"""Configuration intent must never inherit a metadata survey's founder act."""
from pathlib import Path

import pytest

from warden.plan import build_plan
from warden.routing.catalog import Catalog, load_catalog

ROOT = Path(__file__).resolve().parents[1]
NEED = ('attended OpenBao platform administration to configure read policies and auth roles '
        'for Coulomb and email backup delivery')


@pytest.fixture
def catalog(monkeypatch):
    monkeypatch.setenv('WARDEN_POSTURE_CATALOG', str(ROOT / 'registry/policy/security-posture.yaml'))
    return load_catalog(ROOT / 'registry/routing/catalog.yaml')


@pytest.mark.parametrize('need', [NEED,
    'configure OpenBao policies and Kubernetes auth roles for backup delivery',
    'apply OpenBao read policy for an explicitly reviewed service account'])
def test_configuration_requires_attended_admin_identity(catalog, need):
    plan = build_plan(need, catalog=catalog)
    assert plan.lane_id == 'openbao-platform-admin-login'
    assert plan.verdict == 'founder_required' and plan.founder_act.kind == 'oidc_login'
    assert all('--fetch' not in command and '--out' not in command for command in plan.commands)


@pytest.mark.parametrize('need', [
    'survey existing OpenBao policies and roles for backup delivery',
    'OpenBao read-only metadata survey policy approle consumer backup',
    'inspect OpenBao structure metadata policy approle'])
def test_survey_remains_metadata_only(catalog, need):
    plan = build_plan(need, catalog=catalog)
    assert plan.lane_id == 'openbao-structure-survey'
    assert plan.founder_act.kind == 'approve'


def test_explicit_lane_id_still_wins_and_missing_admin_fails_closed(catalog):
    assert catalog.find('openbao-structure-survey')[0].id == 'openbao-structure-survey'
    unavailable = Catalog(catalog.path, [entry for entry in catalog.entries
                                        if entry.id != 'openbao-platform-admin-login'])
    plan = build_plan(NEED, catalog=unavailable)
    assert plan.verdict == 'unroutable' and plan.lane_id is None
    assert not plan.commands


def test_pair_provisioning_routes_to_custody_not_survey(catalog):
    need = "provision a Scaleway object storage backup publisher key pair into OpenBao custody"
    plan = build_plan(need, catalog=catalog)
    assert plan.lane_id == "openbao-api-key"
    assert plan.verdict == "founder_required"
    assert plan.founder_act.kind == "paste_once_provision"
    assert not any("plan-survey" in command for command in plan.commands)


def test_missing_custody_frontdoor_fails_closed(catalog):
    unavailable = Catalog(catalog.path, [e for e in catalog.entries if e.id != "openbao-api-key"])
    assert build_plan("provision OpenBao backup key pair", catalog=unavailable).verdict == "unroutable"