from secrets_engine.catalog import load_catalog
from secrets_engine.config import repo_root
from secrets_engine.plan import build_plan

ADMITTED = (
    "openrouter-llm-connect",
    "email-connect-transactional",
    "issue-core-ingestion-api-key",
    "reuse-surface-hub-write-token",
    "forgejo-admin-api-token",
)
FIRST_LANE = "openrouter-llm-connect"


def test_admitted_lanes_plan_existing_mount_and_exact_approle():
    catalog = load_catalog(repo_root() / "catalog")
    assert FIRST_LANE == ADMITTED[0]
    for lane_id in ADMITTED:
        entry = catalog[lane_id]
        assert entry.stage == "prod"
        assert entry.mount == "platform"
        assert entry.mount_management == "existing"
        plan = build_plan(entry, "prod", decision_id=entry.approval.get("decision_ref", ""))
        kinds = [action.kind for action in plan.actions]
        assert kinds[0] == "kv-mount-check"
        assert "kv-mount" not in kinds
        assert "policy" in kinds
        assert "approle" in kinds
        assert "platform/data/" in plan.policy_hcl
        assert '"create"' not in plan.policy_hcl
        assert "capabilities = [\"read\"]" in plan.policy_hcl