import importlib.util,unittest
from pathlib import Path
from unittest.mock import patch
spec=importlib.util.spec_from_file_location("factor_metadata",Path(__file__).resolve().parents[1]/"scripts/keycape_factor_metadata.py")
m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
class FactorMetadataTests(unittest.TestCase):
 def test_exact_role_and_policy_scope(self):
  self.assertEqual(["keycape-factor-eso"],m.ROLE_CONFIG["bound_service_account_names"])
  self.assertEqual(["sso"],m.ROLE_CONFIG["bound_service_account_namespaces"])
  self.assertTrue(m.ROLE_CONFIG["token_no_default_policy"])
  self.assertEqual(900,m.ROLE_CONFIG["token_max_ttl"])
  policy=(m.ROOT/"openbao/policies"/(m.POLICY+".hcl")).read_text()
  self.assertNotIn("*",policy);self.assertNotIn("issuer",policy.splitlines()[1:])
  self.assertEqual(3,policy.count('capabilities = ["read"]'))
 def test_denied_capabilities_prevent_writes(self):
  calls=[]
  def fake(*args,**kwargs):
   calls.append(args)
   if args[:2]==("secrets","list"):return {"platform/":{"type":"kv","options":{"version":"2"}}}
   if args[:2]==("auth","list"):return {"kubernetes/":{"type":"kubernetes"}}
   return ["deny"]
  with patch.object(m,"call",side_effect=fake):
   with self.assertRaises(RuntimeError):m.execute(True)
  self.assertFalse(any(c[0]=="write" for c in calls))
 def test_mismatched_role_fails_readback(self):
  self.assertTrue(m.verify_role(dict(m.ROLE_CONFIG)))
  self.assertFalse(m.verify_role(dict(m.ROLE_CONFIG,token_policies=["root"])))

 def test_policy_readback_accepts_cli_and_api_shapes(self):
  self.assertEqual("expected",m.policy_text({"policy":"expected"}))
  self.assertEqual("expected",m.policy_text({"data":{"policy":"expected"}}))