from __future__ import annotations

import sys
import unittest
from datetime import datetime, timezone
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "scripts"))

from s1_handoff import build_receipt  # noqa: E402
from s1_receipt import validate_receipt  # noqa: E402


HOSTS = [
    {"name": "Railiance01", "baseline_profile": "ufw-managed"},
    {"name": "CoulombCore", "baseline_profile": "external-firewall"},
]


class HandoffTests(unittest.TestCase):
    def test_all_hosts_and_evidence_produce_pass(self) -> None:
        receipt = build_receipt(
            revision="3734a1c",
            inventory_digest="a" * 64,
            hosts=HOSTS,
            results={"Railiance01": 0, "CoulombCore": 0},
            observed_at=datetime(2026, 8, 23, tzinfo=timezone.utc),
            freshness_hours=24,
            evidence=[
                {"kind": "goss-tap", "sha256": "b" * 64},
                {"kind": "goss-tap", "sha256": "c" * 64},
            ],
        )
        self.assertEqual("pass", receipt["status"])
        validate_receipt(receipt)

    def test_one_failed_host_fails_aggregate(self) -> None:
        receipt = build_receipt(
            revision="3734a1c",
            inventory_digest="a" * 64,
            hosts=HOSTS,
            results={"Railiance01": 0, "CoulombCore": 1},
            observed_at=datetime(2026, 8, 23, tzinfo=timezone.utc),
            freshness_hours=24,
            evidence=[],
        )
        self.assertEqual("fail", receipt["status"])

    def test_dry_run_cannot_claim_pass(self) -> None:
        receipt = build_receipt(
            revision="3734a1c",
            inventory_digest="a" * 64,
            hosts=HOSTS,
            results=None,
            observed_at=datetime(2026, 8, 23, tzinfo=timezone.utc),
            freshness_hours=24,
            evidence=[],
        )
        self.assertEqual("not-run", receipt["status"])


if __name__ == "__main__":
    unittest.main()