"""Source checks for the netkingdom OpenBao role files (RPF-WP-0065). No live access."""
import json
from pathlib import Path

AUTH = Path(__file__).resolve().parents[1] / 'openbao/auth'


def role(name):
    return json.loads((AUTH / name).read_text())


def test_platform_admin_binds_group_and_aal2():
    r = role('netkingdom-platform-admin-role.json')
    assert r['bound_claims_type'] == 'string'
    assert r['bound_claims'] == {'groups': ['net-kingdom-admins'], '/assurance/level': 'aal2'}
    assert r['groups_claim'] == 'groups'
    assert r['token_policies'] == ['platform-admin', 'operator-custody']


def test_platform_admin_matches_credential_broker_assurance_binding():
    admin = role('netkingdom-platform-admin-role.json')['bound_claims']
    broker = role('credential-broker-keycape-client-secret-generate-oidc-role.json')['bound_claims']
    assert admin['/assurance/level'] == broker['/assurance/level'] == 'aal2'


def test_coding_agent_accepts_service_and_agent_during_transition():
    r = role('coding-agent-jwt-role.json')
    claims = r['bound_claims']
    assert sorted(claims['principal_type']) == ['agent', 'service']
    # nothing else loosened
    assert claims['sub'] == 'service:codex:railiance-platform'
    assert claims['tenant'] == 'tenant:platform'
    assert claims['roles'] == 'coding-agent'
    assert r['bound_audiences'] == ['codex-railiance-platform']
    assert r['token_ttl'] == r['token_max_ttl'] == '15m'
    assert r['token_no_default_policy'] is True
    assert 'default' not in r['token_policies']