"""Row O5: the window watcher and its CCR name the same roles and identity (NK-WP-0058-T06)."""
import importlib.util
import sys
from pathlib import Path

import pytest
import yaml

REPO = Path(__file__).resolve().parents[3]
CCRS = REPO.parent / 'railiance-platform' / 'credential-change-requests'
sys.path.insert(0, str(REPO / 'bounded-executor'))
spec = importlib.util.spec_from_file_location('window_watch_contract', REPO / 'bounded-executor/window_watch.py')
watch = importlib.util.module_from_spec(spec)
spec.loader.exec_module(watch)


def ccr(prefix):
    files = sorted(CCRS.glob(prefix + '-*.yaml'))
    if not files:
        pytest.skip(f'railiance-platform {prefix} required')
    return yaml.safe_load(files[0].read_text())


def test_watcher_logs_in_with_the_ccr_role_and_watches_the_write_role():
    watch_ccr, write_ccr = ccr('CCR-2026-0064'), ccr('CCR-2026-0058')
    auth = watch_ccr['openbao']['auth']
    assert watch.WATCH_ROLE == auth['role']
    assert watch.WRITE_ROLE == watch_ccr['openbao']['watch']['role'] == write_ccr['openbao']['auth']['role']
    assert watch.ROLE_PATH == '/v1/auth/kubernetes/role/' + watch.WRITE_ROLE
    assert auth['bound_claims'] == {'service_account_names': ['nk-window-watch'], 'service_account_namespaces': ['sso']}
    assert auth['audience'] == 'openbao'


def test_flag_mode_matches_what_the_watcher_needs():
    mode = ccr('CCR-2026-0064')['openbao']['watch']['mode']
    assert mode in ('flag', 'close')  # the CronJob's --mode must not need more than the CCR grants