"""Apple release-train guard — run: python tests/test_apple_os_train.py

Apple states every parallel train as its own zero-floor range on the SAME CVE
(CVE-2026-64721: lessThan 14.8.8, 15.7.8 and 26.6). Without the train guard a
Sonoma host matches the Tahoe range and the finding claims a fix it will never
receive. This is the check that fails if that guard breaks.
"""
import os
import sys

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from app.services.cvelistv5_scan_service import _affected, _same_train


def _hit(installed, lt):
    return _same_train(installed, lt) and _affected(installed, "0", lt, None)


def demo():
    # CVE-2026-64721's three macOS ranges, one host per train.
    trains = ["14.8.8", "15.7.8", "26.6"]

    # Sonoma 14.7 is affected, and ONLY by its own train's fix.
    assert [_hit("14.7", lt) for lt in trains] == [True, False, False]
    # Tahoe 26.5.2 likewise — the older trains must not answer for it.
    assert [_hit("26.5.2", lt) for lt in trains] == [False, False, True]
    # Patched host on its train: not affected, and still no cross-train hit.
    assert [_hit("15.7.9", lt) for lt in trains] == [False, False, False]

    # iOS 26.6 exactly at the bound is fixed, .5 below it is not.
    assert not _hit("26.6", "26.6")
    assert _hit("26.5.2", "26.6")

    # Junk in, nothing out — never guess a train.
    assert not _same_train("", "26.6")
    assert not _same_train("26.5", None)

    print("apple train guard OK")


if __name__ == "__main__":
    demo()
