import importlib.util
import json
from pathlib import Path

import pytest

spec = importlib.util.spec_from_file_location(
    "create_sitting_approvals",
    Path(__file__).resolve().parents[1] / "tools" / "create_sitting_approvals.py",
)
create = importlib.util.module_from_spec(spec)
spec.loader.exec_module(create)


def test_dry_run_lists_seven_and_skips_c01():
    report = create.dry_run()
    assert report["posted"] is False
    assert report["skipped"] == ["infd-20260914-c01"]
    assert len(report["memo_ids"]) == 7
    assert "infd-20260914-c01" not in report["memo_ids"]
    assert report["memo_ids"][0] == "infd-20260914-c02"
    assert report["memo_ids"][-1] == "infd-20260914-d04"


def test_require_attended_refuses_this_shell():
    with pytest.raises(create.Refused, match="attended_reader_required"):
        create.require_attended()


def test_created_receipt_has_seven_requested_and_no_entries():
    receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text())
    assert receipt["status"] == "created"
    assert receipt["human_entries_created"] is False
    assert receipt["credential_values_emitted"] is False
    assert len(receipt["requests"]) == 7
    assert receipt["skipped"] == ["infd-20260914-c01"]
    for row in receipt["requests"]:
        approval = row["approval"]
        assert approval["status"] == "requested"
        assert approval["entries"] == []
        assert approval["binding"]["human_control"] is True
        assert approval["binding"]["digest"].startswith("sha256:")


def test_policy_package_pins_match_created_receipt():
    root = Path(__file__).resolve().parents[1] / "docs" / "batches" / "2026-09-14"
    receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text())
    package = (root / "policy-package.md").read_text()
    assert "c01" not in package or "infd-20260914-c01" not in package
    for row in receipt["requests"]:
        assert f'memo:{row["memo_id"]}' in package
        assert row["approval"]["id"] in package
        assert row["approval"]["binding"]["digest"] in package


def test_failed_receipt_does_not_block_retry(tmp_path, monkeypatch):
    receipt = tmp_path / "r.json"
    monkeypatch.setattr(create, "RECEIPT", receipt)
    receipt.write_text('{"status": "failed", "phase": "preflight"}\n')
    assert create.existing_receipt_blocks() is False
    receipt.write_text('{"status": "created", "phase": "seven_unapproved_requests_created"}\n')
    assert create.existing_receipt_blocks() is True


@pytest.mark.parametrize(
    "origin,ok",
    [
        ("http://127.0.0.1:18281", True),
        ("http://approval-engine.approval-engine.svc.cluster.local:8080", True),
        ("https://evil.example", False),
        ("http://10.43.103.108:8080", False),
        (None, False),
    ],
)
def test_approval_origin_is_loopback_or_in_cluster_only(origin, ok):
    assert create._approval_origin_ok(origin) is ok