from pathlib import Path
import json,sys,importlib.util
ROOT=Path(__file__).resolve().parents[1]; checks=[]
def ck(n,v): checks.append((n,bool(v)))
sp=importlib.util.spec_from_file_location('wf',ROOT/'src/webauthn_fixture.py'); m=importlib.util.module_from_spec(sp); sp.loader.exec_module(m)
b=json.loads((ROOT/'fixture/baseline-webauthn.json').read_text()); cases=json.loads((ROOT/'fixture/probe-cases.json').read_text())['cases']; rp=b['relying_party']; p=b['ceremony_policy']; rec=b['recovery_policy']
ck('invariants',m.validate_model_invariants()['pass']); ck('rp id',rp['rp_id']=='login.example.test'); ck('origin',rp['expected_origin']=='https://login.example.test'); ck('server challenge',p['server_generates_challenge']); ck('single use',p['challenge_single_use']); ck('verify origin',p['verify_origin']); ck('verify rp',p['verify_rp_id']); ck('uv required',p['user_verification']=='required'); ck('risk recovery',rec['risk_based_decision_required']); ck('record eleven',len(b['record_fields'])==11); ck('baseline registration',m.run_probe('baseline_registration')['classification']=='VERIFIED_REGISTRATION'); ck('baseline authentication',m.run_probe('baseline_authentication')['classification']=='VERIFIED_AUTHENTICATION')
for c in cases: ck('class '+c['id'],m.run_probe(c['id'])['classification']==c['expected_class'])
for n,v in checks: print(('PASS' if v else 'FAIL'),n)
print(f'{sum(v for _,v in checks)}/{len(checks)} PASS'); sys.exit(0 if all(v for _,v in checks) else 1)