"""Normalized Glas evidence boundary (ACTIVITY-WP-0032-T04)."""

from __future__ import annotations

import json

from activity_core.glas_evidence import (
    normalise_execution_evidence,
    normalise_ops_result,
)


def _gateway_result() -> dict:
    return {
        "ok": True,
        "evidence": {
            "request_id": "request-1",
            "correlation_id": "corr-1",
            "actor": "agt",
            "project": "activity-core",
            "target_repo": "activity-core",
            "contract_version": "1.0",
            "profile_ref": "harness.agent-dev@1.0.0",
            "rein_id": "rein-aharness",
            "rein_version": "0.1.0",
            "model_route": "claude-code-cli",
            "resolved_model": "claude-sonnet-4-6",
            "sandbox_profile": "profile.bwrap-local",
            "sandbox_id": "sandbox-1",
            "tool_profile": "green-commit-only",
            "outcome": "succeeded",
            "started_at": "2026-08-22T20:00:00Z",
            "finished_at": "2026-08-22T20:00:05Z",
            "duration_s": 5.0,
            "tokens_spent": 0,
            "token_budget": 60000,
            "commit_sha": "deadbeef",
            "artifacts": ["README.md"],
            "tool_events_count": 0,
            "tool_events_completeness": "unavailable",
            "refs": {
                "assignment_ref": "assignment:42",
                "goal_refs": ["goal:42@1", {"credential": "must-drop"}],
                "api_key": "must-drop",
            },
            "raw_prompt": "must-drop",
            "provider_response": {"must": "drop"},
        },
        "tool_output": "sensitive direct model output",
        "tool_error": "sensitive provider exception",
        "provider_blob": {"credential": "must-drop"},
    }


def test_normalises_gateway_result_and_drops_direct_output() -> None:
    result = normalise_ops_result(_gateway_result())

    assert result["ok"] is True
    evidence = result["execution_evidence"]
    assert evidence["profile_ref"] == "harness.agent-dev@1.0.0"
    assert evidence["rein_id"] == "rein-aharness"
    assert evidence["tokens_spent"] == 0
    assert evidence["tool_events_count"] == 0
    assert evidence["tool_events_completeness"] == "unavailable"
    assert evidence["refs"] == {
        "assignment_ref": "assignment:42",
        "goal_refs": ["goal:42@1"],
    }

    serialized = json.dumps(result)
    for forbidden in (
        "tool_output",
        "tool_error",
        "provider_blob",
        "raw_prompt",
        "provider_response",
        "credential",
    ):
        assert forbidden not in serialized


def test_rejects_invalid_enums_and_non_finite_measurements() -> None:
    evidence = normalise_execution_evidence(
        {
            "outcome": "maybe",
            "failure_stage": "provider-internal",
            "duration_s": float("nan"),
            "tokens_spent": -1,
            "tool_events_completeness": "unknown-ish",
        }
    )

    assert evidence == {}


def test_keeps_legacy_artifact_fields_but_not_unknown_blobs() -> None:
    result = normalise_ops_result(
        {
            "ok": True,
            "path": "briefs/report.md",
            "head_after": "deadbeef",
            "target_repo": "activity-core",
            "artifact_urls": [
                {"kind": "report", "label": "Report", "url": "https://example.test/a"},
                {"kind": "unsafe", "label": "Unsafe", "url": "file:///tmp/key"},
            ],
            "messages": [{"role": "user", "content": "secret"}],
        }
    )

    assert result["path"] == "briefs/report.md"
    assert result["artifact_urls"] == [
        {"kind": "report", "label": "Report", "url": "https://example.test/a"}
    ]
    assert "messages" not in result