from pathlib import Path
import json,sys
R=Path(__file__).resolve().parents[1]; checks=[]
def ck(n,v): checks.append((n,bool(v)))
b=json.loads((R/'fixture/baseline-webauthn.json').read_text()); p=json.loads((R/'fixture/golden-policy.json').read_text()); cases=json.loads((R/'fixture/probe-cases.json').read_text())['cases']; req=json.loads((R/'requirements.json').read_text()); rp=b['relying_party']; cp=b['ceremony_policy']; a=b['synthetic_account']; rec=b['recovery_policy']
ck('rp id',rp['rp_id']=='login.example.test'); ck('origin https',rp['expected_origin']=='https://login.example.test'); ck('server challenge',cp['server_generates_challenge'] is True); ck('single use',cp['challenge_single_use'] is True); ck('origin verify',cp['verify_origin'] is True); ck('rp verify',cp['verify_rp_id'] is True); ck('uv required',cp['user_verification']=='required'); ck('ttl positive',cp['challenge_ttl_seconds']>0); ck('credential synthetic',a['credential_id']=='cred-synth-001'); ck('registered',a['credential_registered'] is True); ck('private stays virtual',a['private_key_location']=='VIRTUAL_AUTHENTICATOR_ONLY_NO_SECRET_EXPORTED'); ck('risk recovery',rec['risk_based_decision_required'] is True); ck('credential lifecycle recovery',rec['revoke_or_supersede_lost_credential_on_reenrollment'] is True); ck('weaker shortcut', 'email_only_link' in rec['materially_weaker_shortcuts']); ck('record fields exact',len(b['record_fields'])==11 and 'Residual Decision' in b['record_fields']); ck('nine probes',len(cases)==9); ck('two positive',len(p['required_positive_paths'])==2); ck('six negative',len(p['required_negative_paths'])==6); ck('four forbidden',len(p['forbidden_conclusions'])==4); ck('fixture exists',(R/'src/webauthn_fixture.py').exists()); ck('runner exists',(R/'src/run_local_lab.py').exists()); ck('submission template',(R/'submission/decision.template.json').exists()); ck('network false',req['external_network_required'] is False); ck('real creds false',req['real_credentials_required'] is False); ck('real account false',req['real_account_required'] is False); ck('physical authenticator false',req['physical_authenticator_required'] is False); ck('external target false',req['external_target_required'] is False)
for c in cases: ck('case class '+c['id'],bool(c['expected_class']))
for n,v in checks: print(('PASS' if v else 'FAIL'),n)
print(f'{sum(v for _,v in checks)}/{len(checks)} PASS'); sys.exit(0 if all(v for _,v in checks) else 1)