import copy
import json
from datetime import datetime, timezone
from pathlib import Path

import yaml

from secrets_engine.catalog import validate_entry
from secrets_engine.secret_use import LANE_FIELDS, snapshot, snapshot_lane
from tests.test_catalog import VALID

NOW = datetime(2026, 9, 2, 12, 0, tzinfo=timezone.utc)


def _write_catalog(tmp_path: Path, data=None):
    entry = copy.deepcopy(data or VALID)
    path = tmp_path / "catalog"
    path.mkdir()
    (path / f"{entry['id']}.yaml").write_text(
        yaml.safe_dump(entry), encoding="utf-8"
    )
    return path


def test_snapshot_omits_unknown_ready_and_never_claims_completeness(tmp_path):
    catalog = _write_catalog(tmp_path)
    payload = snapshot(catalog, tmp_path / "evidence", now=NOW)
    assert payload["completeness_claimed"] is False
    assert payload["cadence"]["form"] == "heartbeat"
    assert payload["cadence"]["interval"] == "1d"
    assert payload["surface"] == "secret-use-evidence"
    assert len(payload["lanes"]) == 1
    lane = payload["lanes"][0]
    assert lane["catalog_id"] == "test-lane"
    assert "ready" not in lane
    assert set(lane) <= set(LANE_FIELDS)


def test_snapshot_reads_last_verify_and_session_without_secrets(tmp_path):
    catalog = _write_catalog(tmp_path)
    evidence = tmp_path / "evidence"
    evidence.mkdir()
    records = [
        {
            "catalog_id": "test-lane",
            "action": "verify",
            "result": "pass",
            "decision_id": "dec-1",
            "evidence_kind": "attributive",
            "detail": {
                "session": {
                    "session_handle": "abc123def456",
                    "revocation_attempted": True,
                    "revocation_succeeded": True,
                },
                "secret": "npm_SHOULDNEVERAPPEAR",
            },
        },
        {
            "catalog_id": "test-lane",
            "action": "revoke",
            "result": "native-access-deactivated",
            "detail": {"stance_stage": "test", "stance_failure_mode": "fail_open"},
        },
    ]
    (evidence / "evidence-2026-09-02.jsonl").write_text(
        "".join(json.dumps(row) + "\n" for row in records), encoding="utf-8"
    )
    lane = snapshot_lane(
        validate_entry(copy.deepcopy(VALID)), evidence, now=NOW
    )
    assert lane["ready"] is True
    assert lane["session_handle"] == "abc123def456"
    assert lane["revocation_attempted"] is True
    assert lane["revocation_succeeded"] is True
    assert lane["lifecycle_operation"] == "revoke"
    assert lane["decision_id"] == "dec-1"
    assert lane["stance_stage"] == "test"
    dumped = json.dumps(lane)
    assert "npm_SHOULDNEVERAPPEAR" not in dumped
    assert "secret" not in lane
    assert set(lane) <= set(LANE_FIELDS)


def test_snapshot_does_not_contact_openbao(tmp_path, monkeypatch):
    from secrets_engine import secret_use

    monkeypatch.setattr(
        secret_use,
        "load_catalog",
        lambda *_args, **_kwargs: {"test-lane": validate_entry(copy.deepcopy(VALID))},
    )
    # If OpenBao were imported/called, this would be the failure mode to catch
    # in handlers. The snapshot function has no OpenBao client parameter.
    payload = snapshot(tmp_path, tmp_path, now=NOW)
    assert payload["lanes"][0]["mount"] == "secret"
    assert payload["completeness_claimed"] is False