import pathlib,json,sys
ROOT=pathlib.Path(__file__).resolve().parents[1]; sys.path.insert(0,str(ROOT/'src'))
from injection_boundary import validate_report_days,evaluate_output_case,evaluate_query_design,classify_transfer
fx=json.loads((ROOT/'fixture/baseline-injection.json').read_text()); policy=json.loads((ROOT/'fixture/golden-policy.json').read_text()); checks=[]
def c(n,x): checks.append((n,bool(x)))
d={x['id']:x for x in fx['display_cases']}; q={x['id']:x for x in fx['query_cases']}; v={x['id']:x for x in fx['validation_cases']}
c('html_text',evaluate_output_case(d['DISPLAY_HTML_TEXT'],policy)['status']=='SAFE_TEXT_SINK_REQUIRED'); c('attribute',evaluate_output_case(d['DISPLAY_HTML_ATTRIBUTE'],policy)['status']=='ATTRIBUTE_ENCODING_REQUIRED'); c('rich_reclass',evaluate_output_case(d['DISPLAY_CHANGED_RICH'],policy)['status']=='SANITIZATION_REQUIRED')
c('valid',validate_report_days(v['DAYS_VALID']['value'],policy)['status']=='VALID'); c('syntax',validate_report_days(v['DAYS_SYNTAX_INVALID']['value'],policy)['status']=='REJECT_SYNTAX'); c('semantic',validate_report_days(v['DAYS_SEMANTIC_INVALID']['value'],policy)['status']=='REJECT_SEMANTIC')
par=evaluate_query_design(q['REPORT_PARAMETERIZED'],policy); c('parameterized',par['status']=='PARAMETERIZED_DESIGN'); c('query_template',par['query_template'].endswith('?')); c('bound_parameter',par['parameters']==[30]); c('not_executed',par['executed'] is False)
unsafe=evaluate_query_design(q['REPORT_STRING_BUILDING'],policy); c('string_building_rejected',unsafe['status']=='REJECT_STRING_BUILDING'); c('string_building_not_executed',unsafe['executed'] is False)
c('generic_not_universal',policy['generic_sanitizer_is_universal'] is False); c('validation_not_primary',policy['input_validation_is_primary_injection_defense'] is False); c('csp_not_primary',policy['csp_is_primary_xss_defense'] is False)
c('transfer_rich',classify_transfer('rich_comments',policy)['primary_defense']=='html_sanitization'); c('transfer_sort',classify_transfer('report_sort_identifier',policy)['primary_defense']=='fixed_allowlist_mapping')
req=json.loads((ROOT/'requirements.json').read_text()); c('local_only',req['network']=='forbidden'); c('no_real_creds',req['real_credentials']=='forbidden'); c('no_hostile_payloads',req['hostile_payloads']=='forbidden'); c('no_external_targets',req['external_targets']=='forbidden')
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(x[1] for x in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(x[1] for x in checks) else 1)