"""Real CCR schema/applier contract, no credentials or backend invocation."""
from copy import deepcopy
import importlib.util
import json
from pathlib import Path
import yaml
ROOT=Path(__file__).resolve().parents[1]
spec=importlib.util.spec_from_file_location('signer_ccr',ROOT/'scripts/credential-change.py')
ccr_module=importlib.util.module_from_spec(spec);spec.loader.exec_module(ccr_module)
CCR=ROOT/'credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml'


def test_real_schema_and_apply_refusal():
    ccr,errors,warnings=ccr_module.validate_ccr(CCR)
    assert errors==[]
    assert warnings==['OIDC/Kubernetes bound claim is not confirmed; apply is blocked']
    blockers=ccr_module.applier_readiness_blockers(ccr)
    assert len(blockers)==2
    assert any('status, got proposed' in x for x in blockers)
    assert any('confirmed OpenBao auth binding' in x for x in blockers)
    assert ccr['review']['comments']==[] and ccr['access_frontdoor']['resolvable'] is False
    # Pure synthetic candidate only: ensure admitted-pattern scope has no latent
    # schema/applier role/field failures once the real owners eventually approve.
    admitted=deepcopy(ccr);admitted['status']='approved';admitted['openbao']['auth']['bound_claims_confirmed']=True
    assert ccr_module.applier_readiness_blockers(admitted)==[]


def test_generated_read_scope_and_projection_join():
    ccr,_,_=ccr_module.validate_ccr(CCR)
    assert (ROOT/ccr['openbao']['policy_file']).read_text()==ccr_module.generated_policy_hcl(ccr)
    hcl=ccr_module.generated_policy_hcl(ccr)
    assert 'metadata/' not in hcl and 'list' not in hcl and 'create' not in hcl
    assert ccr['openbao']['fields']==['ED25519_PRIVATE_KEY']
    docs=list(yaml.safe_load_all((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed').read_text()))
    store=next(x for x in docs if x['kind']=='SecretStore')
    assert store['spec']['provider']['vault']['auth']['kubernetes']['role']==ccr['openbao']['auth']['role']
    external=next(x for x in docs if x['kind']=='ExternalSecret')
    assert external['spec']['data']==[{'secretKey':'seed','remoteRef':{'key':'workloads/flex-auth/envelope-signing','property':'ED25519_PRIVATE_KEY'}}]


def test_native_scope_separates_read_grant_and_unadmitted_execution():
    plan=json.loads((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_text())
    assert plan['authority_granted'] is False and plan['status']=='prepared-unapproved'
    assert plan['bootstrap']['expected_version']==0
    assert all(x['disposition'].startswith('pending ') for x in plan['reviews_required'])
    assert 'implementation/independent tests still required' in plan['protected_adapter']['state']
    assert plan['receipts']['maximum_bytes']==65536
    assert all('platform/' in x['path'] for x in plan['bootstrap']['allowed_native_methods'])
    assert 'zero flex-auth PVCs' in plan['requested_scope']['new_resources']