"""attended-service-credential-delivery contract (NetKingdom NK-WP-0056-T04); no values."""
import copy
import importlib.util
from pathlib import Path

import yaml

ROOT = Path(__file__).resolve().parents[1]
spec = importlib.util.spec_from_file_location("asd", ROOT / "scripts/attended_service_delivery.py")
m = importlib.util.module_from_spec(spec)
spec.loader.exec_module(m)
CCR = yaml.safe_load((ROOT / "credential-change-requests/CCR-2026-0055-net-kingdom-privacyidea-bind.yaml").read_text())


def test_checked_in_request_is_valid():
    assert m.validate_contract(CCR) == []


def test_any_workload_access_is_refused():
    for change in ({"policy_name": "x"}, {"runtime_access": True}, {"initial_cas": 1},
                   {"auth": {"method": "kubernetes", "mount": "kubernetes", "role": "x"}}):
        ccr = copy.deepcopy(CCR); ccr["openbao"].update(change)
        assert m.validate_contract(ccr), change
    ccr = copy.deepcopy(CCR); ccr["access_frontdoor"]["resolvable"] = True
    assert "runtime credential frontdoor must remain disabled" in m.validate_contract(ccr)


def test_delivery_and_lifecycle_are_required():
    ccr = copy.deepcopy(CCR); del ccr["delivery"]["gate"]
    assert "delivery needs surface, service, target, procedure and gate" in m.validate_contract(ccr)
    ccr = copy.deepcopy(CCR); ccr["lifecycle"]["rotate"] = ""
    assert "lifecycle.rotate required" in m.validate_contract(ccr)


def test_applied_stage_needs_every_required_approval():
    ccr = copy.deepcopy(CCR); ccr["status"] = "verified"
    ccr["review"]["comments"] = [{"reviewer": "User (platform-owner)", "decision": "approved"}]
    assert m.validate_contract(ccr) == ["explicit role approval missing: net-kingdom-owner"]
    ccr["review"]["comments"].append({"reviewer": "net-kingdom-owner", "decision": "approved"})
    assert m.validate_contract(ccr) == []