"""The CCR record-evidence gate matches a policy and refuses a different one."""

from pathlib import Path

import pytest
import yaml

from ops_mason.ccr_gate import EvidenceRefused, draft_from_plan, record_evidence

DECISION_ID = "00000000-0000-4000-8000-000000000001"
KV_PATH = "platform/workloads/fixture/reader"


def _draft(tmp_path: Path) -> dict:
    return draft_from_plan(
        kv_path=KV_PATH,
        plan_ref={
            "repo": "ops-mason",
            "path": "plans/fixture.md",
            "commit": "0123456789abcdef",
        },
        decision_id=DECISION_ID,
        out_dir=tmp_path,
    )


def _evidence(draft: Path) -> list:
    document = yaml.safe_load(draft.read_text(encoding="utf-8"))
    return (document.get("verification") or {}).get("evidence") or []


def test_record_evidence_accepts_a_trailing_newline_and_refuses_a_different_policy(tmp_path):
    drafted = _draft(tmp_path)
    policy_path = Path(drafted["policy_file"])
    # The platform generator's text, plus one trailing newline, still matches.
    policy_path.write_text(policy_path.read_text(encoding="utf-8") + "\n", encoding="utf-8")

    completed = record_evidence(
        drafted["draft"],
        built_policy=drafted["built_policy"],
        actor="ops-mason",
        kind="metadata_apply",
        result="passed",
        detail=["built policy matched the CCR policy file"],
    )

    assert completed.returncode == 0
    assert "record-evidence" in completed.args
    assert "sync-decision" not in completed.args
    recorded = _evidence(drafted["draft"])
    assert len(recorded) == 1
    assert recorded[0]["kind"] == "metadata_apply"
    assert recorded[0]["result"] == "passed"
    assert "matched the CCR policy file" in recorded[0]["details"][0]

    policy_path.write_text(
        policy_path.read_text(encoding="utf-8").replace('["read"]', '["create"]', 1),
        encoding="utf-8",
    )
    with pytest.raises(EvidenceRefused, match="record-evidence refused"):
        record_evidence(
            drafted["draft"],
            built_policy=drafted["built_policy"],
            actor="ops-mason",
            kind="metadata_apply",
            result="passed",
            detail=["built policy matched the CCR policy file"],
        )
    assert len(_evidence(drafted["draft"])) == 1
    stored = drafted["draft"].read_text(encoding="utf-8")
    assert "sync-decision" not in stored
    assert DECISION_ID in stored