"""Tests for run_platform.sh Step 5b kyverno-json wiring (REQ-302, v1.25).

Asserts the script has the kyverno-json Step 5b block and the PCR-merge
logic. Pattern from tests/test_pipeline.py:79-95 (read script text +
assert substrings).
"""

import os
import sys
from pathlib import Path

import pytest

sys.path.insert(0, str(Path(__file__).resolve().parent.parent))

SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "run_platform.sh"


def _read_script():
    with open(SCRIPT, "r", encoding="utf-8") as fh:
        return fh.read()


class TestStep5bKyvernoJsonWiring:
    def test_step_5b_block_present(self):
        s = _read_script()
        assert "Step 5b: kyverno-json plan-JSON policies" in s, \
            "run_platform.sh must have a Step 5b kyverno-json block (REQ-301)"

    def test_kj_scan_invocation_present(self):
        s = _read_script()
        assert "adapters/kyverno-json/policies/plan-json" in s, \
            "Step 5b must reference the plan-json policy dir"

    def test_kj_not_installed_skip_present(self):
        s = _read_script()
        assert "kyverno-json not installed; skipping plan-JSON policies" in s, \
            "Step 5b must skip gracefully when kj is absent (D-120)"
        assert "D-120 graceful degradation" in s

    def test_pcr_merge_logic_present(self):
        s = _read_script()
        assert "merged PCR list" in s, \
            "Step 5b must merge the Checkov/Wiz + kj PCR lists"

    def test_command_v_kj_guard_present(self):
        s = _read_script()
        assert "command -v kj" in s, \
            "Step 5b must guard on `command -v kj` (is_configured)"


class TestExistingPipelineUnchanged:
    def test_step_5_still_present(self):
        s = _read_script()
        assert "Step 5: runtime policy scan" in s

    def test_step_7_confidence_still_present(self):
        s = _read_script()
        assert "Step 7: confidence signal compute" in s