from pathlib import Path
import json,sys
R=Path(__file__).resolve().parents[1]; checks=[]
def ck(n,v): checks.append((n,bool(v)))
b=json.loads((R/'fixture/baseline-policy.json').read_text()); p=json.loads((R/'fixture/golden-policy.json').read_text()); cases=json.loads((R/'fixture/probe-cases.json').read_text())['cases']
ck('subjects exact',set(b['subjects'])=={'alice','bob','carol','dave'}); ck('roles exact',set(b['roles'])=={'Viewer','Editor','WorkspaceAdmin'}); ck('viewer minimal',b['roles']['Viewer']==['project.read','file.read']); ck('editor minimal',b['roles']['Editor']==['project.read','file.read','file.write']); ck('admin member manage','member.manage' in b['roles']['WorkspaceAdmin']); ck('two workspaces',set(x['workspace_id'] for x in b['resources'].values())=={'w1','w2'}); ck('default deny',b['policy']['default_decision']=='DENY'); ck('workspace scope',b['policy']['workspace_scope_required'] is True); ck('server enforcement',b['policy']['authoritative_enforcement_point']=='SERVER_POLICY_EVALUATOR'); ck('ui not authz',b['policy']['ui_visibility_is_authorization_control'] is False); ck('editor hidden member manage','member.manage' in b['ui']['Editor']['hidden_actions']); ck('record fields exact',len(b['record_fields'])==10 and 'Residual Policy Question' in b['record_fields']); ck('seven probes',len(cases)==7); ck('three positive paths',len(p['required_positive_paths'])==3); ck('three negative paths',len(p['required_negative_paths'])==3); ck('four forbidden',len(p['forbidden_conclusions'])==4); ck('fixture exists',(R/'src/authz_fixture.py').exists()); ck('runner exists',(R/'src/run_local_lab.py').exists()); ck('submission template',(R/'submission/decision.template.json').exists()); ck('transfer template',(R/'transfer/changed-context.template.json').exists()); ck('evidence template',(R/'evidence/Authorization_Decision_Matrix_v1.template.json').exists()); ck('network false',json.loads((R/'requirements.json').read_text())['external_network_required'] is False)
for c in cases: ck('case class '+c['id'],bool(c['expected_class']))
for n,v in checks: print(('PASS' if v else 'FAIL'),n)
print(f'{sum(v for _,v in checks)}/{len(checks)} PASS'); sys.exit(0 if all(v for _,v in checks) else 1)