"""Exact sealed input, authority-root, and protected-inventory verifier."""

from __future__ import annotations

from pathlib import Path

from .contract import FilePin, PackageContract
from .fdio import open_root, read_pinned_absolute


class VerificationError(RuntimeError):
    """A bound input differs from the sealed package."""


def verify_file_pin(pin: FilePin) -> None:
    """Verify an absolute file through no-follow parent traversal."""
    _ = read_pinned_absolute(pin)


class ExactInputVerifier:
    """Verify package, runtime, authority, observer, and protected pins."""

    def verify(self, contract: PackageContract) -> None:
        """Fail before mutation when any listed root or file pin drifts."""
        with open_root(contract.source_root), open_root(contract.target_root):
            pass
        pins = (
            contract.file_pins
            + contract.controller_closure
            + contract.installed_records
            + contract.protected_files
        )
        paths: set[Path] = set()
        for pin in pins:
            if pin.path in paths:
                raise VerificationError("duplicate pin")
            paths.add(pin.path)
            verify_file_pin(pin)