"""bao-session.sh grant: distinguish an absent policy from an unreadable one."""

import os
import subprocess
from pathlib import Path

SCRIPT = Path(__file__).resolve().parents[1] / "scripts" / "bao-session.sh"


def _run_grant(tmp_path, stub_stderr, stub_rc):
    bindir = tmp_path / "bin"
    bindir.mkdir()
    stub = bindir / "bao"
    stub.write_text(
        "#!/usr/bin/env bash\n"
        f"echo {stub_stderr!r} >&2\n"
        f"exit {stub_rc}\n"
    )
    stub.chmod(0o755)
    env = dict(os.environ)
    env["PATH"] = f"{bindir}:{env['PATH']}"
    env["HOME"] = str(tmp_path)
    env["GRANT_FILE"] = str(tmp_path / "grant")
    return subprocess.run(
        ["bash", str(SCRIPT), "grant", "t"], env=env, capture_output=True, text=True
    )


def test_absent_policy_reported_as_absent(tmp_path):
    r = _run_grant(tmp_path, "No policy named: ops-mason-survey", 2)
    assert r.returncode == 1
    assert "does not exist yet" in r.stdout
    assert not (tmp_path / "grant").exists()


def test_permission_denied_not_reported_as_absent(tmp_path):
    r = _run_grant(tmp_path, "Code: 403. Errors: * permission denied", 2)
    assert r.returncode == 1
    assert "does not exist" not in r.stdout
    assert "session expired or not permitted" in r.stdout
    assert not (tmp_path / "grant").exists()