from pathlib import Path
import unittest


ROOT = Path(__file__).parents[1]


class UserEnginePlatformExpansionContractTests(unittest.TestCase):
    def test_contract_keeps_authorization_fail_closed(self):
        text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
        self.assertIn("fail closed", text)
        self.assertIn("decision ID", text)
        self.assertIn("USER_ENGINE_FLEX_AUTH_URL", text)

    def test_contract_requires_idempotent_bounded_delivery(self):
        text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
        self.assertIn("Idempotency-Key", text)
        self.assertIn("bounded attempts", text)
        self.assertIn("dead-letter", text)
        self.assertIn("OpenBao", text)

    def test_live_manifest_does_not_enable_partial_integration(self):
        manifest = (ROOT / "sso-mfa/k8s/user-engine/runtime.yaml").read_text()
        self.assertNotIn("USER_ENGINE_FLEX_AUTH_URL", manifest)
        self.assertNotIn("USER_ENGINE_EVENT_URL", manifest)
        self.assertNotIn("USER_ENGINE_MAIL_URL", manifest)


if __name__ == "__main__":
    unittest.main()