from whitehat_security.capacity import CapacitySample, characterize
from whitehat_security.e3 import PROBES, evaluate
from whitehat_security.model import RunReport
from whitehat_security.reporting import risk_nexus_message


def test_e3_expected_failures_are_findings_and_limit_is_not():
    conformance = next(probe for probe in PROBES if probe.probe_id == "conformance-view-empty")
    boundary = next(probe for probe in PROBES if probe.probe_id == "sql-compromise-reset")
    assert evaluate(conformance, rows=1).outcome == "finding"
    assert evaluate(conformance, rows=0).outcome == "pass"
    assert evaluate(boundary, rows=1).outcome == "inconclusive"


def test_capacity_records_neighbour_degradation():
    result = characterize(
        baseline=[CapacitySample("n", 10, 0, 100)],
        loaded=[CapacitySample("n", 15, .01, 75)],
        governor_bound=True, aggressor_peak=5, aggressor_ceiling=5,
    )
    assert result.outcome == "pass"
    assert result.neighbour_degradation["n"] == {
        "latency_increase_percent": 50.0,
        "error_rate_increase_points": .01,
        "throughput_decrease_percent": 25.0,
    }


def test_capacity_unbound_governor_is_finding():
    result = characterize(
        baseline=[], loaded=[], governor_bound=False,
        aggressor_peak=7, aggressor_ceiling=5,
    )
    assert result.outcome == "aborted"
    assert len(result.reasons) == 2


def test_risk_message_contains_pass_and_no_severity():
    report = RunReport(
        schema_version="whitehat-run/v1", run_id="run-1", evidence_class="target",
        engagement_id="eng-1", authorization_id="auth-1", target="service",
        target_revision="abc", posture_claim="E2", attacker_model="E2",
        started_at="2026-08-21T00:00:00Z", ended_at="2026-08-21T00:01:00Z",
        outcome="pass", attempted_operations=1, cleanup="complete",
        credential_revocation="complete",
    )
    message = risk_nexus_message(report)
    assert "**pass**" in message
    assert "Severity" not in message
    assert "not proof" in message