from whitehat_security.cli import fixture_calibration
from whitehat_security.differential import execute
from whitehat_security.fixtures import FixtureService, probe_suite


def test_every_probe_passes_known_good_fixture():
    results = [execute(probe, salt=b"test") for probe in probe_suite(FixtureService(True))]
    assert results
    assert {result.outcome for result in results} == {"pass"}


def test_every_probe_detects_known_bad_fixture():
    results = [execute(probe, salt=b"test") for probe in probe_suite(FixtureService(False))]
    assert results
    assert {result.outcome for result in results} == {"finding"}


def test_evidence_never_contains_fixture_body_values():
    result = execute(probe_suite(FixtureService(False))[0], salt=b"test")
    rendered = repr(result)
    assert "fixture-b" not in rendered
    assert "tenant-b" not in rendered
    assert result.observations["attacker"].fixture_match_count > 0


def test_fixture_marker_is_found_when_embedded_in_a_value():
    service = FixtureService(False)
    service.objects["object-b"]["label"] = "prefix-fixture-b-suffix"
    result = execute(probe_suite(service)[0], salt=b"test")
    assert result.outcome == "finding"


def test_calibration_distinguishes_good_and_bad():
    report = fixture_calibration()
    assert report["outcome"] == "pass"
    assert all(item["outcome"] == "pass" for item in report["known_good"])
    assert all(item["outcome"] == "finding" for item in report["known_bad"])