"""Tests for scripts/verify_working_leo_production_apply_authorization.py."""

from __future__ import annotations

import sys
from pathlib import Path

REPO_ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(REPO_ROOT / "scripts"))

import verify_working_leo_production_apply_authorization as verifier  # noqa: E402


def test_missing_authorization_text_refuses_apply_window():
    result = verifier.verify_authorization(
        deployed_sha="427a9f1a1e114814c750bb3e9e99e3456a6c1539",
        operator_identity="operator@example.com",
    )

    assert result["status"] == "missing_authorization_text"
    assert result["safe_to_enter_apply_window"] is False
    assert result["production_apply_executed"] is False
    assert result["production_apply_authorization_present"] is False
    assert result["checks"]["auth_packet_ready"] is True
    assert result["checks"]["authorization_text_matches_expected"] is False
    assert "does not run SQL" in result["claim_ceiling"]


def test_missing_fresh_deployed_sha_refuses_apply_window_without_stale_sha():
    result = verifier.verify_authorization(deployed_sha="")

    assert result["status"] == "missing_fresh_deployed_sha"
    assert result["safe_to_enter_apply_window"] is False
    assert result["production_apply_executed"] is False
    assert result["production_apply_authorization_present"] is False
    assert result["checks"]["deployed_sha_shape"] is False
    assert result["fresh_deployed_sha_required"] is True
    assert "<DEPLOYED_SHA_READBACK>" in result["expected_authorization_text"]


def test_exact_authorization_text_verifies_without_execution():
    deployed_sha = "427a9f1a1e114814c750bb3e9e99e3456a6c1539"
    auth_packet = verifier._load_json(verifier.DEFAULT_AUTH_PACKET)
    text = verifier.expected_authorization_text(auth_packet, deployed_sha)

    result = verifier.verify_authorization(
        deployed_sha=deployed_sha,
        authorization_text=text,
        operator_identity="operator@example.com",
    )

    assert result["status"] == "authorization_verified_not_executed"
    assert result["safe_to_enter_apply_window"] is True
    assert result["production_apply_executed"] is False
    assert result["production_apply_authorization_present"] is True
    assert all(result["checks"].values())
    assert result["expected_authorization_text"] == text


def test_wrong_deployed_sha_or_text_refuses_apply_window():
    deployed_sha = "427a9f1a1e114814c750bb3e9e99e3456a6c1539"
    auth_packet = verifier._load_json(verifier.DEFAULT_AUTH_PACKET)
    text = verifier.expected_authorization_text(auth_packet, deployed_sha)

    result = verifier.verify_authorization(
        deployed_sha="45bec0ed84846ae92a53993e5337313014538206",
        authorization_text=text,
        operator_identity="operator@example.com",
    )

    assert result["status"] == "authorization_text_mismatch"
    assert result["safe_to_enter_apply_window"] is False
    assert result["checks"]["authorization_text_matches_expected"] is False


def test_markdown_shows_claim_ceiling(tmp_path: Path):
    result = verifier.verify_authorization(deployed_sha="427a9f1a1e114814c750bb3e9e99e3456a6c1539")
    out = tmp_path / "auth.md"

    verifier.write_markdown(out, result)

    text = out.read_text(encoding="utf-8")
    assert "Working Leo Production Apply Authorization Verification" in text
    assert "Safe to enter apply window: `False`" in text
    assert "Production apply executed: `False`" in text
    assert "Claim Ceiling" in text
