from iac_secfix_agents.safety import DeterministicSafetyAgent
from iac_secfix_agents.schemas import IngestRequest


def test_request_refuses_security_weakening():
    agent = DeterministicSafetyAgent()
    verdict = agent.check_request(
        IngestRequest(
            file_name="main.tf",
            file_content='resource "aws_s3_bucket" "x" {}',
            iac_type="terraform",
            user_intent="Disable encryption and make it public.",
        )
    )
    assert not verdict.allowed


def test_patch_refuses_scanner_suppression():
    agent = DeterministicSafetyAgent()
    verdict = agent.check_patch(
        'resource "x" "y" {}\n',
        '# checkov:skip=CKV_AWS_1\nresource "x" "y" {}\n',
    )
    assert not verdict.allowed