import json

import pytest

from whitehat_security.cli import main


def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
    path = tmp_path / "pending.json"
    path.write_text(json.dumps({}), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["validate-engagement", str(path)])
    assert stopped.value.code == 2
    assert capsys.readouterr().err.startswith("not authorized:")


def test_validate_targets_accepts_catalog(capsys):
    main(["validate-targets", "targets"])
    assert capsys.readouterr().out.startswith("validated 8 target registrations")


def test_kill_switch_is_clear_by_default(capsys):
    main(["kill-switch"])
    assert capsys.readouterr().out.strip() == "clear"


def test_validate_engagement_refuses_proposed_record(capsys):
    with pytest.raises(SystemExit) as stopped:
        main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"])
    assert stopped.value.code == 2
    err = capsys.readouterr().err
    assert err.startswith("not authorized:")
    assert "proposed" in err


def test_admit_plane_refuses_proposed_record(capsys):
    with pytest.raises(SystemExit) as stopped:
        main([
            "admit-plane",
            "engagements/2026-08-22-audit-core-e2.json",
            "targets/audit-core-e2.json",
        ])
    assert stopped.value.code == 2
    err = capsys.readouterr().err
    assert "not authorized:" in err
    assert "proposed" in err


def test_admit_plane_refuses_cancelled_engagement(capsys):
    with pytest.raises(SystemExit) as stopped:
        main([
            "admit-plane",
            "engagements/2026-08-21-audit-core-e2.json",
            "targets/audit-core-e2.json",
        ])
    assert stopped.value.code == 2
    assert "not authorized:" in capsys.readouterr().err


def test_deliver_refuses_fixture_calibration(tmp_path, capsys):
    report = tmp_path / "fixture.json"
    report.write_text(json.dumps({
        "schema_version": "whitehat-run/v1", "run_id": "run-1",
        "evidence_class": "fixture", "engagement_id": "eng",
        "authorization_id": "auth", "target": "fixture-e2",
        "target_revision": "local", "posture_claim": "E2",
        "attacker_model": "E2", "started_at": "2026-08-22T00:00:00Z",
        "ended_at": "2026-08-22T00:01:00Z", "outcome": "pass",
        "attempted_operations": 1, "cleanup": "n/a",
        "credential_revocation": "n/a", "probes": [], "limitations": [],
        "assurance_statement": "not proof",
    }), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["deliver", str(report), "--outbox", str(tmp_path / "outbox")])
    assert stopped.value.code == 2
    assert "fixture evidence" in capsys.readouterr().err