from pathlib import Path
import json,sys
R=Path(__file__).resolve().parents[1]; checks=[]
def ck(n,v): checks.append((n,bool(v)))
b=json.loads((R/'fixture/baseline-session.json').read_text()); p=json.loads((R/'fixture/golden-policy.json').read_text()); cases=json.loads((R/'fixture/probe-cases.json').read_text())['cases']; c=b['cookie']; pol=b['policy']
ck('host cookie',c['name']=='__Host-session'); ck('secure',c['Secure'] is True); ck('httponly',c['HttpOnly'] is True); ck('samesite',c['SameSite']=='Strict'); ck('path root',c['Path']=='/'); ck('domain absent',c['Domain'] is None); ck('rotate auth',pol['rotate_on_authentication'] is True); ck('rotate privilege',pol['rotate_on_privilege_change'] is True); ck('server invalidation',pol['server_side_invalidation_on_logout'] is True); ck('reauth recovery','recovery_settings.change' in pol['reauthentication_required_for']); ck('server authority',pol['authoritative_session_state']=='SERVER_SESSION_STORE'); ck('browser delete false',pol['browser_cookie_deletion_invalidates_server_session'] is False); ck('opaque id',pol['session_id_is_opaque_reference'] is True); ck('record fields exact',len(b['record_fields'])==10 and 'Residual Risk' in b['record_fields']); ck('seven probes',len(cases)==7); ck('three positive',len(p['required_positive_paths'])==3); ck('four negative',len(p['required_negative_paths'])==4); ck('four forbidden',len(p['forbidden_conclusions'])==4); ck('fixture exists',(R/'src/session_fixture.py').exists()); ck('runner exists',(R/'src/run_local_lab.py').exists()); ck('submission template',(R/'submission/decision.template.json').exists()); ck('network false',json.loads((R/'requirements.json').read_text())['external_network_required'] is False)
for cse in cases: ck('case class '+cse['id'],bool(cse['expected_class']))
for n,v in checks: print(('PASS' if v else 'FAIL'),n)
print(f'{sum(v for _,v in checks)}/{len(checks)} PASS'); sys.exit(0 if all(v for _,v in checks) else 1)