"""Crystallized regression test — generated, do not edit by hand.

Lineage
-------
ancestor asset : va-grant-via-browser
ancestor maturity: T1
descendant     : va-grant-crystallized (T5 Deterministic)
frozen from    : 4 identical realizations
surface version: lab-0.2.0-baseline
generated      : 2026-08-22

Why this file exists
--------------------
An agent discovered this path 4 times running and it did not change. The
search is now waste, so it has been frozen. **No model is involved in running
this test.**

The realization below is plain HTTP with no framework dependency. The assertions
are imported from the originating use case rather than restated — a generated
test that paraphrases its assertions creates a second, unverified statement of
intent, and drift between the two would be silent. See F-0007 for what that
costs.

If this test starts failing, the correct first response is **not** to update the
selectors. Re-run the agentic ancestor: if it recovers, the surface moved and
this file should be regenerated; if it does not, the behaviour changed and that
is a finding.
"""

from __future__ import annotations

import urllib.error
import urllib.parse
import urllib.request

from scenarios.alice_bob_carol import _bob_can_read, _bob_cannot_write, _carol_cannot_read

TARGET = '/resources/R/grant'
FIELDS = {'permission': 'READ', 'subject_id': 'bob'}


def _post(base_url: str, token: str, path: str, fields: dict) -> int:
    request = urllib.request.Request(
        urllib.parse.urljoin(base_url, path),
        data=urllib.parse.urlencode(fields).encode(),
        method="POST",
        headers={
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/x-www-form-urlencoded",
        },
    )
    try:
        with urllib.request.urlopen(request, timeout=10) as response:
            return response.status
    except urllib.error.HTTPError as error:
        return error.code


def realize(base_url: str, token: str) -> int:
    """Perform grant_access deterministically, exactly as the agent learned to."""
    return _post(base_url, token, TARGET, FIELDS)


def test_grant_access(crystallized_world):
    """grant_access still works, and the claims it protects still hold."""
    base_url, token, observe = crystallized_world

    assert realize(base_url, token) < 400, "the frozen realization no longer works"

    snapshot = observe()
    assert _bob_can_read(snapshot), 'Bob can read R after the grant'
    assert _carol_cannot_read(snapshot), 'Carol can never read R'
    assert _bob_cannot_write(snapshot), 'A READ grant does not let Bob write R'