from datetime import datetime, timezone

import pytest

from approval_engine.api import App
from approval_engine.auth import Identity, StaticTokenAuthenticator
from approval_engine.store import Engine

FROZEN = datetime(2026, 8, 29, 12, 0, tzinfo=timezone.utc)


@pytest.fixture
def now():
    return FROZEN


@pytest.fixture
def engine(now):
    eng = Engine(":memory:", clock=lambda: now)
    yield eng
    eng.close()


@pytest.fixture
def app(engine):
    identity = Identity(
        subject="agt-secrets-engine",
        issuer="https://keycape.example",
        audiences=("approval-engine",),
        principal_type="service",
        tenant="platform",
        roles=frozenset({"secrets-engine"}),
        scopes=frozenset(
            {
                "approval:create",
                "approval:read",
                "approval:approve",
                "approval:revoke",
                "approval:supersede",
                "approval:consume",
                "approval:observe",
                "approval:emit",
            }
        ),
        assurance={"level": "aal1", "methods": ["test"], "source": "test"},
        evidence_ref="test-identity:test-token",
    )
    return App(engine, StaticTokenAuthenticator({"test-token": identity}))


def binding(**overrides):
    base = {
        "action": "secrets.kv.destroy",
        "target": {"id": "lane-openbao-root", "stage": "prod"},
        "actor": "agt-secrets-engine",
        "principal": "bernd",
        "purpose": "rotate-exposed-key",
    }
    base.update(overrides)
    return base


def validity():
    return {
        "not_before": "2026-08-29T11:00:00+00:00",
        "expires_at": "2026-08-29T15:00:00+00:00",
    }


def approve(engine, required=1, extra_binding=None, pdp_digest=None):
    obj = engine.create(
        extra_binding or binding(),
        validity(),
        required_count=required,
        pdp_digest=pdp_digest,
    )
    for i in range(required):
        obj = engine.add_entry(obj.id, f"user:approver-{i}")
    return obj