from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]


def test_activity_core_eso_token_covers_every_declared_runtime_lane():
    script = (ROOT / "scripts" / "openbao-eso-token-apply.sh").read_text(encoding="utf-8")
    required_policies = {
        "workload-kv-read-issue-core-runtime",
        "workload-kv-read-forgejo-admin",
        "workload-kv-read-railiance-backup-offsite-lane",
        "workload-kv-read-llm-connect-provider-secrets",
    }

    default_line = next(
        line for line in script.splitlines() if line.startswith("DEFAULT_POLICIES=")
    )
    for policy in required_policies:
        assert policy in default_line


def test_railiance_runbook_applies_and_waits_for_llm_connect_external_secret():
    runbook = (ROOT / "k8s" / "railiance" / "README.md").read_text(encoding="utf-8")
    assert "llm-connect/deploy/k8s/activity-core-llm-connect/externalsecret.yaml" in runbook
    assert "externalsecret/llm-connect-provider-secrets --timeout=120s" in runbook