"""Pure Make command fixture: run with --noconftest, no database or cluster."""
import json
import os
from pathlib import Path
import subprocess
import sys
import pytest

@pytest.mark.parametrize('namespace_exists',[True,False])
def test_secret_server_dryrun_uses_ssa_without_force_or_other_phase_changes(tmp_path,namespace_exists):
    makefile=Path(__file__).resolve().parents[1]/'Makefile'
    log=tmp_path/'commands.jsonl';helm=tmp_path/'helm';kubectl=tmp_path/'kubectl'
    helm.write_text('#!'+sys.executable+'\nprint("apiVersion: v1\\nkind: ConfigMap\\nmetadata: {name: fixture}")\n')
    kubectl.write_text('#!'+sys.executable+'\nimport json,os,sys\nwith open(os.environ["NK_DRYRUN_LOG"],"a") as log:log.write(json.dumps(sys.argv[1:])+"\\n")\nif sys.argv[1:3]==["get","namespace"] and os.environ["NK_NAMESPACE_EXISTS"]=="0":raise SystemExit(1)\n')
    helm.chmod(0o700);kubectl.chmod(0o700)
    env=dict(os.environ);env['NK_DRYRUN_LOG']=str(log);env['NK_NAMESPACE_EXISTS']='1' if namespace_exists else '0'
    p=subprocess.run(['make','--no-print-directory','-f',str(makefile),'railiance-state-hub-server-dry-run','HELM='+str(helm),'KUBECTL='+str(kubectl),'RAILIANCE_STATE_HUB_IMAGE_TAG=main-51bc70d'],cwd=tmp_path,env=env,capture_output=True,timeout=10)
    assert p.returncode==0
    calls=[json.loads(line) for line in log.read_text().splitlines()]
    applies=[args for args in calls if args[0]=='apply']
    secrets=[args for args in applies if any(p.endswith('.sops.yaml.template') for p in args)]
    assert len(secrets)==2
    assert all('--force-conflicts' not in args and '--force' not in args for args in applies)
    for args in secrets:
        if '--dry-run=server' in args:assert '--server-side' in args
        else:assert not namespace_exists and '--dry-run=client' in args and '--server-side' not in args
    others=[args for args in applies if args not in secrets]
    assert all('--server-side' not in args for args in others)
    assert all('--dry-run=server' in args or '--dry-run=client' in args for args in applies)
    assert not any(args[0] in {'create','replace','delete','patch'} for args in calls)