"""The default envelope is valid data and faithfully encodes canon A6."""

from __future__ import annotations

from emergent_security.constitution import RULE_IDS
from emergent_security.model import Outcome

# Every A6 row of canon v0.8, by decision class id.
A6_CLASSES = {
    "code.edit", "test.add", "test.weaken", "dependency.add", "code.fetch_execute",
    "data.egress", "git.commit_feature", "git.push_feature", "git.merge_protected",
    "git.history_rewrite", "ci.add_check", "ci.weaken", "checks.bypass", "policy.edit",
    "secrets.read", "secrets.write", "credential.reuse_broader", "env.disposable",
    "agent.delegate", "deploy.internal", "deploy.relied_upon", "iam.change",
    "data.sensitive", "tenant.cross", "data.delete_irreversible",
    "tenant.governance_change", "tenant.platform_envelope_change", "audit.disable",
    "platform.root",
}

# Rows whose base mode is a constitutional deny (canon A6 "DENY" rows).
CONSTITUTIONAL_DENY = {
    "checks.bypass", "policy.edit", "secrets.write", "credential.reuse_broader",
    "agent.delegate", "tenant.cross", "tenant.governance_change",
    "tenant.platform_envelope_change", "audit.disable",
}


def test_envelope_validates_cleanly(default_envelope, scales):
    assert default_envelope.validate(scales) == []


def test_envelope_covers_every_a6_row(default_envelope):
    assert set(default_envelope.class_ids) == A6_CLASSES


def test_constitutional_denies_are_the_base_mode(default_envelope):
    denied = {cid for cid in default_envelope.class_ids if default_envelope.row(cid).mode is Outcome.DENY}
    assert denied == CONSTITUTIONAL_DENY


def test_root_row_only_requests_root_authorization(default_envelope):
    assert default_envelope.row("platform.root").mode is Outcome.ROOT_AUTHORIZATION_REQUIRED


def test_every_cited_rule_exists(default_envelope):
    cited = {rule for cid in default_envelope.class_ids for rule in default_envelope.all_rules(cid)}
    assert cited <= RULE_IDS


def test_applies_only_to_hot_build_l0_outside_tenants(default_envelope):
    base = {"level": "L0", "temperature": "hot", "phase": "build", "tenant": "none"}
    assert default_envelope.applies_to(base)
    for key, other in [("level", "L1"), ("temperature", "warm"), ("phase", "production"), ("tenant", "tenant://acme")]:
        assert not default_envelope.applies_to({**base, key: other})


def test_validation_reports_broken_rows(scales):
    from emergent_security.envelope import DefaultEnvelope

    broken = DefaultEnvelope.from_dict(
        {
            "id": "envelope://broken",
            "applies_when": {},
            "risk_envelope": {"blast_radius": "galaxy"},
            "classes": [
                {"id": "a", "mode": "sometimes", "rules": ["C99"]},
                {"id": "a", "mode": "autonomous", "rules": []},
            ],
        }
    )
    errors = broken.validate(scales)
    assert any("duplicate class id: a" in e for e in errors)
    assert any("unknown mode" in e for e in errors)
    assert any("unknown rule C99" in e for e in errors)
    assert any("unknown value for blast_radius" in e for e in errors)