import json

import pytest

from whitehat_security.cli import main


def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
    path = tmp_path / "pending.json"
    path.write_text(json.dumps({}), encoding="utf-8")
    with pytest.raises(SystemExit) as stopped:
        main(["validate-engagement", str(path)])
    assert stopped.value.code == 2
    assert capsys.readouterr().err.startswith("not authorized:")