import json

import pytest

from approval_engine.cli import main


def test_migrate_verify_and_backup_commands(tmp_path, capsys):
    database = tmp_path / "approval.sqlite"
    backup = tmp_path / "approval.backup.sqlite"
    assert main(["migrate", "--db", str(database)]) == 0
    migrated = json.loads(capsys.readouterr().out)
    assert migrated["ok"] is True
    assert main(["verify", "--db", str(database)]) == 0
    assert json.loads(capsys.readouterr().out)["schema_current"] is True
    assert main(["backup", "--db", str(database), "--output", str(backup)]) == 0
    assert json.loads(capsys.readouterr().out)["integrity"] == "ok"


def test_production_refuses_memory_store_before_serving():
    with pytest.raises(SystemExit):
        main(["serve", "--production", "--db", ":memory:"])


def test_production_requires_jwt_verifier_not_static_token(tmp_path, capsys):
    database = tmp_path / "approval.sqlite"
    assert main(["migrate", "--db", str(database)]) == 0
    capsys.readouterr()
    audit = tmp_path / "audit.token"
    audit.write_text("audit")
    static = tmp_path / "dev.token"
    static.write_text("dev")
    with pytest.raises(SystemExit):
        main(
            [
                "serve",
                "--production",
                "--db",
                str(database),
                "--audit-url",
                "http://audit-core:8080",
                "--audit-token-file",
                str(audit),
                "--dev-token-file",
                str(static),
            ]
        )
    assert "KeyCape JWT verifier" in capsys.readouterr().err


def test_production_requires_authenticated_audit_delivery(tmp_path, capsys):
    database = tmp_path / "approval.sqlite"
    assert main(["migrate", "--db", str(database)]) == 0
    capsys.readouterr()
    with pytest.raises(SystemExit):
        main(
            [
                "serve",
                "--production",
                "--db",
                str(database),
                "--jwt-issuer",
                "https://keycape.example",
                "--jwt-audience",
                "approval-engine",
                "--jwks-url",
                "https://keycape.example/jwks",
            ]
        )
    assert "authenticated audit delivery" in capsys.readouterr().err