#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
木马暗链清除与代码完整性回归测试 (Malware Cleanup & Integrity Test)
严格 TDD 模式：确保全站无任何 jscdn.top 劫持暗链与 PHP 不死马
"""
import os
import unittest

BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

class MalwareCleanupTest(unittest.TestCase):

    def test_no_jscdn_top_in_codebase(self):
        """测试全站源码与静态资产无 jscdn.top 暗链"""
        infected_files = []
        ignore_dirs = {'.git', 'runtime', 'tests', '.gemini'}

        for root, dirs, files in os.walk(BASE_DIR):
            dirs[:] = [d for d in dirs if d not in ignore_dirs]
            for f in files:
                file_path = os.path.join(root, f)
                try:
                    with open(file_path, 'r', encoding='utf-8', errors='ignore') as fp:
                        content = fp.read()
                        if 'jscdn.top' in content:
                            rel_path = os.path.relpath(file_path, BASE_DIR)
                            infected_files.append(rel_path)
                except Exception:
                    pass

        self.assertEqual(
            infected_files,
            [],
            f"发现仍然含有 jscdn.top 恶意暗链的文件: {infected_files[:10]} (共 {len(infected_files)} 个)"
        )

    def test_no_suspicious_php_in_public_static_dirs(self):
        """测试 public 静态资源目录（assets、images、template）无非法 PHP 木马文件"""
        static_folders = [
            os.path.join(BASE_DIR, 'public', 'assets'),
            os.path.join(BASE_DIR, 'public', 'images'),
            os.path.join(BASE_DIR, 'public', 'template'),
        ]
        found_php = []
        for folder in static_folders:
            if not os.path.exists(folder):
                continue
            for root, dirs, files in os.walk(folder):
                for f in files:
                    if f.lower().endswith('.php'):
                        rel_path = os.path.relpath(os.path.join(root, f), BASE_DIR)
                        found_php.append(rel_path)

        self.assertEqual(
            found_php,
            [],
            f"静态目录中严禁存在 PHP 木马文件: {found_php}"
        )

    def test_no_nested_malware_directories(self):
        """测试 public 目录下不存在恶意递归嵌套目录"""
        nested_images = os.path.join(BASE_DIR, 'public', 'images', 'images')
        nested_template = os.path.join(BASE_DIR, 'public', 'template', 'template')

        self.assertFalse(os.path.exists(nested_images), "public/images/images 木马嵌套目录必须已被彻底删除")
        self.assertFalse(os.path.exists(nested_template), "public/template/template 木马嵌套目录必须已被彻底删除")

    def test_key_js_files_integrity(self):
        """测试核心引用的 JS 库文件首行干净"""
        key_files = [
            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery-1.7.2.min.js'),
            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery.SuperSlide.js'),
            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery.online.js'),
        ]

        for p in key_files:
            self.assertTrue(os.path.exists(p), f"核心库文件丢失: {p}")
            with open(p, 'r', encoding='utf-8', errors='ignore') as fp:
                first_line = fp.readline()
                self.assertNotIn('createElement', first_line, f"{p} 首行不能包含动态 script 注入")
                self.assertNotIn('jscdn.top', first_line, f"{p} 首行不能包含恶意域名")

if __name__ == '__main__':
    unittest.main()