bikoret/azazel_processor/test/test_eretz_gezerah.py

"""
Tests for the eretz_gezerah sentinel — property 12 (unmanaged
destination opacity) from azazel_engineering_reading.md §14.

The destination MUST be opaque. There is no name, no URL, no queue
identifier, no string handle that encodes anything about where state
goes after disposal. The only legitimate reference is the sentinel
ERETZ_GEZERAH; identity comparison (`is`) is the only legitimate
predicate.
"""

import pathlib

import pytest

from azazel_processor.eretz_gezerah import ERETZ_GEZERAH, is_eretz_gezerah


# ============================================================
# The sentinel itself
# ============================================================


def test_sentinel_exists():
    """ERETZ_GEZERAH is importable and is the same object across imports."""
    from azazel_processor.eretz_gezerah import ERETZ_GEZERAH as second_import

    assert ERETZ_GEZERAH is second_import


def test_sentinel_is_a_plain_object_not_a_string():
    """A string would be searchable, interned, serializable. The sentinel
    must NOT be a string. Property 12: opacity of name."""
    assert not isinstance(ERETZ_GEZERAH, str)
    assert not isinstance(ERETZ_GEZERAH, bytes)


def test_sentinel_has_no_meaningful_attributes():
    """A bare object() has no useful attributes for tooling to
    discover. We don't grant the sentinel a name, a destination
    string, or any other tracking handle."""
    # Plain object() exposes only the dunder methods. No public attrs.
    public = [a for a in dir(ERETZ_GEZERAH) if not a.startswith("_")]
    assert public == []


def test_sentinel_repr_does_not_leak_destination_info():
    """The repr is just object()'s default — no operator-readable name
    encoding 'where it goes'. Default Python repr is `<object object at
    0x...>` which leaks only the address (changes per process)."""
    r = repr(ERETZ_GEZERAH)
    assert "<object object at 0x" in r
    assert "azazel" not in r.lower()
    assert "void" not in r.lower()
    assert "null" not in r.lower()


# ============================================================
# is_eretz_gezerah/1
# ============================================================


def test_is_eretz_gezerah_recognizes_canonical_sentinel():
    assert is_eretz_gezerah(ERETZ_GEZERAH)


def test_is_eretz_gezerah_rejects_other_objects():
    assert not is_eretz_gezerah(None)
    assert not is_eretz_gezerah(object())
    assert not is_eretz_gezerah("eretz_gezerah")
    assert not is_eretz_gezerah("ERETZ_GEZERAH")
    assert not is_eretz_gezerah(0)
    assert not is_eretz_gezerah([])


def test_is_eretz_gezerah_uses_identity_not_equality():
    """A class with __eq__ that returns True for anything must not
    be confused with the sentinel. Identity is the gate; equality
    would let any impostor in."""

    class Impostor:
        def __eq__(self, other):
            return True

        def __hash__(self):
            return 0

    impostor = Impostor()
    assert impostor == ERETZ_GEZERAH  # equality is True (impostor lies)
    assert not is_eretz_gezerah(impostor)  # but identity is not


# ============================================================
# Module-level __getattr__ refuses introspection
# ============================================================


def test_module_refuses_unknown_attribute_access():
    """The module exposes only ERETZ_GEZERAH and is_eretz_gezerah.
    Any other attribute access must raise — there are no further
    handles to discover."""
    import azazel_processor.eretz_gezerah as mod

    with pytest.raises(AttributeError) as exc:
        mod.DESTINATION_URL  # noqa: B018 — deliberate access for the test

    assert "no further handles" in str(exc.value).lower() or \
           "opaque" in str(exc.value).lower()


def test_module_refuses_invented_metadata_lookup():
    import azazel_processor.eretz_gezerah as mod

    for invented in ("destination", "endpoint", "queue_name", "host", "address"):
        with pytest.raises(AttributeError):
            getattr(mod, invented)


# ============================================================
# CI-style invariant: no destination string in the codebase
# ============================================================
#
# This is the grep-the-codebase check from BUILD_AZAZEL.md §12.
# It runs as a normal test so a regression at any layer of the
# build (a future contributor adding `DESTINATION_URL = "..."` to
# any module) fires immediately.


# Forbidden ASSIGNMENT-SHAPED patterns. The failure mode is someone
# adding a module-level constant that reintroduces a destination
# handle (e.g. `DESTINATION_URL = "..."`). Mere mention in a
# docstring, an `__all__` re-export, or a `__getattr__` allowlist is
# NOT the failure mode; what we defend against is binding a forbidden
# name to a value at module scope.
import re

_FORBIDDEN_ASSIGNMENT_PATTERNS = [
    re.compile(rf"^\s*{name}\s*=", re.MULTILINE)
    for name in (
        "DESTINATION_URL",
        "DESTINATION_HOST",
        "AZAZEL_QUEUE",
        "AZAZEL_ENDPOINT",
        "DISPOSAL_HOST",
        "DISPOSAL_URL",
        "DISPOSAL_QUEUE",
        "AZAZEL_RECIPIENT",
        "DISPOSAL_RECIPIENT",
    )
]


def _walk_source_files():
    """Yield every .py file under src/ — the source the operator has
    to read to understand the channel. Tests are excluded (test
    files legitimately reference forbidden patterns in assertions)."""
    src_root = pathlib.Path(__file__).resolve().parent.parent / "src"
    yield from src_root.rglob("*.py")


def test_no_destination_handle_assigned_in_source():
    """Property 12 enforced as a CI invariant. If a future contributor
    adds `DESTINATION_URL = "..."` (or any of the other forbidden
    handle-shaped names) to ANY module in azazel_processor/, this
    test fails — they reintroduced the failure mode the sentinel
    exists to prevent.

    Catches assignment, not mention. Documenting "do not add
    DESTINATION_URL" in a docstring is fine; `DESTINATION_URL = "x"`
    is the regression.
    """
    offenders = []
    for path in _walk_source_files():
        text = path.read_text()
        for pattern in _FORBIDDEN_ASSIGNMENT_PATTERNS:
            for match in pattern.finditer(text):
                offenders.append((path.name, match.group().strip()))

    assert offenders == [], (
        f"Forbidden destination-handle assignment(s) in azazel_processor "
        f"source: {offenders}. The destination is opaque by specification "
        f"(property 12, azazel_engineering_reading.md §14). Use "
        f"ERETZ_GEZERAH (the Python sentinel), not a string-valued "
        f"module constant."
    )


def test_sentinel_name_not_assigned_to_string_in_source():
    """A module-level `X = 'ERETZ_GEZERAH'` would treat the sentinel
    name as if it were a string handle — re-introducing the very
    string-tracking the sentinel exists to prevent. Mere mention in
    `__all__` or `__getattr__`'s allowlist is fine; binding a name
    to the string is not.
    """
    string_assignment = re.compile(
        r"""^\s*\w+\s*=\s*["']ERETZ_GEZERAH["']""", re.MULTILINE
    )
    offenders = []
    for path in _walk_source_files():
        text = path.read_text()
        if string_assignment.search(text):
            offenders.append(path.name)

    assert offenders == [], (
        f"Module-level assignment binding the string 'ERETZ_GEZERAH' "
        f"to a name in: {offenders}. The sentinel is a Python object, "
        f"not a string. Refer to it via the imported name, not via a "
        f"string handle."
    )