import contextlib
import io
from pathlib import Path
from tempfile import TemporaryDirectory
import unittest

import yaml

from tools import check_layer_conformance as layer


INTENT = """---
layer: Engine
role: PIP
standard: netkingdom-security-layer-model
---

# INTENT
"""

DECL = {
    "layer": "engine",
    "role": "pip",
    "repository": "zone-engine",
    "derived": True,
    "derived_from": "INTENT.md",
    "tooling_contacts": [],
    "unowned_capabilities": [],
}


def _write_tree(root: Path, *, decl=None, intent=None, tools=None) -> None:
    (root / "layer.yaml").write_text(yaml.safe_dump(decl if decl is not None else DECL))
    (root / "INTENT.md").write_text(intent if intent is not None else INTENT)
    tools_dir = root / "tools"
    tools_dir.mkdir()
    (tools_dir / "noop.py").write_text("import json\n")
    if tools:
        for name, body in tools.items():
            (tools_dir / name).write_text(body)


class LayerDeclarationTest(unittest.TestCase):
    def test_declaration_exists_and_matches_intent(self):
        decl = yaml.safe_load(layer.DECL.read_text())
        intent = layer.load_intent()
        self.assertEqual(decl["repository"], "zone-engine")
        self.assertEqual(decl["layer"], "engine")
        self.assertEqual(decl["role"], "pip")
        self.assertIs(decl["derived"], True)
        self.assertEqual(decl["derived_from"], "INTENT.md")
        self.assertEqual(decl["tooling_contacts"], [])
        self.assertIsNone(decl.get("pep_stance"))
        self.assertEqual(intent["layer"].lower(), "engine")
        self.assertEqual(intent["role"].lower(), "pip")
        self.assertEqual(layer.check_declaration_agrees(decl, intent), [])

    def test_the_two_forms_agree_once_case_is_folded(self):
        """A9/A11: assert the fold, not equality; nothing is re-spelled."""
        decl = yaml.safe_load(layer.DECL.read_text())
        intent = layer.load_intent()
        self.assertEqual(layer._norm(decl["layer"]), layer._norm(intent["layer"]))
        self.assertIn(layer._norm(intent["layer"]), layer.LAYER_VOCABULARY)

    def test_no_declaration_carries_a_standard_version(self):
        """GH-DEC-2026-017 §5 / A12, in both forms."""
        decl = yaml.safe_load(layer.DECL.read_text())
        self.assertNotIn("standard_version", decl)
        self.assertNotIn("standard_version", layer.load_intent())

    def test_no_version_anywhere_in_either_form(self):
        """GH-DEC-2026-020 / A12 r2: no version in any key or value, not only the key name."""
        decl = yaml.safe_load(layer.DECL.read_text())
        self.assertEqual(layer.declaration_versions(decl), [])
        self.assertEqual(layer.declaration_versions(layer.load_intent()), [])
        self.assertNotIn("companion_version", decl)
        self.assertNotIn("companion_version", layer.load_intent())

    def test_every_run_prints_version_and_scope(self):
        """GH-DEC-2026-020 §4: the version lives in the run, including the OK line."""
        out = io.StringIO()
        with contextlib.redirect_stdout(out):
            self.assertEqual(layer.main([]), 0)
        text = out.getvalue()
        self.assertIn(f"validated against: {layer.VALIDATED_AGAINST}", text)
        self.assertIn(f"scope: {layer.SCOPE}", text)
        ok = [line for line in text.splitlines() if line.startswith("OK:")]
        self.assertTrue(ok and layer.VALIDATED_AGAINST in ok[0])

    def test_vocabulary_is_the_closed_four_tokens(self):
        self.assertEqual(layer.LAYER_VOCABULARY, {"taxonomy", "tooling", "engine", "staff"})

    def test_checker_passes_on_the_real_tree(self):
        code, errors, _reports = layer.evaluate()
        self.assertEqual(code, 0, errors)
        self.assertEqual(errors, [])


