from __future__ import annotations

import importlib.util
import copy
import unittest
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
SPEC = importlib.util.spec_from_file_location("reef_exposure", ROOT / "scripts" / "validate-reef-exposure.py")
assert SPEC and SPEC.loader
module = importlib.util.module_from_spec(SPEC)
SPEC.loader.exec_module(module)
GrantError = module.GrantError
validate = module.validate


VALID = {
    "kind": "substrate-reef",
    "reef_id": "reef-example",
    "primary_rail": "rail-kubernetes",
    "exposure": {
        "posture": "public",
        "grants": [
            {"port": 80, "reason": "redirect", "approved_on": "2026-08-22", "residual_risk_owner": "infra"},
            {"port": 443, "reason": "tls", "approved_on": "2026-08-22", "residual_risk_owner": "infra"},
        ],
    },
}


class ReefExposureTests(unittest.TestCase):
    def test_valid_public_web_grants(self) -> None:
        self.assertEqual([80, 443], validate(VALID, [80, 443])["validated_ports"])

    def test_private_reef_fails(self) -> None:
        payload = {**VALID, "exposure": {"posture": "private"}}
        with self.assertRaisesRegex(GrantError, "must be public"):
            validate(payload, [443])

    def test_missing_port_fails(self) -> None:
        payload = copy.deepcopy(VALID)
        payload["exposure"]["grants"] = payload["exposure"]["grants"][:1]
        with self.assertRaisesRegex(GrantError, "port 443"):
            validate(payload, [443])

    def test_kubernetes_api_is_never_grantable(self) -> None:
        with self.assertRaisesRegex(GrantError, "operator-only"):
            validate(VALID, [6443])

    def test_provider_delegated_reef_fails(self) -> None:
        payload = {key: value for key, value in VALID.items() if key != "primary_rail"}
        with self.assertRaisesRegex(GrantError, "provider-delegated"):
            validate(payload, [443])


if __name__ == "__main__":
    unittest.main()