"""Historical live evidence remains immutable and cannot satisfy the new contract."""
import json
from datetime import datetime
from pathlib import Path

import pytest

from secrets_engine.authorization import build_action_request, validate_decision_envelope
from secrets_engine.catalog import load_catalog
from secrets_engine.errors import DecisionError


def test_old_live_pin_without_submitted_binding_refuses_even_during_its_lifetime():
    root = Path(__file__).resolve().parents[1]
    decision = json.loads((root / "tests/fixtures/flex-auth-live/decision_rotate_glas_live.json").read_text())
    entry = load_catalog(root / "catalog")["glas-claude-agent-dev-anthropic"]
    request = build_action_request(entry, "rotate", subject_id="secrets-engine", subject_type="service",
        purpose="live-adoption-proof", fields=["api_key"], request_id="check:secrets-engine-adoption-proof")
    assert decision["effect"] == "allow"
    assert "submitted_request_digest" not in decision["binding"]
    with pytest.raises(DecisionError, match="submitted request digest"):
        validate_decision_envelope(decision, request,
            accepted_policy_packages={"secrets-engine.catalog-lane.lifecycle"}, accepted_policy_versions={"v2"},
            now=datetime.fromisoformat(decision["provenance"]["decision_time"].replace("Z", "+00:00")))