import unittest
import json
from pathlib import Path
from scripts import render_serviceification_test_stack as renderer
from scripts.verify_local_public_connected_app import verify
from scripts.verify_local_api_read import verify as verify_api_read

READ_CAPABILITIES = [
    "runtime.records.query.v1",
    "runtime.records.read-record-view.v1",
    "runtime.permissions.read-effective.v1",
]

class PublicRecordsScopeTest(unittest.TestCase):
    def test_confidential_read_scope_covers_records_and_describe(self):
        layout_read = "runtime.metadata.resolve-page-layout.v1"
        grants = [{"authorized_workload_id": "sfcrm-app-service", "capability_id": layout_read}]
        policy = renderer.d3_session_scope_policy(READ_CAPABILITIES, grants)
        self.assertEqual(policy["api.read"], READ_CAPABILITIES + [layout_read])
        self.assertIsNot(policy["api.read"], policy["external.records.read"])

    def test_confidential_read_scope_excludes_writes_and_unreviewed_capabilities(self):
        forbidden = ["runtime.records.mutate.v1", "runtime.permissions.authoring.v1",
                     "runtime.layout.authoring.v2", "runtime.future.read-sensitive.v1"]
        policy = renderer.d3_session_scope_policy(READ_CAPABILITIES + forbidden, [])
        self.assertEqual(policy["api.read"], READ_CAPABILITIES)
        self.assertTrue(set(forbidden).issubset(policy["api"]))

    def test_confidential_read_scope_requires_sfcrm_layout_delegation(self):
        grants = [{"authorized_workload_id": "integration-service",
                   "capability_id": "runtime.metadata.resolve-page-layout.v1"}]
        policy = renderer.d3_session_scope_policy([READ_CAPABILITIES[0]], grants)
        self.assertEqual(policy["api.read"], [READ_CAPABILITIES[0]])

    def test_installed_layout_read_still_requires_sfcrm_delegation(self):
        layout = "runtime.metadata.resolve-page-layout.v1"
        installed = READ_CAPABILITIES + [layout]
        for workload in (None, "integration-service", "sfcrm-app-service"):
            with self.subTest(workload=workload):
                grants = ([] if workload is None else
                          [{"authorized_workload_id": workload, "capability_id": layout}])
                policy = renderer.d3_session_scope_policy(installed, grants)
                expected = installed if workload == "sfcrm-app-service" else READ_CAPABILITIES
                for scope in ("api.read", "external.records.read"):
                    self.assertEqual(policy[scope], expected)
                self.assertEqual(policy["api"], installed)

    def test_public_describe_includes_sfcrm_delegated_layout_read(self):
        layout_read = "runtime.metadata.resolve-page-layout.v1"
        grants = [{"authorized_workload_id": "sfcrm-app-service", "capability_id": layout_read}]
        policy = renderer.d3_session_scope_policy(READ_CAPABILITIES, grants)
        self.assertEqual(policy["external.records.read"], READ_CAPABILITIES + [layout_read])

    def test_other_workloads_cannot_delegate_public_layout_read(self):
        for workload in ("integration-service", "unrelated-service", None):
            with self.subTest(workload=workload):
                grants = [{"authorized_workload_id": workload, "capability_id": "runtime.metadata.resolve-page-layout.v1"}]
                self.assertEqual(renderer.d3_session_scope_policy(READ_CAPABILITIES, grants)["external.records.read"], READ_CAPABILITIES)

    def test_sfcrm_admin_and_mutation_grants_remain_excluded(self):
        grants = [{"authorized_workload_id": "sfcrm-app-service", "capability_id": capability}
                  for capability in ("runtime.metadata.read-admin.v1", "runtime.layout.authoring.v2", "runtime.records.mutate.v1", "runtime.future.read-sensitive.v1")]
        self.assertEqual(renderer.d3_session_scope_policy(READ_CAPABILITIES, grants)["external.records.read"], READ_CAPABILITIES)

    def test_public_reads_have_explicit_grants_without_mutation_or_admin(self):
        installed = READ_CAPABILITIES + ["runtime.records.mutate.v1", "runtime.permissions.authoring.v1", "runtime.files.authorized-content.v1"]
        grants = [{"capability_id": renderer.METADATA_ADMIN_READ_CAPABILITY}]
        policy = renderer.d3_session_scope_policy(installed, grants)
        self.assertEqual(policy["external.records.read"], READ_CAPABILITIES)
        self.assertEqual(policy["api"], renderer.d3_session_scope_capabilities(installed, grants))
        self.assertNotIn("", policy)
        self.assertNotIn("unknown", policy)

    def test_current_apprelease_grants_cover_public_read_surfaces(self):
        root = Path(__file__).resolve().parents[1]
        bom = json.loads((root / "release/serviceification-d3-bom.json").read_text())
        installed = [binding["runtime_capability_id"] for binding in bom["app_installation"]["capabilities"]]
        grants = bom["catalog_consumers"]["runtime_capability_grants"]
        policy = renderer.d3_session_scope_policy(installed, grants)
        self.assertEqual(policy["external.records.read"], READ_CAPABILITIES + ["runtime.metadata.resolve-page-layout.v1"])
        self.assertIn("runtime.records.mutate.v1", policy["api"])

    def test_fixture_verifier_rejects_nonlocal_origins_before_network(self):
        for base in ("https://nexuscrm-new-prod.pingcap.com", "http://example.com", "http://127.0.0.1@example.com", "http://user:password@127.0.0.1", "http://localhost/api", "http://localhost?redirect=prod"):
            with self.subTest(base=base), self.assertRaises(ValueError):
                verify(base, "unused", "unused", 200)

    def test_api_read_verifier_rejects_remote_origins_before_loading_credentials(self):
        for base in ("https://example.com", "http://example.com", "http://127.0.0.1@example.com",
                     "http://localhost?redirect=prod", "http://localhost/api"):
            with self.subTest(base=base), self.assertRaises(ValueError):
                verify_api_read(base, Path("missing-private-env"), 200)

    def test_does_not_grant_uninstalled_capabilities(self):
        policy = renderer.d3_session_scope_policy([READ_CAPABILITIES[0]], [])
        self.assertEqual(policy["external.records.read"], [READ_CAPABILITIES[0]])
        self.assertEqual(renderer.d3_session_scope_policy(["runtime.records.mutate.v1"], []), {"api": ["runtime.records.mutate.v1"]})

    def test_new_capabilities_do_not_implicitly_expand_public_scope(self):
        installed = READ_CAPABILITIES + ["runtime.future.read-sensitive.v1", "runtime.future.execute.v1"]
        self.assertEqual(renderer.d3_session_scope_policy(installed, [])["external.records.read"], READ_CAPABILITIES)

if __name__ == "__main__":
    unittest.main()