"""Public export preserves the canonical YAML approval state and exact policy."""

import hashlib
import importlib.util
import json
import sys
from pathlib import Path

import pytest
import yaml

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "scripts"))
spec = importlib.util.spec_from_file_location(
    "exporter", ROOT / "scripts/render_backup_credential_contract.py"
)
e = importlib.util.module_from_spec(spec)
spec.loader.exec_module(e)


@pytest.mark.parametrize("application", e.PROFILES)
def test_owner_yaml_updates_export_without_node_yaml_dependency(application, tmp_path):
    source = (
        ROOT
        / "credential-change-requests"
        / f"{e.PROFILES[application]['ccr']}-{application}-backup-primary.yaml"
    )
    ccr = yaml.safe_load(source.read_text())
    ccr["status"] = "applied"
    ccr["openbao"]["auth"]["bound_claims_confirmed"] = True
    ccr["review"]["comments"] = []
    ccr["delivery"]["admission"] = {
        "node_executor_approved": False,
        "provider_scope_verified": False,
        "reader_boundary_verified": False,
        "source_ref": None,
    }
    candidate = tmp_path / "reviewed.yaml"
    candidate.write_text(yaml.safe_dump(ccr))
    raw = e.render(candidate, application)
    exported = json.loads(raw)
    assert exported["status"] == "applied"
    assert exported["source_ccr_sha256"] == hashlib.sha256(candidate.read_bytes()).hexdigest()
    assert len(exported["policy_sha256"]) == 64
    # Export is a representation, not an approval: missing reviews/admission fail.
    with pytest.raises(Exception):
        e.contract(raw, application, True, hashlib.sha256(raw).hexdigest())


def test_export_rejects_source_secret_marker(tmp_path):
    source = ROOT / "credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml"
    ccr = json.loads(source.read_bytes())
    ccr["accidental_value"] = "AGE-SECRET-KEY-1SYNTHETIC"
    candidate = tmp_path / "bad.yaml"
    candidate.write_text(yaml.safe_dump(ccr))
    with pytest.raises(ValueError, match="invalid_reader_contract"):
        e.render(candidate, "coulomb-social")


def test_export_cannot_change_reader_namespace(tmp_path):
    source = ROOT / "credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml"
    ccr = json.loads(source.read_bytes())
    ccr["openbao"]["auth"]["bound_claims"]["service_account_namespaces"] = ["email-connect"]
    candidate = tmp_path / "bad.yaml"
    candidate.write_text(yaml.safe_dump(ccr))
    with pytest.raises(Exception):
        e.render(candidate, "coulomb-social")