from pathlib import Path

import yaml

ROOT = Path(__file__).resolve().parents[1]


def _operation(openapi, path):
    methods = openapi["paths"][path]
    return methods.get("post") or methods.get("get")


def _assert_no_store(section):
    for response in section["responses"].values():
        assert response["headers"]["Cache-Control"]["schema"]["const"] == "no-store"


def test_trusted_delivery_openapi_permissions_no_store_and_deployment_byte_parity():
    openapi = yaml.safe_load((ROOT / "docs/architecture/OPENAPI.yaml").read_text())
    for path, permission in (
        ("/api/system/trusted-delivery/policy-versions", "security-governance:operate"),
        ("/api/system/trusted-delivery/policy-versions/activate", "security-governance:operate"),
        ("/api/system/trusted-delivery/policy-versions/rollback", "security-governance:operate"),
        ("/api/system/trusted-delivery/provisions", "security-governance:operate"),
        ("/api/system/trusted-delivery/decisions", "security-governance:operate"),
        ("/api/system/trusted-delivery/legal-holds", "security-governance:manage"),
        ("/api/system/trusted-delivery/legal-holds/release", "security-governance:manage"),
        ("/api/system/trusted-delivery/reclaim/preview", "security-governance:manage"),
        ("/api/system/trusted-delivery/reclaim/execute", "security-governance:manage"),
        ("/api/system/trusted-delivery/subscriptions", "security-governance:operate"),
        ("/api/system/trusted-delivery/subscriptions/{subscription_uid}/activate", "security-governance:operate"),
        ("/api/system/trusted-delivery/subscriptions/{subscription_uid}/pause", "security-governance:operate"),
        ("/api/system/trusted-delivery/subscriptions/{subscription_uid}/resume", "security-governance:operate"),
        ("/api/system/trusted-delivery/subscriptions/{subscription_uid}/terminate", "security-governance:operate"),
        ("/api/system/trusted-delivery/subscriptions/anomalies", "security-governance:operate"),
        ("/api/system/trusted-delivery/subscriptions/deliveries/{delivery_uid}/compensate", "security-governance:manage"),
    ):
        section = _operation(openapi, path)
        assert section["requestBody"]["content"]["application/json"]["schema"]["additionalProperties"] is False
        assert section["x-required-permission"] == permission
        _assert_no_store(section)
    for relative in (
        "app/core/system/trusted_delivery.py", "app/core/system/trusted_delivery_repository.py",
        "app/core/system/trusted_delivery_controls.py", "app/core/system/trusted_delivery_controls_repository.py",
        "app/core/system/trusted_delivery_controls_service.py", "app/api/system/trusted_delivery.py",
        "migrations/versions/20260811_481_trusted_delivery.py", "migrations/versions/20260811_482_trusted_delivery_lifecycle.py",
        "migrations/versions/20260811_483_trusted_delivery_subscriptions.py", "migrations/versions/20260811_484_trusted_delivery_controls.py",
        "migrations/versions/20260811_485_trusted_delivery_hardening.py",
        "migrations/versions/20260811_486_trusted_delivery_database_boundary.py",
        "migrations/versions/20260811_487_trusted_delivery_runtime_write_gateway.py",
        "migrations/versions/20260811_488_trusted_delivery_approval_and_incident_gate.py",
        "migrations/versions/20260811_491_trusted_delivery_control_fact_actor_fix.py",
    ):
        assert (ROOT / relative).read_bytes() == (ROOT / "deployment" / relative).read_bytes()


def test_trusted_delivery_controls_openapi_permissions_and_safe_no_store_contract():
    raw = (ROOT / "docs/architecture/OPENAPI.yaml").read_text()
    openapi = yaml.safe_load(raw)
    for path, permission in (
        ("/api/system/trusted-delivery/controls/profiles/{profile_id}/active", "security-governance:read"),
        ("/api/system/trusted-delivery/controls/release-gates/evaluate", "security-governance:operate"),
        ("/api/system/trusted-delivery/controls/profiles/activate", "security-governance:manage"),
        ("/api/system/trusted-delivery/controls/profiles/rollback", "security-governance:manage"),
        ("/api/system/trusted-delivery/controls/capability-approvals", "security-governance:manage"),
        ("/api/system/trusted-delivery/controls/evidence", "security-governance:read"),
        ("/api/system/trusted-delivery/controls/destruction-approvals", "security-governance:manage"),
    ):
        section = _operation(openapi, path)
        assert section["x-required-permission"] == permission
        _assert_no_store(section)
    assert "raw_scan" not in raw