import json
from pathlib import Path

from approval_engine.binding import binding_digest
from tests.conftest import approve, binding

ROOT = Path(__file__).resolve().parents[1]


def test_schema_forbids_decision_keys():
    schema = json.loads((ROOT / "schemas/approval_claim.schema.json").read_text())
    assert "not" in schema
    kinds = [item["required"][0] for item in schema["not"]["anyOf"]]
    assert set(kinds) >= {"effect", "decision", "allow", "deny"}


def test_claim_has_issuer_digest_freshness(engine):
    obj = approve(engine)
    claim = engine.claim(obj.id)
    assert claim["kind"] == "approval-claim"
    assert claim["issuer"] == "approval-engine"
    assert claim["approval_id"] == obj.id
    assert claim["valid_now"] is True
    assert claim["reason_code"] == "ok"
    assert claim["binding"]["digest"] == binding_digest(binding())
    assert claim["freshness"]["ttl_seconds"] == 30
    assert claim["freshness"]["not_after"] == "2026-08-29T12:00:30+00:00"
    assert "effect" not in claim
    assert "decision" not in claim
    assert "yields_to" in claim


def test_wrong_target_changes_digest():
    a = binding()
    b = binding(target={"id": "other-lane", "stage": "prod"})
    assert binding_digest(a) != binding_digest(b)


def test_wrong_action_changes_digest():
    assert binding_digest(binding()) != binding_digest(binding(action="secrets.kv.read"))


def test_pdp_digest_is_recorded_not_recomputed(engine):
    pdp = "sha256:" + "ab" * 32
    obj = approve(engine, pdp_digest=pdp)
    claim = engine.claim(obj.id)
    assert claim["binding"]["pdp_digest"] == pdp
    assert claim["binding"]["digest"] == binding_digest(binding())
    assert claim["binding"]["digest"] != pdp


def test_examples_are_claim_shaped():
    for name in ("claim.valid.json", "claim.revoked.json"):
        data = json.loads((ROOT / "examples" / name).read_text())
        assert data["kind"] == "approval-claim"
        assert data["issuer"] == "approval-engine"
        for forbidden in ("effect", "decision", "allow", "deny"):
            assert forbidden not in data