"""Backup-store retirement guard (audit rpcweb finding; 2026-10-03 follow-up).

/api/wallet/backup/create used to be an unauthenticated flat-file writer that
stored a client-supplied encrypted seed blob keyed only by a 64-bit id, kept it
forever, and (before an earlier fix) could fill the disk. The 2026-10-03 audit
retired the whole endpoint to 410 instead of merely capping it: removing the
writer eliminates both the seed-exfil surface and the disk-fill DoS outright.

These tests pin that it stays retired and never writes a seed to disk again.
"""

import os

import pytest

import web_app


@pytest.fixture
def client(tmp_path, monkeypatch):
    monkeypatch.chdir(tmp_path)       # isolate any relative backups/ dir
    web_app._rl_hits.clear()          # independent rate-limit state per test
    web_app.app.config["TESTING"] = True
    return web_app.app.test_client()


@pytest.mark.parametrize("method,route", [
    ("post", "/api/wallet/backup/create"),
    ("post", "/api/wallet/backup/restore"),
    ("get", "/api/wallet/backup/status"),
])
def test_backup_endpoints_are_retired(client, method, route):
    res = getattr(client, method)(route, json={"encryptedSeed": "blob", "backupId": "0" * 16})
    assert res.status_code == 410
    # The retired handler must never echo a seed back out.
    assert "encryptedSeed" not in (res.get_json() or {})


def test_create_writes_no_seed_to_disk(client, tmp_path):
    """The seed-to-disk sink is gone: posting must not create a backups/ store."""
    res = client.post("/api/wallet/backup/create", json={"encryptedSeed": "super-secret"})
    assert res.status_code == 410
    assert not os.path.isdir(tmp_path / "backups"), "retired endpoint still wrote to disk"