"""V13 weekly-authority preseal semantic binding regressions."""

from __future__ import annotations

import copy
import hashlib
import json
from pathlib import Path
import sys

from pydantic import JsonValue, TypeAdapter
import pytest

sys.path.insert(0, str(Path(__file__).resolve().parents[1]))

from scripts.nutricoach_v150_detached_bootstrap import (
    BootstrapDenied,
    verify_closure,
)
from scripts.verify_nutricoach_v150_preseal_v13 import (
    VerificationDenied,
    validate_bound_contract,
)

_OBJECT = TypeAdapter(dict[str, JsonValue])
PRESEAL = Path(
    "/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/"
    + "live-transaction-preseal-v13-weekly-authority"
)


def _documents() -> tuple[
    dict[str, JsonValue], dict[str, JsonValue], dict[str, JsonValue]
]:
    target = _OBJECT.validate_json((PRESEAL / "sealed-target.json").read_bytes())
    package_path = target.get("permission_package")
    assert isinstance(package_path, str)
    package = _OBJECT.validate_json(Path(package_path).read_bytes())
    supersession = _OBJECT.validate_json(
        (PRESEAL / "package-supersession.json").read_bytes()
    )
    return target, package, supersession


def test_v13_contract_denies_v12_authority_and_execution_roots() -> None:
    target, package, supersession = _documents()
    altered = copy.deepcopy(target)
    altered["global_approval_ledger"] = str(altered["global_approval_ledger"]).replace(
        "live-authorization-v13", "live-authorization-v12"
    )

    with pytest.raises(VerificationDenied, match="v13_paths"):
        _ = validate_bound_contract(altered, package, supersession)


def test_v13_closure_denies_weekly_authority_source_tamper(tmp_path: Path) -> None:
    source = tmp_path / "source"
    weekly = source / "scripts/nutricoach_v150_weekly_authority.py"
    weekly.parent.mkdir(parents=True)
    _ = weekly.write_bytes(
        (Path(__file__).parents[1] / weekly.relative_to(source)).read_bytes()
    )
    manifest = tmp_path / "controller-source-manifest.json"
    _ = manifest.write_text(
        json.dumps({
            "files": {
                str(weekly.relative_to(source)): hashlib.sha256(
                    weekly.read_bytes()
                ).hexdigest()
            }
        }),
        encoding="utf-8",
    )
    assert verify_closure(manifest, source).startswith("sha256:")
    _ = weekly.write_text("tampered\n", encoding="utf-8")

    with pytest.raises(BootstrapDenied, match="closure_drift"):
        _ = verify_closure(manifest, source)


def test_v13_contract_denies_old_v12_approval() -> None:
    target, package, supersession = _documents()
    old_digest = "4627a832bd84bbc8b534deb06019643d74f5e567640fd612fbcd8b8d7690d3a1"
    altered = copy.deepcopy(package)
    altered["package_digest"] = old_digest
    altered["approval_phrase"] = f"AUTHORIZE NUTRICOACH V1.5 LIVE UPGRADE {old_digest}"

    with pytest.raises(VerificationDenied, match="superseded_package"):
        _ = validate_bound_contract(target, altered, supersession)