import json
import sys
from pathlib import Path

from informed_decision.records import memo_from

ROOT = Path(__file__).resolve().parents[1]
REG = json.loads((ROOT / "docs" / "keycape-sitting-requester-registration.json").read_text())
INTENTS = json.loads((ROOT / "docs" / "batches" / "2026-09-14" / "approval-create-intents.json").read_text())


def test_sitting_requester_is_create_only_and_unapplied():
    assert REG["clientId"] == "informed-decision-sitting-requester"
    assert REG["audience"] == "approval-engine"
    assert REG["allowedScopes"] == ["approval:create"]
    assert REG["grantTypes"] == ["client_credentials"]
    assert REG["clientType"] == "confidential"
    assert REG["serviceSubject"] == "informed-decision"
    assert REG["tenant"] == "tenant:platform"
    assert REG["applied"] is False
    assert "redirect" not in json.dumps(REG).lower()
    forbidden = {"approval:approve", "approval:consume", "approval:read", "openid"}
    assert forbidden.isdisjoint(REG["allowedScopes"])
    assert not REG["secretRef"].startswith("s.") and ":" in REG["secretRef"]


def test_create_intents_cover_the_sitting_and_are_not_posted():
    assert INTENTS["posted"] is False
    assert INTENTS["human_control"] is True
    assert INTENTS["pdp_path"] is False
    ids = [row["memo_id"] for row in INTENTS["intents"]]
    sitting_ids = []
    batch_root = ROOT / "docs" / "batches" / "2026-09-14"
    for name in ("credentials", "decisions"):
        index = json.loads((batch_root / name / "index.json").read_text())
        sitting_ids.extend(row["memo_id"] for row in index["ordinal"])
    assert ids == sitting_ids
    undecided = [row for row in INTENTS["intents"] if row["create_client"] == "undecided"]
    assert [row["memo_id"] for row in undecided] == ["infd-20260914-c01"]
    for row in INTENTS["intents"]:
        binding = row["binding"]
        assert set(binding) == {"action", "actor", "principal", "purpose", "target"}
        assert binding["actor"] == "informed-decision"
        assert "digest" not in binding
        batch = "credentials" if "-c0" in row["memo_id"] else "decisions"
        memo = memo_from(json.loads((batch_root / batch / f"{row['memo_id']}.memo.json").read_text()))
        assert binding["target"]["id"] == memo.binding.target.id
        assert memo.question.startswith(binding["purpose"][:20]) or binding["purpose"] in memo.question or memo.question.rstrip("?") in binding["purpose"]


def test_create_intents_match_approval_engine_canonical_binding():
    engine = Path("/home/worsch/approval-engine")
    sys.path.insert(0, str(engine))
    from approval_engine.binding import BINDING_FIELDS, binding_digest, canonical_binding

    for row in INTENTS["intents"]:
        canon = canonical_binding(row["binding"])
        assert tuple(canon) == BINDING_FIELDS
        digest = binding_digest(canon)
        assert digest.startswith("sha256:") and len(digest) == 71


def test_custody_request_is_unallocated_and_does_not_widen_t03_path():
    text = (ROOT / "docs" / "sitting-requester-custody-request.yaml").read_text()
    assert "status: requested" in text
    assert "id: unallocated" in text
    assert "kv_path: platform/workloads/informed-decision/sitting-requester" in text
    assert "kv_path: platform/workloads/secrets-engine/approval-requester" not in text
    md = (ROOT / "docs" / "sitting-requester-custody-request.md").read_text()
    assert "Do not widen" in md
    assert "No secret" in md