#!/usr/bin/env python3
"""Tests for the explicit selected-case release authorization gate."""

from __future__ import annotations

import hashlib
import json
import sys
import unittest
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parent))

import generate_release_authorized_gate as generator


ROOT = Path(__file__).resolve().parents[1]
REPORT = ROOT / generator.OUTPUT


class ReleaseAuthorizedGateTests(unittest.TestCase):
    def test_authorized_scope_and_no_blockers(self) -> None:
        report = json.loads(REPORT.read_text(encoding="utf-8"))
        self.assertEqual(report["schema"], "release-authorized-gate.v1")
        self.assertEqual(report["task_id"], "RELEASE-AUTHORIZATION-01")
        self.assertEqual(report["status"], "authorized")
        self.assertTrue(report["candidate_eligible"])
        self.assertEqual(report["release_action"], "ALLOW_RELEASE")
        self.assertEqual(report["release_scope"], "selected_case_web_wasm_simulation")
        self.assertEqual(report["remaining_blockers"], [])
        self.assertEqual(len(report["waived_blockers"]), 6)
        self.assertTrue(all(item["hash_match"] for item in report["evidence"]))
        self.assertFalse(report["risk_boundary"]["technical_evidence_rewritten"])

    def test_self_hash_and_determinism(self) -> None:
        before = REPORT.read_bytes()
        generated = generator.generate(ROOT, REPORT)
        self.assertEqual(before, REPORT.read_bytes())
        unsigned = {key: value for key, value in generated.items() if key != "report_sha256"}
        self.assertEqual(generated["report_sha256"], hashlib.sha256(generator.canonical(unsigned).encode("utf-8")).hexdigest())


if __name__ == "__main__":
    unittest.main()