"""Source safety bounds; live JWT verification remains attended acceptance."""
import json
import re
import unittest
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]

class ServiceJWTContract(unittest.TestCase):
    def test_platform_identity_is_exact_and_cannot_be_an_applier(self):
        role = json.loads((ROOT / "openbao/auth/secrets-engine-jwt-role.json").read_text())
        self.assertEqual(role["bound_audiences"], ["secrets-engine-openbao"])
        self.assertEqual(role["bound_subject"], "service:secrets-engine")
        self.assertEqual(role["bound_claims"], dict(principal_type="service", tenant="tenant:platform", roles="secrets-engine", scope="openbao:login"))
        self.assertEqual(role["bound_claims_type"], "string")
        self.assertEqual(role["token_policies"], ["secrets-engine-login-self"])
        self.assertTrue(role["token_no_default_policy"])
        self.assertFalse(role["verbose_oidc_logging"])
        self.assertEqual(role["token_type"], "service")
        self.assertEqual(role["token_num_uses"], 8)
        for key in ("token_ttl", "token_max_ttl", "token_explicit_max_ttl"):
            self.assertEqual(role[key], "5m")
        self.assertNotIn("token_period", role)

    def test_only_self_endpoints_and_pinned_signature_verifier(self):
        policy = (ROOT / "openbao/policies/secrets-engine-login-self.hcl").read_text()
        grants = re.findall(r'path "([^"]+)"\s*{\s*capabilities = \["([^"]+)"\]', policy)
        self.assertEqual(grants, [("auth/token/lookup-self", "read"), ("sys/capabilities-self", "update"), ("auth/token/revoke-self", "update")])
        self.assertNotIn("*", policy)
        config = json.loads((ROOT / "openbao/auth/keycape-services-config.json").read_text())
        self.assertEqual(config, dict(jwks_url="https://kc.coulomb.social/jwks", bound_issuer="https://kc.coulomb.social", jwt_supported_algs=["RS256"]))