATH, size, crc))",
            recovery,
        )
        temp_start = recovery.index(
            "if (validateStoredPairCrc(TEMP_FONT_PATH, TEMP_META_PATH"
        )
        backup_start = recovery.index(
            "if (validateStoredPairCrc(BACKUP_FONT_PATH, BACKUP_META_PATH"
        )
        cleanup_start = recovery.index("removeIfPresent(FONT_PATH)", backup_start)
        for block in (
            recovery[temp_start:backup_start],
            recovery[backup_start:cleanup_start],
        ):
            self.assertIn("promotePair", block)
            self.assertIn("return;", block)

        # Keep the ordinary healthy-boot INFO path fast; full-file CRC reads
        # are reserved for abnormal transaction candidates.
        healthy = recovery.index("validatePair(FONT_PATH, FONT_META_PATH")
        first_transaction_crc = recovery.index("validateStoredPairCrc(")
        self.assertLess(healthy, first_transaction_crc)

    def test_internal_uart_commit_is_separate_from_usb_put(self):
        rp = source(RP2040)
        self.assertIn(
            "CommandReader usbCommands = {Serial, Serial, true, false, false}", rp
        )
        self.assertIn(
            "CommandReader espCommands = {Serial1, Serial1, false, true, true}", rp
        )
        self.assertIn("if (!reader.allowStagedUpload)", rp)
        self.assertIn("if (!reader.allowUpload)", rp)

    def test_retry_budget_and_backoff_are_bounded(self):
        policy = source(POLICY)
        client = source(CLIENT)
        self.assertIn("kMaximumAttemptsPerBoot = 4", policy)
        self.assertIn("30000UL", policy)
        self.assertIn("120000UL", policy)
        self.assertIn("600000UL", policy)
        self.assertIn(
            "recoveryAttempts >= mesh::indicator_font::kMaximumAttemptsPerBoot",
            client,
        )
        self.assertIn("RecoveryState::Exhausted", client)
        self.assertIn("WiFi.status() == WL_CONNECTED", client)

    def test_initial_unavailable_service_gets_bounded_post_wifi_reprobe(self):
        policy = source(POLICY)
        client = source(CLIENT)
        load = function_body(
            client,
            "uint8_t* IndicatorFontClient::load",
            "uint8_t* IndicatorFontClient::serviceRecovery",
        )
        probe = function_body(client, "void serviceProbeTask", "void recoveryTask")
        service = function_body(
            client,
            "uint8_t* IndicatorFontClient::serviceRecovery",
            "void IndicatorFontClient::noteRuntimeFontInstalled",
        )

        self.assertIn("armServiceProbe();", load)
        self.assertIn("RecoveryState::ProbeWaiting", service)
        self.assertIn("WiFi.status() == WL_CONNECTED", service)
        self.assertIn("++serviceProbeAttempts", service)
        self.assertIn("xTaskCreatePinnedToCore(serviceProbeTask", service)

        self.assertIn("LoadedFont loaded = loadFromService();", probe)
        self.assertIn("if (loaded.currentAsset)", probe)
        self.assertIn("RecoveryState::Ready", probe)
        self.assertIn("RecoveryNeed::Missing", probe)
        self.assertIn("RecoveryNeed::Corrupt", probe)
        self.assertIn("RecoveryNeed::VersionMismatch, true", probe)
        self.assertIn("finishServiceProbeFailure();", probe)

        self.assertIn("kMaximumServiceProbeAttemptsPerBoot = 4", policy)
        self.assertIn("serviceProbeRetryDelayAfter", policy)
        self.assertIn("2000UL", policy)
        self.assertIn("5000UL", policy)
        self.assertIn("15000UL", policy)
        self.assertIn(
            ">= mesh::indicator_font::kMaximumServiceProbeAttemptsPerBoot",
            client,
        )

    def test_acknowledged_commit_uses_bounded_local_reprobe_not_redownload(self):
        policy = source(POLICY)
        client = source(CLIENT)
        transfer = function_body(
            client,
            "RecoveryAttemptOutcome downloadAndInstallAsset",
            "void finishRecoveryFailure",
        )
        arm = function_body(
            client, "void armPostCommitProbe", "enum class HttpLineResult"
        )
        finish = function_body(
            client,
            "void finishPostCommitProbeFailure",
            "void serviceProbeTask",
        )
        probe = function_body(
            client, "void postCommitProbeTask", "void recoveryTask"
        )
        recovery = function_body(
            client, "void recoveryTask", "#endif  // INDICATOR_WIFI_FONT_RECOVERY"
        )
        service = function_body(
            client,
            "uint8_t* IndicatorFontClient::serviceRecovery",
            "void IndicatorFontClient::noteRuntimeFontInstalled",
        )

