"""workload-kv-write-next-version contract (NetKingdom NK-WP-0056 bounded executor); no values."""
import copy
import importlib.util
from pathlib import Path

import yaml

ROOT = Path(__file__).resolve().parents[1]
spec = importlib.util.spec_from_file_location("wkw", ROOT / "scripts/workload_kv_write_next_version.py")
m = importlib.util.module_from_spec(spec)
spec.loader.exec_module(m)
CCR = yaml.safe_load((ROOT / "credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml").read_text())


def test_checked_in_request_is_valid():
    assert m.validate_contract(CCR) == []


def test_policy_artifact_matches_contract():
    path = ROOT / CCR["openbao"]["policy_file"]
    assert path.read_text() == m.policy_hcl(CCR)
    hcl = m.policy_hcl(CCR)
    assert '"read", "update"' in hcl and "create" not in hcl and "metadata" not in hcl
    # required_parameters would refuse reads too (OpenBao 2.5.4, NK-WP-0056-T12); cas_required on the key
    # refuses writes without options.cas
    assert "required_parameters" not in hcl
    assert '"options" = []' in hcl and '"data" = []' in hcl


def test_write_shape_cannot_be_widened():
    for change in ({"cas_required": False}, {"create": True}, {"metadata_read": True}, {"delete": True},
                   {"mode": "any"}):
        ccr = copy.deepcopy(CCR); ccr["openbao"]["write"].update(change)
        assert m.validate_contract(ccr), change
    ccr = copy.deepcopy(CCR); ccr["openbao"]["kv_path"] = "platform/workloads/net-kingdom/*"
    assert m.validate_contract(ccr)
    ccr = copy.deepcopy(CCR); ccr["openbao"]["metadata_paths"] = ["x"]
    assert m.validate_contract(ccr)


def test_auth_is_one_serviceaccount_one_policy_15m():
    for key, value in (("ttl", "1h"), ("token_no_default_policy", False), ("audience", "x")):
        ccr = copy.deepcopy(CCR); ccr["openbao"]["auth"][key] = value
        assert m.validate_contract(ccr), key
    ccr = copy.deepcopy(CCR); ccr["openbao"]["auth"]["policies"].append("other")
    assert "openbao.auth.policies must contain exactly openbao.policy_name" in m.validate_contract(ccr)
    ccr = copy.deepcopy(CCR); ccr["openbao"]["auth"]["bound_claims"]["service_account_names"].append("x")
    assert m.validate_contract(ccr)


def test_fence_frontdoor_and_admission_required():
    ccr = copy.deepcopy(CCR); ccr["agent_fence"]["data_and_metadata_denied"] = False
    assert "coding agents must be fenced from the data and metadata paths" in m.validate_contract(ccr)
    ccr = copy.deepcopy(CCR); ccr["access_frontdoor"]["resolvable"] = True
    assert "runtime credential frontdoor must remain disabled" in m.validate_contract(ccr)
    ccr = copy.deepcopy(CCR); del ccr["admission"]
    assert m.validate_contract(ccr)


def test_approved_stage_needs_every_required_approval():
    ccr = copy.deepcopy(CCR); ccr["status"] = "approved"
    ccr["review"]["comments"] = [{"reviewer": "platform-owner", "decision": "approved"}]
    assert m.validate_contract(ccr) == ["explicit role approval missing: net-kingdom-owner"]