ops-mason/tests/test_wp_0013_0014_evidence.py

"""MASON-WP-0013 and MASON-WP-0014 evidence stays name-only and fail-closed."""

import importlib.util
import re
import sys
from pathlib import Path

import pytest
import yaml

ROOT = Path(__file__).parents[1]
spec = importlib.util.spec_from_file_location(
    "plan_survey", ROOT / "scripts" / "plan-survey.py"
)
survey = importlib.util.module_from_spec(spec)
sys.modules["plan_survey"] = survey
spec.loader.exec_module(survey)

READER_ARGS = [
    "--kv-path",
    "platform/workloads/reuse/reuse-surface/forgejo-source-read",
    "--policy",
    "workload-kv-read-reuse-surface-runtime-eso",
    "--k8s-role",
    "reuse-surface-runtime-eso",
    "--consumer",
    "reuse-surface",
    "--keyword",
    "forgejo",
]
MAS_ARGS = [
    "--kv-path",
    "platform/suppliers/scaleway/mas-tem-relay",
    "--policy",
    "workload-kv-read-mas-tem-relay",
    "--k8s-role",
    "external-secrets-mas-tem-relay",
    "--consumer",
    "mail-address-semantics",
]


def _task_status(text: str, task_id: str) -> str:
    match = re.search(rf"id: {re.escape(task_id)}\nstatus: (\w+)", text)
    assert match, task_id
    return match.group(1)


def _frontmatter(text: str) -> dict:
    return yaml.safe_load(text.split("---", 2)[1])


def _flat(text: str) -> str:
    return re.sub(r"\s+", " ", text)


def _intake(intake_id: str) -> dict:
    text = (ROOT / "intakes" / "intakes.md").read_text()
    blocks = re.findall(r"```yaml\n(.*?)```", text, re.S)
    for block in blocks:
        data = yaml.safe_load(block)
        if isinstance(data, dict) and data.get("id") == intake_id:
            return data
    raise AssertionError(intake_id)


@pytest.mark.parametrize("args", [READER_ARGS, MAS_ARGS])
def test_plan_survey_refuses_without_grant(args, monkeypatch, tmp_path, capsys):
    monkeypatch.delenv("BAO_TOKEN", raising=False)
    monkeypatch.setattr(survey, "GRANT_FILE", str(tmp_path / "absent-grant"))
    calls = []

    def runner(argv, env):
        calls.append(argv)
        raise AssertionError("survey must not call bao without a grant")

    with pytest.raises(survey.SurveyError, match="no ops-mason-survey grant"):
        survey.main(args, runner=runner, environ={"BAO_ADDR": "http://127.0.0.1:18200"})
    assert calls == []
    assert capsys.readouterr().out == ""


def test_mas_teardown_intake_is_residual_and_value_free():
    data = _intake("MASON-IN-0007")
    description = data["description"]
    assert data["origin"] == "residual"
    assert data["origin_ref"] == "MASON-WP-0014"
    assert data["status"] == "open"
    assert "external-secrets-mas-tem-relay" in description
    assert "workload-kv-read-mas-tem-relay" in description
    assert "platform/suppliers/scaleway/mas-tem-relay" in description
    assert "metadata delete" in description
    assert "Scaleway API key" in description
    assert "MAS-WP-0003" in description
    lowered = description.lower()
    for banned in ("password", "username", "hvs.", "token=", "begin private"):
        assert banned not in lowered


def test_mas_delivery_check_stays_wait_until_metadata_grant():
    workplan = (ROOT / "workplans" / "MASON-WP-0014-mas-tem-relay-smtp.md").read_text()
    plan = (ROOT / "plans" / "mas-tem-relay-smtp.md").read_text()
    assert _frontmatter(workplan)["status"] == "proposed"
    assert _task_status(workplan, "MASON-WP-0014-T04") == "wait"
    assert "needs_human: true" in workplan
    assert "0b55e53b-2531-466c-a2f9-282618b183f8" in workplan
    assert _task_status(workplan, "MASON-WP-0014-T01") == "done"
    for text in (workplan, plan):
        flat = _flat(text)
        assert "no ops-mason-survey grant" in flat
        assert "SecretSynced" in flat
        assert "binding name `mas-relay`" in flat
        assert "MASON-IN-0007" in flat
    assert "current_version" not in workplan.split("2026-10-21 check", 1)[1]


def test_private_reader_stays_draft_without_survey_or_success():
    workplan = (
        ROOT / "workplans" / "MASON-WP-0013-reuse-surface-private-source-reader.md"
    ).read_text()
    plan = (ROOT / "plans" / "reuse-surface-private-source-reader.md").read_text()
    assert _frontmatter(workplan)["status"] == "proposed"
    assert _frontmatter(plan)["status"] == "draft"
    for task_id in (
        "MASON-WP-0013-T02",
        "MASON-WP-0013-T03",
        "MASON-WP-0013-T04",
    ):
        assert _task_status(workplan, task_id) == "wait"
    assert "needs_human: true" in workplan
    assert "0b55e53b-2531-466c-a2f9-282618b183f8" in workplan
    assert "does not approve this plan" in _flat(workplan)
    flat_plan = _flat(plan)
    flat_workplan = _flat(workplan)
    assert "no ops-mason-survey grant" in flat_plan
    assert "Q1:" in flat_plan and "Q2:" in flat_plan and "Q3:" in flat_plan
    assert "9833715e-a22a-45c0-ab6c-881f0f4f1a0e" in flat_workplan
    assert "CCR-2026-0046" in flat_workplan
    assert "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52" in flat_workplan
    assert "RPF-WP-0058-T05" in flat_workplan
    assert "not an ops-mason success publication" in flat_workplan