        # An acknowledged COMMIT is distinct from a network/staging failure.
        # A transient post-commit INFO failure, or an ambiguous/missing COMMIT
        # reply, enters the local-only state. Only an explicit ERROR is allowed
        # to resume network attempts.
        self.assertIn("RecoveryAttemptDisposition::CommittedNeedsProbe", client)
        commit = transfer.index("const bool commitReplied = commandReply(")
        committed = transfer.index("const bool committed =", commit)
        rejected = transfer.index("const bool commitExplicitlyRejected", committed)
        verified = transfer.index("bool postCommitVerified = false", commit)
        probe_outcome = transfer.index(
            "RecoveryAttemptDisposition::CommittedNeedsProbe", verified
        )
        self.assertLess(commit, committed)
        self.assertLess(committed, rejected)
        self.assertLess(rejected, verified)
        self.assertLess(verified, probe_outcome)
        self.assertIn("if (!committed)", transfer[commit:probe_outcome])
        unresolved = transfer[
            transfer.index("if (!committed)", commit) :
            transfer.index("return recoveryOutcome(postCommitVerified", commit)
        ]
        self.assertIn("commitExplicitlyRejected", unresolved)
        self.assertIn("RecoveryAttemptDisposition::RetryableFailure", unresolved)
        self.assertIn("RecoveryAttemptDisposition::CommittedNeedsProbe", unresolved)

        self.assertIn("armPostCommitProbe(activateCommittedLive)", recovery)
        network_failure = function_body(
            client,
            "void finishRecoveryFailure(const RecoveryAttemptOutcome& outcome)",
            "void finishRecoveryFailure()",
        )
        self.assertIn(
            "RecoveryAttemptDisposition::CommittedNeedsProbe",
            network_failure,
        )
        self.assertIn("RecoveryState::Exhausted", network_failure)
        local_load = recovery.index("LoadedFont loaded = loadFromService()")
        local_failure = recovery.index("loaded.data == nullptr", local_load)
        local_success = recovery.index("data = loaded.data", local_failure)
        self.assertIn("armPostCommitProbe(true)", recovery[local_failure:local_success])
        self.assertNotIn(
            "finishRecoveryFailure", recovery[local_failure:local_success]
        )

        # The local path preserves the consumed download budget, needs no
        # Wi-Fi/NTP/TLS, and can only become Ready/Complete or retry/exhaust.
        self.assertNotIn("recoveryAttempts =", arm)
        self.assertIn("RecoveryNeed::None", arm)
        self.assertIn("RecoveryState::PostCommitProbeWaiting", arm)
        info_only = probe[
            probe.index("if (!activateLive)") :
            probe.index("LoadedFont loaded = loadFromService();")
        ]
        self.assertIn("probeServiceInfo(size, crc)", info_only)
        self.assertIn("mesh::indicator_font::kAssetSize", info_only)
        self.assertIn("mesh::indicator_font::kAssetCrc32", info_only)
        self.assertIn("RecoveryState::Complete", info_only)
        self.assertNotIn("ps_malloc", info_only)
        self.assertNotIn("loadFromService", info_only)
        self.assertIn("LoadedFont loaded = loadFromService();", probe)
        self.assertIn("loaded.data != nullptr && loaded.currentAsset", probe)
        self.assertIn("RecoveryState::Ready", probe)
        self.assertIn("RecoveryState::Complete", probe)
        self.assertIn("finishPostCommitProbeFailure();", probe)
        for forbidden in (
            "downloadAndInstallAsset",
            "armRecovery",
            "finishRecoveryFailure",
            "prepareTlsClock",
            "WiFi.status",
        ):
            self.assertNotIn(forbidden, probe)

        self.assertIn(
            "kMaximumPostCommitProbeAttemptsPerBoot = 4", policy
        )
        post_commit_policy = policy[
            policy.index("postCommitProbeRetryDelayAfter") :
            policy.index("constexpr bool deadlineReached")
        ]
        self.assertIn("2000UL", post_commit_policy)
        self.assertIn("5000UL", post_commit_policy)
        self.assertIn("15000UL", post_commit_policy)
        self.assertIn("RecoveryState::Exhausted", finish)
        self.assertIn("RecoveryState::PostCommitProbeWaiting", finish)
        self.assertNotIn("RecoveryState::Waiting", finish)

