"""Layer-model conformance (security-layer-model_v0.7 §3.3, §6, §11).

The declaration must be this repository's own, machine-readable, and equal to
the shipped production fail-closed gate. A published stance map that may drift
from the code is worse than none.
"""
from __future__ import annotations

import subprocess
import sys
from pathlib import Path
from types import SimpleNamespace

import pytest
import yaml

from secrets_engine.catalog import validate_entry
from secrets_engine.cli import _require_lane_approval
from secrets_engine.errors import DecisionError

from tests.test_catalog import VALID

ROOT = Path(__file__).resolve().parents[1]
SCRIPT = ROOT / "scripts" / "check_layer_conformance.py"
DECL = ROOT / "layer.yaml"
STANCE = ROOT / "pep-stance.yaml"
INTENT = ROOT / "INTENT.md"


def _decl() -> dict:
    return yaml.safe_load(DECL.read_text(encoding="utf-8"))


def _stance() -> dict:
    return yaml.safe_load(STANCE.read_text(encoding="utf-8"))


def test_declares_engine_lifecycle_in_its_own_voice():
    assert DECL.exists(), "no layer.yaml — §11 requires a machine-readable declaration"
    data = _decl()
    assert data["repository"] == "secrets-engine"
    assert data["layer"] == "engine"
    assert data["role"] == "lifecycle"
    assert data["declared_by"] == "INTENT.md"
    assert data["decision_surfaces_exposed"] == "none"
    assert data["pep_shaped"] is True


def test_intent_frontmatter_matches_declaration():
    text = INTENT.read_text(encoding="utf-8")
    assert text.startswith("---"), "companion §2 requires INTENT.md frontmatter"
    end = text.find("\n---", 3)
    front = yaml.safe_load(text[3:end])
    assert front["layer"] == "Engine"
    assert front["role"] == "Lifecycle"
    assert front["declaration"] == "layer.yaml"
    assert front["pep_stance"] == "pep-stance.yaml"


def test_checker_passes_on_the_real_tree():
    result = subprocess.run(
        [sys.executable, str(SCRIPT)],
        capture_output=True,
        text=True,
        check=False,
    )
    assert result.returncode == 0, result.stdout + result.stderr


def test_proposed_capabilities_carry_gap_record_fields():
    for cap in _decl()["proposed_capabilities"]:
        for field in ("capability", "intended_owner", "blocked_on", "review", "state"):
            assert cap.get(field), f"{cap.get('id')} missing {field}"
        assert cap["state"] == "unowned-capability"
        assert cap["owner_status"] == "proposed"


def test_stance_map_is_total_over_catalog_stages():
    stance = _stance()["stance"]
    required = {"build", "test", "prod", "unknown"}
    assert required <= set(stance), f"stance not total; missing {required - set(stance)}"
    assert set(stance.values()) <= {"fail_open", "fail_closed"}
    assert stance["prod"] == "fail_closed"
    assert stance["unknown"] == "fail_closed"
    assert _stance()["verdict_caching"] == "none"


def test_published_prod_stance_equals_shipped_fail_closed(monkeypatch):
    """pep-stance.yaml prod: fail_closed must equal _require_lane_approval."""
    assert _stance()["stance"]["prod"] == "fail_closed"
    entry = validate_entry(dict(VALID, stage="prod", approval={"model": "bootstrap-only"}))
    cfg = SimpleNamespace(hub_url="http://127.0.0.1:8000", bao_addr="http://127.0.0.1:8200")
    monkeypatch.delenv("SECRETS_ENGINE_UNSAFE_DEMO", raising=False)
    with pytest.raises(DecisionError, match="live production remains disabled"):
        _require_lane_approval(cfg, entry, "apply")


def test_build_stage_is_not_the_production_fail_closed_gate(tmp_path, monkeypatch):
    """build is fail_open relative to access-engine: lane approval still applies."""
    assert _stance()["stance"]["build"] == "fail_open"
    (tmp_path / ".decisions").mkdir()
    (tmp_path / ".decisions" / "x.yaml").write_text(
        "id: x\ntitle: approved\nstatus: resolved\nsuperseded_by: null\n"
    )
    import secrets_engine.cli as cli

    monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
    entry = validate_entry(
        dict(
            VALID,
            stage="build",
            path="build/team/thing",
            approval={"model": "decision", "decision_ref": "x"},
        )
    )
    cfg = SimpleNamespace(hub_url="", bao_addr="http://127.0.0.1:8200")
    assert _require_lane_approval(cfg, entry, "apply").id == "x"