from __future__ import annotations

import copy
import json
import sys
import unittest
import uuid
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "scripts"))

from check_secret_paths import is_encrypted_content, is_protected_path  # noqa: E402
from s1_receipt import ReceiptError, load_receipt, validate_receipt  # noqa: E402
from sops_rotation import rotation_plan  # noqa: E402


class SecretAndReceiptContractTests(unittest.TestCase):
    def test_inventory_secret_paths_are_protected(self) -> None:
        self.assertTrue(is_protected_path("secrets/provider.yaml"))
        self.assertTrue(is_protected_path("inventory/group_vars/secrets.sops.yaml"))
        self.assertFalse(is_protected_path("inventory/group_vars/all.yaml"))

    def test_plaintext_and_empty_files_fail(self) -> None:
        self.assertFalse(is_encrypted_content("secrets/example.yaml", "value: clear"))
        self.assertFalse(is_encrypted_content("secrets/example.age", ""))
        self.assertTrue(is_encrypted_content("secrets/example.yaml", "sops:\n  age: []\n"))

    def test_synthetic_chain_validates(self) -> None:
        load_receipt(ROOT / "docs" / "evidence" / "s1-receipts" / "synthetic-provisioning-chain.json")

    def test_incomplete_passing_chain_fails(self) -> None:
        payload = json.loads(
            (ROOT / "docs" / "evidence" / "s1-receipts" / "synthetic-provisioning-chain.json").read_text()
        )
        payload["phases"][2]["status"] = "not-run"
        with self.assertRaisesRegex(ReceiptError, "every phase"):
            validate_receipt(payload)

    def test_secret_shaped_receipt_content_fails(self) -> None:
        payload = json.loads(
            (ROOT / "docs" / "evidence" / "s1-receipts" / "synthetic-provisioning-chain.json").read_text()
        )
        payload["token"] = "not-even-a-real-value"
        with self.assertRaisesRegex(ReceiptError, "secret-shaped key"):
            validate_receipt(payload)

        payload.pop("token")
        payload["provider_access_token"] = "redacted-is-still-not-allowed"
        with self.assertRaisesRegex(ReceiptError, "secret-shaped key"):
            validate_receipt(payload)

    def test_passing_verification_without_evidence_fails(self) -> None:
        payload = {
            "schema_version": "1.0",
            "receipt_id": str(uuid.uuid4()),
            "event_type": "verification",
            "synthetic": False,
            "created_at": "2026-08-23T09:30:00Z",
            "source_revision": "3734a1c",
            "inventory_sha256": "a" * 64,
            "status": "pass",
            "hosts": ["Railiance01"],
            "profiles": {"Railiance01": "ufw-managed"},
            "observed_at": "2026-08-23T09:30:00Z",
            "fresh_until": "2026-08-24T09:30:00Z",
            "evidence": [],
        }
        with self.assertRaisesRegex(ReceiptError, "host evidence"):
            validate_receipt(payload)

    def test_current_sops_recipient_metadata_matches_policy(self) -> None:
        plan = rotation_plan(ROOT)
        self.assertTrue(plan)
        self.assertFalse(any(item["changed"] for item in plan))


if __name__ == "__main__":
    unittest.main()