import json
from pathlib import Path

import pytest

from whitehat_security.cli import main
from whitehat_security.plane import ReceiptBroker


def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
    path = tmp_path / "pending.json"
    path.write_text(json.dumps({}), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["validate-engagement", str(path)])
    assert stopped.value.code == 2
    assert capsys.readouterr().err.startswith("not authorized:")


def test_validate_targets_accepts_catalog(capsys):
    main(["validate-targets", "targets"])
    assert capsys.readouterr().out.startswith("validated 8 target registrations")


def test_kill_switch_is_clear_by_default(capsys):
    main(["kill-switch"])
    assert capsys.readouterr().out.strip() == "clear"


def test_validate_engagement_refuses_elapsed_window(capsys):
    with pytest.raises(SystemExit) as stopped:
        main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"])
    assert stopped.value.code == 2
    err = capsys.readouterr().err
    assert err.startswith("not authorized:")
    assert "elapsed" in err


def test_admit_plane_refuses_elapsed_window(capsys):
    with pytest.raises(SystemExit) as stopped:
        main([
            "admit-plane",
            "engagements/2026-08-22-audit-core-e2.json",
            "targets/audit-core-e2.json",
        ])
    assert stopped.value.code == 2
    err = capsys.readouterr().err
    assert "not authorized:" in err
    assert "elapsed" in err


def test_admit_plane_refuses_cancelled_engagement(capsys):
    with pytest.raises(SystemExit) as stopped:
        main([
            "admit-plane",
            "engagements/2026-08-21-audit-core-e2.json",
            "targets/audit-core-e2.json",
        ])
    assert stopped.value.code == 2
    assert "not authorized:" in capsys.readouterr().err


def _live_e2_record():
    return {
        "engagement_id": "WH-ENG-CLI-RECEIPT",
        "authorization_id": "auth-cli",
        "authorizer": "operator",
        "approved_at": "2026-08-22T00:00:00Z",
        "expires_at": "2099-01-01T00:00:00Z",
        "target": "https://fixture.invalid",
        "target_id": "audit-core",
        "target_owner": "audit-core",
        "environment": "build",
        "source": "runner",
        "approval_class": "live-e2",
        "plane_namespace": "whitehat",
        "runner_image_digest": "sha256:abc",
        "routes": ["POST /v1/events"],
        "fixture_ids": ["object-a", "object-b"],
        "credential_lane": "receipt",
        "credential_role": "runtime",
        "credential_max_ttl_seconds": 900,
        "techniques": ["e2-differential"],
        "prohibited_techniques": ["saturation"],
        "rate_limit_per_minute": 10,
        "max_concurrency": 1,
        "maximum_requests": 8,
        "window_start": "2026-08-22T00:00:00Z",
        "window_end": "2099-01-01T00:00:00Z",
        "operator_contact": "operator",
        "abort_contact": "operator",
        "posture_claim": "E2",
        "attacker_model": "E2-authenticated-tenant-a",
        "finding_destination": "risk-nexus",
        "target_owner_acknowledged_at": "2026-08-22T00:01:00Z",
    }


def _receipt(**overrides):
    data = {
        "engagement_id": "WH-ENG-CLI-RECEIPT",
        "projected_at": "2026-08-22T19:17:54Z",
        "expires_at": "2099-01-01T00:00:00Z",
        "identities": ["whitehat-e2-a-example", "whitehat-e2-b-example"],
        "mounted_secret": "whitehat/whitehat-e2-audit-credentials",
        "mounted_keys": ["token-a", "token-b"],
        "target_ready": True,
        "secret_values_observed": False,
    }
    data.update(overrides)
    return data


def test_admit_plane_without_receipt_still_fails_closed(tmp_path, capsys):
    path = tmp_path / "engagement.json"
    path.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["admit-plane", str(path), "targets/audit-core-e2.json"])
    assert stopped.value.code == 2
    assert "no credential was requested" in capsys.readouterr().err


def test_admit_plane_receipt_issues_lease(tmp_path, capsys):
    engagement = tmp_path / "engagement.json"
    receipt = tmp_path / "receipt.json"
    engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
    receipt.write_text(json.dumps(_receipt()), encoding="utf-8")
    main(["admit-plane", str(engagement), "targets/audit-core-e2.json", "--receipt", str(receipt)])
    out = capsys.readouterr().out
    assert out.startswith("admitted: WH-ENG-CLI-RECEIPT")


def test_admit_plane_receipt_refuses_secret_material(tmp_path, capsys):
    engagement = tmp_path / "engagement.json"
    receipt = tmp_path / "receipt.json"
    engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
    receipt.write_text(json.dumps(_receipt(token="must-not-appear")), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["admit-plane", str(engagement), "targets/audit-core-e2.json", "--receipt", str(receipt)])
    assert stopped.value.code == 2
    assert "secret material" in capsys.readouterr().err


def test_example_projection_receipt_is_value_safe():
    broker = ReceiptBroker.load("engagements/receipts/example-projection-receipt.json")
    assert broker.receipt["engagement_id"] == "WH-ENG-EXAMPLE"
    assert broker.receipt["secret_values_observed"] is False
    assert broker.receipt["mounted_keys"] == ["token-a", "token-b"]


