"""Governance classifications are validated against the fixed ADR-0011 set (issue 05).

ADR-0011 fixes the v0 governance vocabulary to eight classifications. Nothing in the
engine enforced it, so an arbitrary label in source.yaml flowed straight into governance
metadata. The valid universe is a platform invariant, so an unknown label must be
rejected in engine code.

Runnable without a test harness::

    .venv/bin/python tests/test_governance_classifications.py
"""

from __future__ import annotations

import pathlib
import sys

sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1]))

from ingestion.common.classification import classify_table
from ingestion.common.governance import GOVERNANCE_CLASSIFICATIONS, validate_classifications
from ingestion.common.models import Column, Table


def _table(name: str = "account", columns: list[str] | None = None) -> Table:
    cols = columns or ["id", "email"]
    return Table(
        database="nexuscrm",
        name=name,
        rows_estimate=None,
        columns=[
            Column(name=c, data_type="varchar", column_type="varchar(255)", nullable=True, ordinal_position=i)
            for i, c in enumerate(cols, start=1)
        ],
        primary_key=["id"],
    )


def test_set_matches_adr0011() -> None:
    assert GOVERNANCE_CLASSIFICATIONS == {
        "public",
        "internal",
        "confidential",
        "restricted",
        "pii",
        "financial",
        "customer_data",
        "operational_sensitive",
    }


def test_validate_accepts_known_labels() -> None:
    assert validate_classifications(["restricted", "pii"]) == ["restricted", "pii"]


def test_validate_rejects_unknown_label() -> None:
    raised = False
    try:
        validate_classifications(["restricted", "super_secret"])
    except ValueError as error:
        raised = True
        assert "super_secret" in str(error)
    assert raised, "validate_classifications should reject an unknown label"


def test_classify_table_returns_valid_labels() -> None:
    rules = {
        "baseline": ["restricted"],
        "patterns": {"pii": "email"},
        "name_rules": [{"name_prefix": "_System_", "add": "operational_sensitive"}],
    }
    assert classify_table(_table(), rules) == ["pii", "restricted"]
    assert classify_table(_table(name="_System_Config", columns=["id"]), rules) == [
        "operational_sensitive",
        "restricted",
    ]


def test_classify_table_rejects_unknown_baseline() -> None:
    raised = False
    try:
        classify_table(_table(), {"baseline": ["made_up_label"]})
    except ValueError as error:
        raised = True
        assert "made_up_label" in str(error)
        assert "account" in str(error)  # context names the table
    assert raised, "classify_table should reject an unknown classification"


if __name__ == "__main__":
    cases = [value for name, value in sorted(globals().items()) if name.startswith("test_") and callable(value)]
    for case in cases:
        case()
        print(f"ok  {case.__name__}")
    print(f"\n{len(cases)} passed")