"""Actual NetKingdom 1.2 source selection; no accepted/native case fixture."""
import json
from pathlib import Path

import pytest
import yaml

from ops_mason import case_plan, cli

NK = case_plan.DEFAULT_NK_ROOT
TYPES = NK / "security-case-type-revisions/1.2"
CASE = TYPES / "oidc-browser-relying-party/examples/forgejo.yaml"
pytestmark = pytest.mark.skipif(not CASE.is_file(), reason="NetKingdom 1.2 source absent")


def test_explicit_source_root_renders_actual_six_object_draft(tmp_path, capsys):
    output = tmp_path / "plan.md"
    assert cli.main(["plan", "--case", str(CASE), "--types-root", str(TYPES),
                     "--no-live", "--allow-unimplemented", "--out", str(output)]) == 0
    plan = output.read_text()
    front = yaml.safe_load(plan.split("---\n", 2)[1])
    assert front["status"] == "draft"
    assert front["case_acceptance"] is None
    assert front["derived_from_type"] == "oidc-browser-relying-party@1.2"
    assert front["reference_case"] is True
    case, doc, rendered = case_plan.render(CASE, types_root=TYPES, allow_unimplemented=True)
    assert case["spec"]["status"] == "proposed"
    assert "acceptance" not in case["spec"]
    assert doc["spec"]["status"] == "acknowledged"
    assert len(rendered["materialization"]) == 6
    role = next(item for item in rendered["materialization"]
                if item["id"] == "consumer-eso-role")
    body = yaml.safe_load(role["body"])
    assert body["bound_service_account_namespaces"] == ["forgejo"]
    assert body["bound_service_account_names"] == ["forgejo-keycape-forgejo-eso"]
    assert front["render_digest"] == rendered["digest"]
    assert json.loads(capsys.readouterr().err)["ok"] is True


def test_explicit_root_does_not_waive_implemented_gate(tmp_path, capsys):
    output = tmp_path / "plan.md"
    assert cli.main(["plan", "--case", str(CASE), "--types-root", str(TYPES),
                     "--no-live", "--out", str(output)]) == 2
    assert not output.exists()
    assert "only implemented types" in capsys.readouterr().err


def test_missing_explicit_root_never_falls_forward_to_12(tmp_path, capsys):
    output = tmp_path / "plan.md"
    assert cli.main(["plan", "--case", str(CASE), "--no-live",
                     "--allow-unimplemented", "--out", str(output)]) == 2
    assert not output.exists()
    assert "not 1.2" in capsys.readouterr().err


def test_proposed_case_cannot_build_even_with_selected_acknowledged_source(tmp_path, capsys):
    output = tmp_path / "bundle"
    assert cli.main(["build", "--case", str(CASE), "--types-root", str(TYPES),
                     "--allow-unimplemented", "--plan", str(tmp_path / "absent-plan.md"),
                     "--out", str(output)]) == 2
    assert not output.exists()
    assert "case is not accepted" in capsys.readouterr().err


def test_historical_bundle_cannot_attest_12_inventory(tmp_path, capsys):
    owner = Path("/home/worsch/ops-mason")
    assert cli.main(["structure-request", "--case", str(CASE), "--types-root", str(TYPES),
                     "--allow-unimplemented", "--plan", str(owner / "plans/case-forgejo-netkingdom-oidc.md"),
                     "--bundle", str(owner / "builds/case-forgejo-netkingdom-oidc")]) == 2
    captured = capsys.readouterr()
    assert captured.out == ""
    assert json.loads(captured.err)["error"] == "structural-source-preparation-refused"


def test_actual_validator_refuses_invalid_consumer_namespace(tmp_path, capsys):
    case = yaml.safe_load(CASE.read_text())
    case["spec"]["parameters"]["consumer_namespace"] = "../../other"
    source = tmp_path / "case.yaml"
    source.write_text(yaml.safe_dump(case))
    assert cli.main(["plan", "--case", str(source), "--types-root", str(TYPES),
                     "--no-live", "--allow-unimplemented"]) == 2
    captured = capsys.readouterr()
    assert captured.out == ""
    assert "consumer_namespace" in captured.err