def test_admit_plane_wp0025_receipt_requires_contract(tmp_path, capsys):
    engagement = tmp_path / "engagement.json"
    receipt = tmp_path / "receipt.json"
    engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
    receipt.write_text(json.dumps({
        "interface": "railiance.custody-projection-receipt",
        "version": 1,
        "engagement_id": "WH-ENG-CLI-RECEIPT",
        "secret_values_observed": False,
    }), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["admit-plane", str(engagement), "targets/audit-core-e2.json",
              "--receipt", str(receipt)])
    assert stopped.value.code == 2
    assert "requires a bound contract" in capsys.readouterr().err


def test_admit_plane_wp0025_receipt_requires_broker_receipt(tmp_path, capsys):
    engagement = tmp_path / "engagement.json"
    receipt = tmp_path / "receipt.json"
    contract = tmp_path / "contract.json"
    engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
    receipt.write_text(json.dumps({
        "interface": "railiance.custody-projection-receipt",
        "version": 1,
        "engagement_id": "WH-ENG-CLI-RECEIPT",
        "secret_values_observed": False,
    }), encoding="utf-8")
    contract.write_text(json.dumps({
        "interface": "railiance.custody-projection-contract",
        "version": 1,
    }), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["admit-plane", str(engagement), "targets/audit-core-e2.json",
              "--receipt", str(receipt), "--contract", str(contract)])
    assert stopped.value.code == 2
    assert "requires a bound broker receipt" in capsys.readouterr().err


def test_admit_plane_wp0025_mismatched_broker_receipt(tmp_path, capsys):
    from test_platform_custody_adapter import (
        broker_readiness, contract, digest, projection_receipt,
    )

    bound = contract()
    receipt_doc = projection_receipt(bound)
    receipt_doc["broker_receipt_digest"] = "0" * 64
    receipt_doc["receipt_id"] = "sha256:" + digest(
        {key: value for key, value in receipt_doc.items() if key != "receipt_id"}
    )
    engagement = tmp_path / "engagement.json"
    receipt = tmp_path / "receipt.json"
    contract_path = tmp_path / "contract.json"
    broker_path = tmp_path / "broker.json"
    engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
    receipt.write_text(json.dumps(receipt_doc), encoding="utf-8")
    contract_path.write_text(json.dumps(bound), encoding="utf-8")
    broker_path.write_text(json.dumps(broker_readiness(bound)), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main([
            "admit-plane", str(engagement), "targets/audit-core-e2.json",
            "--receipt", str(receipt),
            "--contract", str(contract_path),
            "--broker-receipt", str(broker_path),
        ])
    assert stopped.value.code == 2
    assert "broker digest" in capsys.readouterr().err


def test_deliver_queues_target_pass_without_severity(tmp_path, capsys):
    report = json.loads(
        Path("evidence/WH-ENG-20260822-AUDIT-E2-03.json").read_text(encoding="utf-8")
    )
    assert report["outcome"] == "pass"
    assert report["evidence_class"] == "target"
    main(["deliver", "evidence/WH-ENG-20260822-AUDIT-E2-03.json",
          "--outbox", str(tmp_path / "outbox")])
    queued = (tmp_path / "outbox" / f"{report['run_id']}.md").read_text(encoding="utf-8")
    assert capsys.readouterr().out.startswith("queued:")
    assert "pass" in queued
    assert "Severity" not in queued
    assert report["engagement_id"] in queued


def test_admit_plane_refuses_completed_engagement(capsys):
    with pytest.raises(SystemExit) as stopped:
        main([
            "admit-plane",
            "engagements/2026-08-22-audit-core-e2-03.json",
            "targets/audit-core-e2.json",
        ])
    assert stopped.value.code == 2
    err = capsys.readouterr().err
    assert "not authorized:" in err
    assert "completed" in err


def test_deliver_queues_abort_without_calling_it_target_assurance(tmp_path, capsys):
    report = json.loads(
        Path("evidence/WH-ENG-20260822-AUDIT-E2-02-abort.json").read_text(encoding="utf-8")
    )
    path = tmp_path / "abort.json"
    path.write_text(json.dumps(report), encoding="utf-8")
    main(["deliver", str(path), "--outbox", str(tmp_path / "outbox")])
    queued = (tmp_path / "outbox" / f"{report['run_id']}.md").read_text(encoding="utf-8")
    assert capsys.readouterr().out.startswith("queued:")
    assert "abort" in queued
    assert "not target assurance" in queued
    assert "Severity" not in queued


def test_deliver_refuses_fixture_calibration(tmp_path, capsys):
    report = tmp_path / "fixture.json"
    report.write_text(json.dumps({
        "schema_version": "whitehat-run/v1", "run_id": "run-1",
        "evidence_class": "fixture", "engagement_id": "eng",
        "authorization_id": "auth", "target": "fixture-e2",
        "target_revision": "local", "posture_claim": "E2",
        "attacker_model": "E2", "started_at": "2026-08-22T00:00:00Z",
        "ended_at": "2026-08-22T00:01:00Z", "outcome": "pass",
        "attempted_operations": 1, "cleanup": "n/a",
        "credential_revocation": "n/a", "probes": [], "limitations": [],
        "assurance_statement": "not proof",
    }), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["deliver", str(report), "--outbox", str(tmp_path / "outbox")])
    assert stopped.value.code == 2
    assert "fixture evidence" in capsys.readouterr().err