"""Ehemals ExecutionClearance mit Aussteller-String (fälschbar).

Neuer Vertrag: HMAC-SHA256-Clearance (aria_router.authorization). Die sechs
Testnamen bleiben, ihre Absicht auch; siehe docs/AENDERUNGEN.md.
"""
import tempfile
import unittest
from pathlib import Path

from aria_router.authorization import AuthorizationError
from aria_router.core import PrivacyTier

from tests.helpers import AdapterHarness


class AuthorizationTests(unittest.TestCase):

    def setUp(self):
        self._tmp = tempfile.TemporaryDirectory()
        self.harness = AdapterHarness(Path(self._tmp.name))
        self.digest = "a" * 64
        self.clearance = self.harness.issuer.issue(
            job_id="job-1", backend="codex", privacy=PrivacyTier.PUBLIC,
            context_digest=self.digest, sender_id="1", chat_id="1",
        )

    def tearDown(self):
        self._tmp.cleanup()

    def verify(self, clearance, **overrides):
        args = dict(backend="codex", job_id="job-1", context_digest=self.digest,
                    privacy=PrivacyTier.PUBLIC, sender_id="1", chat_id="1")
        args.update(overrides)
        return self.harness.verifier.verify(clearance, **args)

    def assertCode(self, code, func, *args, **kwargs):
        with self.assertRaises(AuthorizationError) as ctx:
            func(*args, **kwargs)
        self.assertEqual(ctx.exception.code, code)

    def test_valid_clearance(self):
        self.verify(self.clearance)

    def test_missing_clearance(self):
        self.assertCode("MISSING_CLEARANCE", self.verify, None)

    def test_wrong_job(self):
        self.assertCode("JOB_MISMATCH", self.verify, self.clearance, job_id="job-2")

    def test_wrong_backend(self):
        self.assertCode("BACKEND_MISMATCH", self.verify, self.clearance, backend="claude")

    def test_denied(self):
        # Eine verweigerte Policy-Entscheidung erzeugt gar keine Clearance.
        self.assertCode("PRIVACY_NOT_PERMITTED", self.harness.issuer.issue, job_id="job-1", backend="codex",
                        privacy=PrivacyTier.CONFIDENTIAL, context_digest=self.digest, sender_id="1",
                        chat_id="1")

    def test_untrusted_approver(self):
        # Fremder Aussteller = fremder Schlüssel -> Signatur ungültig.
        with tempfile.TemporaryDirectory() as other:
            forger = AdapterHarness(Path(other))
            forged = forger.issuer.issue(job_id="job-1", backend="codex", privacy=PrivacyTier.PUBLIC,
                                         context_digest=self.digest, sender_id="1", chat_id="1")
        self.assertCode("INVALID_SIGNATURE", self.verify, forged)


if __name__ == "__main__":
    unittest.main()