package policy_test

import (
 "context"
 "path/filepath"
 "testing"
 "github.com/netkingdom/access-engine/internal/policy"
 "github.com/netkingdom/access-engine/pkg/api"
)

func TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal(t *testing.T) {
 pkg,err:=policy.LoadAndValidateFile(context.Background(),filepath.Join("..","..","examples","secrets-engine","policy_package.md"))
 if err!=nil || !pkg.Valid {t.Fatalf("policy load: %v",err)}
 r:=api.CheckRequest{Tenant:"tenant:platform",Subject:api.SubjectRef{ID:"secrets-engine",Type:"service"},Action:"execute-ccr",Resource:api.ResourceRef{ID:"catalog:test",Type:"secret-catalog-lane",System:"secrets-engine"},Context:map[string]any{"execution_contract":map[string]any{"operation":"metadata-apply-ccr"}}}
 result,err:=pkg.Evaluate(context.Background(),r)
 if err!=nil || result.Effect!=api.DecisionEffectDeny || result.Reason!="unknown_action" {t.Fatalf("new action: %+v %v",result,err)}
 // Existing apply ignores execution_contract content; its allow is not exact task authority.
 r.Action="apply"
 r.Context["execution_contract"]=map[string]any{"operation":"arbitrary-mutation","payload_sha256":"forged"}
 result,err=pkg.Evaluate(context.Background(),r)
 if err!=nil || result.Effect!=api.DecisionEffectAllow {t.Fatalf("existing apply gap characterization: %+v %v",result,err)}
 r.Subject=api.SubjectRef{ID:"founder-unregistered",Type:"human"}
 result,err=pkg.Evaluate(context.Background(),r)
 if err!=nil || result.Effect!=api.DecisionEffectDeny || result.Reason!="wrong_subject_type" {t.Fatalf("human principal: %+v %v",result,err)}
}