import importlib.util
import json
from pathlib import Path


SCRIPT_PATH = Path(__file__).resolve().parents[1] / "scripts" / "b2_key_scope_checklist.py"
SPEC = importlib.util.spec_from_file_location("b2_key_scope_checklist", SCRIPT_PATH)
b2_key_scope_checklist = importlib.util.module_from_spec(SPEC)
assert SPEC.loader is not None
SPEC.loader.exec_module(b2_key_scope_checklist)


def write_setup(root: Path, payload: dict) -> Path:
    path = root / "docs/assets/b2-live-setup.json"
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(payload), encoding="utf-8")
    return path


def valid_setup() -> dict:
    return {
        "schema": "proofframe.b2_live_setup.v1",
        "status": "bucket_created_key_pending",
        "bucket_name": "proofframe-demo-a6b4e49",
        "bucket_type": "private",
        "endpoint": "s3.us-west-004.backblazeb2.com",
        "application_key_name": "proofframe-demo-live-proof",
        "application_key_status": "form_prepared_not_created",
        "safe_to_commit": True,
        "secret_policy": "No secrets are stored.",
    }


def test_b2_key_scope_checklist_builds_no_secret_scope_report(tmp_path):
    setup_path = write_setup(tmp_path, valid_setup())

    report = b2_key_scope_checklist.build_report(setup_path)
    serialized = json.dumps(report)

    assert report["schema"] == "proofframe.b2_key_scope_checklist.v1"
    assert report["ok"] is True
    assert report["mode"] == "scope_ready_key_not_created"
    assert report["requires_user_confirmation_before_key_creation"] is True
    confirmation = report["pre_key_creation_confirmation"]
    assert confirmation["status"] == "required_before_key_creation"
    assert "proofframe-demo-a6b4e49" in confirmation["required_phrase"]
    assert "campaigns/" in confirmation["required_phrase"]
    assert "no delete/admin permissions" in confirmation["required_phrase"]
    assert confirmation["safe_to_store"] is True
    assert report["expected_key"]["bucket_scope"]["mode"] == "single_bucket"
    assert report["expected_key"]["file_name_prefix"]["value"] == "campaigns/"
    required = {item["capability"] for item in report["expected_key"]["required_capabilities"]}
    forbidden = {item["capability"] for item in report["expected_key"]["forbidden_capabilities"]}
    assert {"writeFiles", "listAllBucketNames"} <= required
    assert "deleteFiles" in forbidden
    assert "B2_APPLICATION_KEY=" not in serialized


def test_b2_key_scope_checklist_blocks_secret_fields_and_wide_setup(tmp_path):
    payload = {
        **valid_setup(),
        "bucket_type": "public",
        "safe_to_commit": False,
        "application_key_status": "created_with_secret",
        "application_key": "super-" + "secret-b2-value-1234567890",
    }
    setup_path = write_setup(tmp_path, payload)

    report = b2_key_scope_checklist.build_report(setup_path)

    assert report["ok"] is False
    assert report["mode"] == "scope_blocked"
    assert report["safe_to_commit"] is False
    assert "$.application_key" in report["secret_policy"]["forbidden_setup_fields"]
    failed_checks = {check["id"] for check in report["setup"]["checks"] if not check["ok"]}
    assert {"safe_to_commit", "private_bucket", "application_key_status_safe"} <= failed_checks


def test_b2_key_scope_checklist_markdown_and_outputs_do_not_leak(tmp_path):
    setup_path = write_setup(tmp_path, valid_setup())
    report = b2_key_scope_checklist.build_report(setup_path)
    json_path = tmp_path / "out/checklist.json"
    markdown_path = tmp_path / "out/checklist.md"

    b2_key_scope_checklist.write_outputs(report, json_path=json_path, markdown_path=markdown_path)

    saved = json.loads(json_path.read_text(encoding="utf-8"))
    markdown = markdown_path.read_text(encoding="utf-8")
    assert saved["schema"] == "proofframe.b2_key_scope_checklist.v1"
    assert saved["pre_key_creation_confirmation"]["status"] == "required_before_key_creation"
    assert "proofframe-demo-live-proof" in markdown
    assert "Required Pre-Key Confirmation" in markdown
    assert "no secrets in chat/docs/git" in markdown
    assert "`listAllBucketNames`" in markdown
    assert "No key id, application key, token, cookie, signed URL, or account secret is stored here." in markdown