class LayerCheckerFailureTest(unittest.TestCase):
    def test_missing_declaration_is_exit_2(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            (root / "INTENT.md").write_text(INTENT)
            (root / "tools").mkdir()
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 2)
            self.assertTrue(any("no declaration" in item for item in errors))

    def test_intent_disagreement_is_exit_2(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, intent=INTENT.replace("Engine", "Staff").replace("PIP", "null"))
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 2)
            self.assertTrue(any("disagrees" in item for item in errors))

    def test_case_only_difference_is_conforming(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, intent=INTENT.replace("layer: Engine", "layer: ENGINE"))
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 0, errors)

    def test_standard_version_in_either_form_is_exit_2(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, decl={**DECL, "standard_version": "0.7"})
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 2)
            self.assertTrue(any("standard_version" in item for item in errors))
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, intent=INTENT.replace("role: PIP\n", 'role: PIP\nstandard_version: "0.7"\n'))
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 2)
            self.assertTrue(any("standard_version" in item for item in errors))

    def test_sidecar_not_marked_derived_is_exit_2(self):
        for bad in ({**DECL, "derived": False}, {**DECL, "derived_from": "layer.yaml"}):
            with TemporaryDirectory() as directory:
                root = Path(directory)
                _write_tree(root, decl=bad)
                code, _errors, _ = layer.evaluate(root=root)
                self.assertEqual(code, 2)

    def test_token_outside_vocabulary_is_exit_2(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, intent=INTENT.replace("layer: Engine", "layer: surface"))
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 2)
            self.assertTrue(any("closed vocabulary" in item for item in errors))

    def test_undeclared_tooling_client_is_exit_1(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, tools={"vault.py": "import hvac\n\nclient = hvac.Client()\n"})
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 1)
            self.assertTrue(any("hvac" in item for item in errors))

    def test_http_decision_surface_is_exit_1(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(
                root,
                tools={
                    "api.py": (
                        "import fastapi\n\n"
                        "app = fastapi.FastAPI()\n\n"
                        "@app.post('/v1/check')\n"
                        "def check():\n"
                        "    return {'allow': True}\n"
                    )
                },
            )
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 1)
            joined = "\n".join(errors)
            self.assertIn("fastapi", joined)
            self.assertIn("/v1/check", joined)

    def test_versioned_standard_path_is_exit_2(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, intent=INTENT.replace(
                "standard: netkingdom-security-layer-model",
                "standard: net-kingdom/canon/standards/security-layer-model_v0.7.md",
            ))
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 2)
            self.assertTrue(any("standard" in item and "v0.7" in item for item in errors))

    def test_companion_version_is_exit_2(self):
        for decl, intent in (
            ({**DECL, "companion_version": "0.2"}, INTENT),
            (DECL, INTENT.replace("role: PIP\n", 'role: PIP\ncompanion_version: "0.2"\n')),
            (DECL, INTENT.replace("role: PIP\n", "role: PIP\ncompanion: net-kingdom/SECURITY-COMPANION.md v0.2\n")),
        ):
            with TemporaryDirectory() as directory:
                root = Path(directory)
                _write_tree(root, decl=decl, intent=intent)
                code, errors, _ = layer.evaluate(root=root)
                self.assertEqual(code, 2, errors)

    def test_versioned_path_nested_in_layer_yaml_is_exit_2(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, decl={**DECL, "catalog_entry": {"source": "canon/standards/security-layer-model_v0.8.md"}})
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 2)

    def test_schema_version_and_comments_are_not_reached(self):
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root, decl={**DECL, "schema_version": "0.1"})
            path = root / "layer.yaml"
            path.write_text("# Framework: security-layer-model_v0.7.md\n" + path.read_text())
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 0, errors)

    def test_non_declaration_files_are_not_read(self):
        """GH-DEC-2026-020 §3: stance/claims/classification maps keep their versions."""
        with TemporaryDirectory() as directory:
            root = Path(directory)
            _write_tree(root)
            (root / "pep-stance.yaml").write_text('standard_version: "0.7"\n')
            (root / "pip-claims.yaml").write_text('standard_version: "0.7"\n')
            code, errors, _ = layer.evaluate(root=root)
            self.assertEqual(code, 0, errors)