import contextlib
import importlib.util
import io
import unittest
from pathlib import Path
from unittest.mock import patch
spec = importlib.util.spec_from_file_location('proof', Path(__file__).resolve().parents[1]/'scripts/verify_informed_decision_requester.py')
m = importlib.util.module_from_spec(spec)
spec.loader.exec_module(m)

class ProofTests(unittest.TestCase):
    def test_negative_identity_is_bounded(self):
        with patch.object(m.Path, 'read_text', return_value='synthetic-only'), patch.object(m, 'http', return_value=(403, {})):
            result = m.run(True)
        self.assertTrue(result['complete'])
        self.assertTrue(result['wrong_identity_refused'])

    def test_exception_text_never_enters_receipt_or_output(self):
        output = io.StringIO()
        with patch.object(m.Path, 'read_text', side_effect=RuntimeError('SECRET-SENTINEL')), contextlib.redirect_stdout(output), contextlib.redirect_stderr(output):
            result = m.run()
        self.assertFalse(result['complete'])
        self.assertNotIn('SECRET-SENTINEL', str(result))
        self.assertEqual(output.getvalue(), '')

    def test_unexpected_admission_revokes_reader_and_still_fails(self):
        with patch.object(m.Path, 'read_text', return_value='synthetic-only'), patch.object(m, 'http', side_effect=[(200, {'auth': {'client_token': 'synthetic-reader'}}), (204, {}), (403, {})]):
            result = m.run(True)
        self.assertFalse(result['complete'])
        self.assertTrue(result['reader_revoked'])
        self.assertTrue(result['revoked_lookup_refused'])
        self.assertNotIn('synthetic-reader', str(result))

if __name__ == '__main__': unittest.main()