from __future__ import annotations

import pathlib
import tomllib
import unittest

from govoplan_audit.backend.manifest import get_manifest


ROOT = pathlib.Path(__file__).resolve().parents[1]


class AuditModuleContractTests(unittest.TestCase):
    def test_audit_package_does_not_hard_require_access(self) -> None:
        project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))["project"]
        dependencies = tuple(project["dependencies"])

        self.assertTrue(any(item.startswith("govoplan-core>=") for item in dependencies))
        self.assertFalse(any(item.startswith("govoplan-access") for item in dependencies))

    def test_audit_source_does_not_import_access_implementation(self) -> None:
        offenders: list[str] = []
        for path in (ROOT / "src" / "govoplan_audit").rglob("*.py"):
            source = path.read_text(encoding="utf-8")
            if "govoplan_access" in source:
                offenders.append(str(path.relative_to(ROOT)))

        self.assertEqual([], offenders)

    def test_audit_documentation_declares_admin_help_contexts(self) -> None:
        topics = {topic.id: topic for topic in get_manifest().documentation}

        evidence = topics["audit.read-authorized-evidence"]
        self.assertIn("audit.admin.system", evidence.metadata["help_contexts"])
        self.assertIn("audit.admin.tenant", evidence.metadata["help_contexts"])
        self.assertEqual(
            ["audit.admin.system", "audit.admin.tenant"],
            evidence.metadata["surfaces"],
        )
        operations = topics["audit.recording-retention-and-outbox"]
        self.assertIn("audit.retention", operations.metadata["help_contexts"])

    def test_evidence_export_permissions_are_module_owned_and_scope_separated(self) -> None:
        manifest = get_manifest()
        permissions = {item.scope: item for item in manifest.permissions}

        self.assertEqual("tenant", permissions["audit:evidence:export"].level)
        self.assertEqual("system", permissions["audit:system_evidence:export"].level)
        roles = {item.slug: item for item in manifest.role_templates}
        self.assertIn(
            "audit:evidence:export",
            roles["audit_evidence_exporter"].permissions,
        )
        self.assertIn(
            "audit:system_evidence:export",
            roles["audit_system_evidence_exporter"].permissions,
        )


if __name__ == "__main__":
    unittest.main()