#!/usr/bin/env python3
"""Check source registrations and launcher isolation; no services are started."""
import json,os,re,subprocess,xml.etree.ElementTree as ET
from pathlib import Path
m=json.loads(Path('integration.json').read_text());seen=set()
for package,entries in m['payload'].items():
 for path,e in entries.items():
  assert path not in seen,path;seen.add(path);p=Path('payload')/package/path
  if 'link' in e:assert p.is_symlink() and os.readlink(p)==e['link']
  else:
   assert p.read_text()==e['text'] and p.stat().st_mode&0o777==e['mode'],path
   if e['text'].startswith('#!/bin/sh'):subprocess.run(['/bin/sh','-n',str(p)],check=True)
   if path.endswith(('.policy','.conf')) and e['text'].lstrip().startswith(('<!DOCTYPE','<?xml','<busconfig','<policyconfig')):
    xml=ET.fromstring(e['text'])
    for rule in xml.iter('allow'):
     if 'send_interface' in rule.attrib:assert rule.get('send_destination'),path+' unbounded D-Bus send rule'
for entry in m['registrations']:
 assert entry['source'] in m['provider_files']
launcher=Path('payload/plasma-next-session/usr/bin/plasma-next-session')
env={**os.environ,'LD_LIBRARY_PATH':'/invalid/private-test','QT_PLUGIN_PATH':'/invalid/private-test','QML2_IMPORT_PATH':'/invalid/private-test'}
r=subprocess.run(['/bin/sh',str(launcher),'--check'],env=env,capture_output=True,text=True,check=True)
assert 'SESSION ENVIRONMENT CHECK PASSED' in r.stdout
assert 'export LD_LIBRARY_PATH=' not in launcher.read_text()
assert 'plasma-next-rust-build-tools' not in m['runtime_packages']
assert 'plasma-next-sddm-kcm' not in m['runtime_packages']
assert 'plasma-next-plasma-login-manager' not in m['runtime_packages']
control=Path('debian/control').read_text();assert 'plasma-next-plm | plasma-next-sddm' in control
print(f'{len(seen)} integration files checked; session environment isolation passed. No runtime consumers executed.')