from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]


def test_audit_workbench_exposes_security_coverage_events_and_seals():
    view = (
        ROOT / "frontend/src/views/systemManage/governanceAudit/index.vue"
    ).read_text(encoding="utf-8")
    api = (
        ROOT / "frontend/src/api/governanceAudit.js"
    ).read_text(encoding="utf-8")
    routes = (
        ROOT / "frontend/src/router/routes.js"
    ).read_text(encoding="utf-8")

    for text in (
        "审计与运行证据",
        "安全检查",
        "关键操作覆盖",
        "审计事件",
        "证据封存",
        "独立封存密钥已配置",
        "签名封存用于检测篡改，不等于阻止数据库管理员修改",
    ):
        assert text in view
    for path in (
        "/system/governance-audit/security-checks",
        "/system/governance-audit/coverage",
        "/system/governance-audit/events",
        "/system/governance-audit/seals",
        "/verify",
    ):
        assert path in api
    assert "systemManage/governanceAudit" in routes
    assert "governance-audit:read" in routes
    assert "governance-audit:seal" in routes


def test_audit_workbench_never_requests_or_renders_unsafe_columns():
    view = (
        ROOT / "frontend/src/views/systemManage/governanceAudit/index.vue"
    ).read_text(encoding="utf-8")
    model = (
        ROOT
        / "frontend/src/views/systemManage/governanceAudit/"
        "governanceAuditModel.js"
    ).read_text(encoding="utf-8")
    combined = view + model

    for forbidden in (
        "ip_address",
        "user_agent",
        "raw_question",
        "remediation_note",
        "evidence_payload",
        "source_config",
        "encrypted_payload",
    ):
        assert forbidden not in combined


def test_audit_workbench_presents_cross_domain_security_categories():
    model = (
        ROOT / "frontend/src/views/systemManage/governanceAudit/governanceAuditModel.js"
    ).read_text(encoding="utf-8")
    for category in (
        "authorization", "workflow_task", "data_product", "agent", "security_governance"
    ):
        assert category in model