"""The CCR record-evidence gate matches a policy and refuses a different one."""

import importlib.util
from pathlib import Path

import pytest
import yaml

from ops_mason.ccr_gate import EvidenceRefused, draft_from_plan, record_evidence

DECISION_ID = "00000000-0000-4000-8000-000000000001"
KV_PATH = "platform/workloads/fixture/reader"
PLATFORM = Path.home() / "railiance-platform"


def _draft(tmp_path: Path) -> dict:
    return draft_from_plan(
        kv_path=KV_PATH,
        plan_ref={
            "repo": "ops-mason",
            "path": "plans/fixture.md",
            "commit": "0123456789abcdef",
        },
        decision_id=DECISION_ID,
        out_dir=tmp_path,
    )


def _evidence(draft: Path) -> list:
    document = yaml.safe_load(draft.read_text(encoding="utf-8"))
    return (document.get("verification") or {}).get("evidence") or []


def _platform_modules():
    def load(name: str, path: Path):
        spec = importlib.util.spec_from_file_location(name, path)
        module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(module)
        return module

    return (
        load("credential_change_for_ccr_gate", PLATFORM / "scripts" / "credential-change.py"),
        load("ccr_intake_for_ccr_gate", PLATFORM / "scripts" / "ccr_intake.py"),
    )


def _record(drafted: dict) -> None:
    record_evidence(
        drafted["draft"],
        built_policy=drafted["built_policy"],
        actor="ops-mason",
        kind="metadata_apply",
        result="passed",
        detail=["built policy matched the CCR policy file"],
    )


def _differ(policy_path: Path) -> None:
    policy_path.write_text(
        policy_path.read_text(encoding="utf-8").replace('["read"]', '["create"]', 1),
        encoding="utf-8",
    )


def test_record_evidence_accepts_a_trailing_newline_and_refuses_a_different_policy(tmp_path):
    drafted = _draft(tmp_path)
    policy_path = Path(drafted["policy_file"])
    # The platform generator's text, plus one trailing newline, still matches.
    policy_path.write_text(policy_path.read_text(encoding="utf-8") + "\n", encoding="utf-8")

    completed = record_evidence(
        drafted["draft"],
        built_policy=drafted["built_policy"],
        actor="ops-mason",
        kind="metadata_apply",
        result="passed",
        detail=["built policy matched the CCR policy file"],
    )

    assert completed.returncode == 0
    assert "record-evidence" in completed.args
    assert "sync-decision" not in completed.args
    recorded = _evidence(drafted["draft"])
    assert len(recorded) == 1
    assert recorded[0]["kind"] == "metadata_apply"
    assert recorded[0]["result"] == "passed"
    assert "matched the CCR policy file" in recorded[0]["details"][0]

    _differ(policy_path)
    with pytest.raises(EvidenceRefused, match="record-evidence refused"):
        _record(drafted)
    assert len(_evidence(drafted["draft"])) == 1
    stored = drafted["draft"].read_text(encoding="utf-8")
    assert "sync-decision" not in stored
    assert DECISION_ID in stored


def test_draft_carries_the_standard_lane_token_bounds(tmp_path):
    drafted = _draft(tmp_path)
    cc, intake = _platform_modules()
    profile, _digest = intake.load_profile(PLATFORM / "registry" / "ccr-standard-profile.yaml")
    document = cc.load_yaml(drafted["draft"])
    auth = document["openbao"]["auth"]
    max_ttl = profile["auth"]["max_ttl_seconds"]
    for key in ("ttl", "token_max_ttl", "token_explicit_max_ttl"):
        assert intake.ttl_seconds(auth[key]) == max_ttl
    assert auth["token_no_default_policy"] is profile["auth"]["token_no_default_policy"]
    assert intake.standard_violations(document, profile, drafted["draft"].parent, cc) == []


def test_synced_hub_decision_accepts_a_newline_and_refuses_a_different_policy(tmp_path):
    drafted = _draft(tmp_path)
    document = yaml.safe_load(drafted["draft"].read_text(encoding="utf-8"))
    decision_id = document["state_hub"]["decision_id"]
    document["state_hub"]["decision_api_url"] = f"http://127.0.0.1:8000/decisions/{decision_id}"
    document["state_hub"]["decision_resolved_at"] = "2026-10-18T10:46:17.864665Z"
    drafted["draft"].write_text(yaml.safe_dump(document, sort_keys=False), encoding="utf-8")
    policy_path = Path(drafted["policy_file"])
    policy_path.write_text(policy_path.read_text(encoding="utf-8") + "\n", encoding="utf-8")

    _record(drafted)
    assert len(_evidence(drafted["draft"])) == 1

    _differ(policy_path)
    with pytest.raises(EvidenceRefused, match="record-evidence refused"):
        _record(drafted)
    assert len(_evidence(drafted["draft"])) == 1