from ops_mason.reuse_surface_hub_writer import (
    DATA,
    FORBIDDEN_ENTITY_ID,
    METADATA,
    PARENT_DATA,
    POLICY,
    SIBLING,
    assess,
)


def member(**overrides):
    report = {
        "mode": "member",
        "login": "ok",
        "policies": [POLICY],
        "identity_policies": [],
        "entity_id": "11111111-1111-1111-1111-111111111111",
        "capabilities": {
            DATA: ["read"],
            METADATA: ["read"],
            PARENT_DATA: ["deny"],
            "platform/metadata/workloads/reuse/reuse-surface": ["deny"],
            SIBLING: ["deny"],
        },
        "revoked": True,
    }
    report.update(overrides)
    return report


def test_member_exact_policy_passes():
    assert assess(member()) == []


def test_admin_entity_and_broad_capabilities_fail():
    failures = assess(
        member(
            policies=["default", "operator-custody", "platform-admin", POLICY],
            identity_policies=["platform-admin"],
            entity_id=FORBIDDEN_ENTITY_ID,
            capabilities={
                DATA: ["create", "delete", "list", "read", "update"],
                METADATA: ["create", "delete", "list", "read", "update"],
                PARENT_DATA: ["create", "delete", "list", "read", "update"],
                "platform/metadata/workloads/reuse/reuse-surface": ["read"],
                SIBLING: ["create", "delete", "list", "read", "update"],
            },
        )
    )
    assert any("platform-admin entity" in item for item in failures)
    assert any("forbidden policies" in item for item in failures)
    assert any(SIBLING in item for item in failures)
    assert any("not exactly" in item for item in failures)


def test_missing_entity_fails():
    assert any("entity id" in item for item in assess(member(entity_id="")))


def test_missing_revoke_fails():
    assert any("not revoked" in item for item in assess(member(revoked=False)))


def test_non_member_refusal_passes_and_unexpected_login_fails():
    refusal = 'claim "groups" does not match any associated bound claim values'
    assert assess({"mode": "non-member", "login": "refused", "openbao_error": refusal}) == []
    assert assess({"mode": "non-member", "login": "refused"}) == [
        "non-member refusal recorded no openbao_error text"
    ]
    assert assess({"mode": "non-member", "login": "ok"})


def test_unknown_mode_fails():
    assert assess({"mode": "other"})