        post_commit_branch = service[
            service.index("RecoveryState::PostCommitProbeWaiting") :
            service.index("RecoveryState::ProbeWaiting")
        ]
        self.assertNotIn("wifiConnected", post_commit_branch)
        self.assertIn("++postCommitProbeAttempts", post_commit_branch)
        self.assertIn("launchPostCommitProbe = true", post_commit_branch)
        self.assertIn("xTaskCreatePinnedToCore(", service)
        self.assertIn("postCommitProbeTask", service)
        self.assertIn("finishPostCommitProbeFailure();", service)

        maximum = int(
            re.search(
                r"kMaximumPostCommitProbeAttemptsPerBoot = (\d+)", policy
            ).group(1)
        )
        downloads_started = 1
        state = "PostCommitProbeWaiting"
        for attempt in range(1, maximum + 1):
            state = (
                "Exhausted"
                if attempt >= maximum
                else "PostCommitProbeWaiting"
            )
        self.assertEqual(downloads_started, 1)
        self.assertEqual(state, "Exhausted")

    def test_rejected_exact_recovered_font_cannot_redownload(self):
        client = source(CLIENT)
        display = source(DISPLAY)
        rejected = function_body(
            client,
            "void IndicatorFontClient::noteRecoveredFontInvalid",
            "#endif",
        )
        service = function_body(
            display,
            "void serviceFontRecovery",
            "void turnOn",
        )

        self.assertIn("noteRecoveredFontInvalid()", service)
        self.assertIn("RecoveryNeed::None", rejected)
        self.assertIn("RecoveryState::Exhausted", rejected)
        self.assertNotIn("armRecovery", rejected)
        self.assertNotIn("finishRecoveryFailure", rejected)
        self.assertNotIn("finishPostCommitProbeFailure", rejected)
        self.assertNotIn("RecoveryState::Waiting", rejected)
        self.assertNotIn("RecoveryState::PostCommitProbeWaiting", rejected)
        self.assertNotIn("recoveryAttempts =", rejected)
        self.assertNotIn("downloadAndInstallAsset", rejected)

    def test_missing_corrupt_and_version_mismatch_are_distinct(self):
        policy = source(POLICY)
        client = source(CLIENT)
        for state in ("Missing", "Corrupt", "VersionMismatch"):
            self.assertIn(state, policy)
            self.assertIn(f"RecoveryNeed::{state}", client)

    def test_live_activation_only_replaces_fallback_font(self):
        policy = source(POLICY)
        client = source(CLIENT)
        display = source(DISPLAY)
        self.assertIn(
            "need == RecoveryNeed::Missing || need == RecoveryNeed::Corrupt",
            policy,
        )
        self.assertIn("!hadRuntimeFont", client)
        self.assertIn("IndicatorFontClient::serviceRecovery", display)
        self.assertIn("installRuntimeFont(fontData, fontSize)", display)
        self.assertIn("noteRuntimeFontInstalled", display)
        self.assertIn("noteRuntimeFontInvalid", display)

    def test_tls_cost_and_global_state_are_limited_to_wifi_indicator_profile(self):
        wifi = profile_section("env:SenseCapIndicator-LoRa_comp_radio_usb_wifi")
        usb = profile_section("env:SenseCapIndicator-LoRa_comp_radio_usb")
        self.assertIn("INDICATOR_WIFI_FONT_RECOVERY=1", wifi)
        self.assertNotIn("board_build.embed_files", wifi)
        self.assertNotIn("INDICATOR_WIFI_FONT_RECOVERY", usb)
        self.assertNotIn("board_build.embed_files", usb)

    def test_core2_timeout_and_worker_stack_fit_internal_tls_buffers(self):
        client = source(CLIENT)
        response = function_body(
            client, "RecoveryAttemptOutcome openAssetResponse", "bool writeAll"
        )
        service = function_body(
            client,
            "uint8_t* IndicatorFontClient::serviceRecovery",
            "void IndicatorFontClient::noteRuntimeFontInstalled",
        )

        self.assertIn("ESP_ARDUINO_VERSION_MAJOR >= 3", response)
        self.assertIn("HTTP_LINE_TIMEOUT_MS / 1000UL", response)
        self.assertIn("RECOVERY_TASK_STACK_BYTES = 8192UL", client)
        self.assertIn("RECOVERY_TASK_STACK_BYTES", service)
        self.assertNotIn('"indicator-font", 24576', service)


if __name__ == "__main__":
    unittest.main()