"""Real candidate Access Engine policy; authentication custody remains synthetic."""
from dataclasses import replace
import os
from pathlib import Path
import time

import pytest

from informed_decision.disposition import Actor, ActorKind
from informed_decision.lifecycle import Attribution, LifecycleRepository
from informed_decision.lifecycle_service import Caller, LifecycleError, LifecycleService
from informed_decision.records import dumps
from informed_decision.store import Store
from review_components import flex_component
from test_browser_auth import signing_key
from test_lifecycle import workspace
from test_policy_client import human


def test_initial_audience_collaborates_across_revisions_with_real_pdp(workspace, tmp_path, signing_key):
    binary = os.environ.get('INFD_FLEX_AUTH_BINARY')
    source = os.environ.get('INFD_FLEX_AUTH_SOURCE')
    if not binary or not source:
        pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy')
    fixture = Path(source) / 'examples/informed-decision-lifecycle'
    pins = (fixture / 'pin.json').read_bytes()
    with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls):
        repo, memo = workspace
        app = LifecycleService(repo, pdp)
        hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)),
            time.time() + 600, dumps({'principal_type_source': 'authentication-derived',
                'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle',
                'workload_uid': 'synthetic-verified-uid'}))
        person = Caller.from_human_session(human())
        app.register(hub, memo, key='first')
        with pytest.raises(LifecycleError):
            app.retrieve(person, memo.id)
        app.publish(hub, memo.id, 1, audience={'groups': ['net-kingdom-admins'], 'subjects': []}, key='publish')
        app.annotate(person, memo.id, 1, kind='comment', body={'text': 'Consider the alternative'}, key='comment')
        app.revise(person, memo.next_version(brief='Alternative assessed'), expected_version=1, summary='Refined', key='refine')
        # The successor is unpublished; its editor and original author retain access.
        assert app.retrieve(person, memo.id).version == 2
        assert app.retrieve(hub, memo.id).version == 2
        other = Caller.from_human_session(replace(human(), subject='another-admin'))
        with pytest.raises(LifecycleError):
            app.retrieve(other, memo.id)
        app.publish(person, memo.id, 2, audience={'groups': ['net-kingdom-admins'], 'subjects': []}, key='republish')
        assert app.retrieve(other, memo.id).version == 2
        app.register(hub, replace(memo, id='second-decision'), key='second')
        reopened = LifecycleService(LifecycleRepository(Store(repo.store.path)), pdp)
        assert reopened.retrieve(person, memo.id).version == 2
        foreign = replace(hub, attribution=Attribution('tenant:platform', Actor('system:serviceaccount:other:other', ActorKind.SERVICE)))
        with pytest.raises(LifecycleError):
            reopened.retrieve(foreign, memo.id)
        assert calls and all(c['known'] and c['audiences'] == ['flex-auth'] for c in calls)
        assert (fixture / 'pin.json').read_bytes() == pins