import pathlib,json,sys
ROOT=pathlib.Path(__file__).resolve().parents[1]; sys.path.insert(0,str(ROOT/'src'))
from secret_scope import *
policy=json.loads((ROOT/'fixture/golden-policy.json').read_text()); fixture=json.loads((ROOT/'fixture/baseline-scope.json').read_text()); checks=[]
def c(n,x): checks.append((n,bool(x)))
results={r['case_id']:evaluate_access(r,policy) for r in fixture['requests']}
c('own_allow',results['OWN_OBJECT_ALLOW']['decision']=='ALLOW_SCOPED_ACCESS'); c('unrelated_deny',results['UNRELATED_OBJECT_DENY']['decision']=='DENY_SCOPE_OR_CAPABILITY'); c('wildcard_deny',results['WILDCARD_DENY']['decision']=='DENY_WILDCARD_SCOPE'); c('revoked_deny',results['REVOKED_DENY']['decision']=='DENY_REVOKED_SECRET')
rots={r['case_id']:evaluate_rotation(r,policy) for r in fixture['rotation_events']}; c('rotation_complete',rots['ROTATION_COMPLETE']['decision']=='ROTATION_COMPLETE'); c('rotation_old_active_deny',rots['ROTATION_OLD_STILL_ACTIVE']['decision']=='DENY_ROTATION_INCOMPLETE')
a=build_audit_event({'identity_id':'wid-orders-api','secret_id':'secret://orders-read-v1','decision':'ALLOW_SCOPED_ACCESS','secret_value':'SHOULD_NOT_COPY'}); c('audit_identity',a['identity_id']=='wid-orders-api'); c('audit_secret_id',a['secret_id']=='secret://orders-read-v1'); c('audit_decision',a['decision']=='ALLOW_SCOPED_ACCESS'); c('audit_no_secret_value','secret_value' not in a); c('audit_fields_exact',set(a)=={'identity_id','secret_id','decision','lifecycle_event','timestamp'})
row=build_record('secret://orders-read-v1','orders-api','wid-orders-api','retrieve',results['OWN_OBJECT_ALLOW'],rots['ROTATION_COMPLETE']); c('record_complete',evidence_row_complete(row)); c('row_no_secret_material',not any(k in row for k in FORBIDDEN_EVIDENCE_KEYS)); c('human_no_direct_read',row['human_access']=='NO_DIRECT_READ')
c('batch_transfer',classify_transfer('batch_worker')['status']=='REBUILD_SCOPE'); c('api_transfer',classify_transfer('interactive_api')['status']=='REBUILD_SCOPE'); c('unknown_transfer',classify_transfer('other')['status']=='UNKNOWN_CONTEXT'); c('batch_vs_api_diff',classify_transfer('batch_worker')['lifetime']!=classify_transfer('interactive_api')['lifetime']); c('policy_no_wildcard',policy['wildcard_secret_access_forbidden'] is True); c('production_false',policy['production_proof'] is False)
for n,ok in checks: print(('PASS' if ok else 'FAIL'),n)
print(f'SUMMARY {sum(ok for _,ok in checks)}/{len(checks)} PASS'); raise SystemExit(0 if all(ok for _,ok in checks) else 1)