import tempfile
import shutil
import threading
import urllib.request
import http.server
import os
import socket

class SecureRootTestCase(unittest.TestCase):
    def setUp(self):
        self.test_root = tempfile.mkdtemp()
        self.outside_file = os.path.join(tempfile.gettempdir(), "outside_secret.txt")
        with open(self.outside_file, "w") as f:
            f.write("TOP SECRET")

        self.symlink_path = os.path.join(self.test_root, "link.txt")
        try:
            os.symlink(self.outside_file, self.symlink_path)
        except (AttributeError, NotImplementedError, OSError):
            self.skipTest("Symlinks not supported on this platform")

        self.port = self._find_free_port()
        self.server_address = ("localhost", self.port)

        handler = functools.partial(http.server.SimpleHTTPRequestHandler,
                                    directory=self.test_root,
                                    secure_root=True)
        self.httpd = http.server.ThreadingHTTPServer(self.server_address, handler)

        self.thread = threading.Thread(target=self.httpd.serve_forever)
        self.thread.daemon = True
        self.thread.start()

    def tearDown(self):
        self.httpd.shutdown()
        self.thread.join()
        shutil.rmtree(self.test_root)
        try:
            os.remove(self.outside_file)
        except FileNotFoundError:
            pass

    def _find_free_port(self):
        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
            s.bind(('localhost', 0))
            return s.getsockname()[1]

    def test_symlink_outside_root_is_forbidden(self):
        url = f"http://localhost:{self.port}/link.txt"
        with self.assertRaises(urllib.error.HTTPError) as cm:
            urllib.request.urlopen(url)

        self.assertEqual(cm.exception.code, 403)