"""Real candidate Access Engine policy; authentication custody remains synthetic."""
from dataclasses import replace
import os
from pathlib import Path
import time

import pytest

from informed_decision.disposition import Actor, ActorKind
from informed_decision.lifecycle import Attribution, LifecycleRepository
from informed_decision.lifecycle_service import Caller, LifecycleError, LifecycleService
from informed_decision.records import dumps
from informed_decision.store import Store
from review_components import flex_component
from test_browser_auth import signing_key
from test_lifecycle import workspace
from test_policy_client import human


def test_initial_audience_collaborates_across_revisions_with_real_pdp(workspace, tmp_path, signing_key):
    binary = os.environ.get('INFD_FLEX_AUTH_BINARY')
    source = os.environ.get('INFD_FLEX_AUTH_SOURCE')
    if not binary or not source:
        pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy')
    fixture = Path(source) / 'examples/informed-decision-lifecycle'
    pins = (fixture / 'pin.json').read_bytes()
    with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls):
        repo, memo = workspace
        app = LifecycleService(repo, pdp)
        hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)),
            time.time() + 600, dumps({'principal_type_source': 'authentication-derived',
                'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle',
                'workload_uid': 'synthetic-verified-uid'}))
        person = Caller.from_human_session(human())
        app.register(hub, memo, key='first')
        with pytest.raises(LifecycleError):
            app.retrieve(person, memo.id)
        app.publish(hub, memo.id, 1, audience={'groups': ['net-kingdom-admins'], 'subjects': []}, key='publish')
        app.annotate(person, memo.id, 1, kind='comment', body={'text': 'Consider the alternative'}, key='comment')
        app.revise(person, memo.next_version(brief='Alternative assessed'), expected_version=1, summary='Refined', key='refine')
        # The successor is unpublished; its editor and original author retain access.
        assert app.retrieve(person, memo.id).version == 2
        assert app.retrieve(hub, memo.id).version == 2
        other = Caller.from_human_session(replace(human(), subject='another-admin'))
        with pytest.raises(LifecycleError):
            app.retrieve(other, memo.id)
        app.publish(person, memo.id, 2, audience={'groups': ['net-kingdom-admins'], 'subjects': []}, key='republish')
        assert app.retrieve(other, memo.id).version == 2
        app.register(hub, replace(memo, id='second-decision'), key='second')
        reopened = LifecycleService(LifecycleRepository(Store(repo.store.path)), pdp)
        assert reopened.retrieve(person, memo.id).version == 2
        foreign = replace(hub, attribution=Attribution('tenant:platform', Actor('system:serviceaccount:other:other', ActorKind.SERVICE)))
        with pytest.raises(LifecycleError):
            reopened.retrieve(foreign, memo.id)
        assert calls and all(c['known'] and c['audiences'] == ['flex-auth'] for c in calls)
        assert (fixture / 'pin.json').read_bytes() == pins


@pytest.mark.parametrize("stale_field", ["version", "package_digest"])
def test_stale_consumer_pin_fails_closed_until_exact_owner_repin(workspace, tmp_path, signing_key, stale_field):
    binary = os.environ.get('INFD_FLEX_AUTH_BINARY')
    source = os.environ.get('INFD_FLEX_AUTH_SOURCE')
    if not binary or not source:
        pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy')
    fixture = Path(source) / 'examples/informed-decision-lifecycle'
    with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls):
        repo, memo = workspace
        app = LifecycleService(repo, pdp)
        hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)),
            time.time() + 600, dumps({'principal_type_source': 'authentication-derived',
                'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle',
                'workload_uid': 'synthetic-verified-uid'}))
        current = getattr(pdp, stale_field)
        setattr(pdp, stale_field, 'v1' if stale_field == 'version' else
                'sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827')
        with pytest.raises(LifecycleError) as refused:
            app.register(hub, memo, key='repin-proof')
        assert refused.value.status == 503 and refused.value.code == 'invalid_decision'
        with repo.store._connection() as db:
            assert db.execute('SELECT count(*) FROM memos').fetchone()[0] == 0
            assert db.execute('SELECT count(*) FROM lifecycle_events').fetchone()[0] == 0
        setattr(pdp, stale_field, current)
        app.register(hub, memo, key='repin-proof')
        assert app.retrieve(hub, memo.id) == memo
        assert calls and all(c['known'] and c['audiences'] == ['flex-auth'] for c in calls)


def test_real_enforcement_response_with_readback_purpose_cannot_authorize(workspace, tmp_path, signing_key):
    binary = os.environ.get('INFD_FLEX_AUTH_BINARY')
    source = os.environ.get('INFD_FLEX_AUTH_SOURCE')
    if not binary or not source:
        pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy')
    fixture = Path(source) / 'examples/informed-decision-lifecycle'
    with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls):
        repo, memo = workspace
        app = LifecycleService(repo, pdp)
        hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)),
            time.time() + 600, dumps({'principal_type_source': 'authentication-derived',
                'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle',
                'workload_uid': 'synthetic-verified-uid'}))
        original = pdp.transport.request
        def advisory_response(*args, **kwargs):
            status, data = original(*args, **kwargs)
            assert status == 200 and data['effect'] == 'allow'
            assert data['binding'].get('purpose', '') == ''
            # Keep the real request binding, digest, pins and TTL unchanged:
            # even an otherwise exact allow cannot cross the advisory boundary.
            data['binding']['purpose'] = 'readback'
            return status, data
        pdp.transport.request = advisory_response
        with pytest.raises(LifecycleError) as refused:
            app.register(hub, memo, key='advisory-proof')
        assert refused.value.status == 503 and refused.value.code == 'invalid_decision'
        with repo.store._connection() as db:
            assert db.execute('SELECT count(*) FROM memos').fetchone()[0] == 0
            assert db.execute('SELECT count(*) FROM lifecycle_events').fetchone()[0] == 0
        pdp.transport.request = original
        app.register(hub, memo, key='advisory-proof')
        assert app.retrieve(hub, memo.id) == memo