"""Shared fixtures + canonical registry fragments for the mgf-secrets suite."""

from __future__ import annotations

import pytest

# A structurally-complete minimal entry (every required field present).
GOLDEN_MINIMAL = """\
[codeberg_ssh_clone_key]
family = "mgf"
kind = "ssh-deploy-key"
purpose = "read-only SSH clone for all CI pipelines (PAPER-109)"
consumers = ["clone step, every generated pipeline"]
recovery = "mint new keypair; staged rotate; MGF_INFRA §2"
state = "active"
policy = { allowed_repos = "*", blast_radius = "read all private repos" }
rotation = { class = "static-key", staged = true, last = "2026-07-12" }
verify = { probe = "forge-key-fingerprint" }
surfaces = [
  { type = "woodpecker-org-secret", events = ["push", "pull_request", "tag", "manual", "cron"] },
  { type = "forge-deploy-key", repos = "ALL_MANAGED", readonly = true, title = "ci-clone-2026-07-12" },
]
"""

# A maximal entry exercising more surface types + rotation fields.
GOLDEN_MAXIMAL = """\
[devpi_password]
family = "mgf"
kind = "password"
purpose = "devpi magogi upload password (PKG-03); tag-only publish secret"
consumers = ["publish step of every releasing repo"]
recovery = "reset on devpi host; re-enter org secret; MGF_INFRA §2"
state = "active"

[devpi_password.policy]
allowed_repos = "*"
blast_radius = "org-wide any-image tag secret (DECISION-06)"

[devpi_password.rotation]
class = "password"
staged = true
canary = "sooth"
rotate_by = "2026-12-31"

[devpi_password.verify]
probe = "devpi-login"

[[devpi_password.surfaces]]
type = "woodpecker-org-secret"
events = ["tag"]

[[devpi_password.surfaces]]
type = "local-file"
repo = "mgf"
path = "tokens/devpi_password.txt"
mode = "0600"

[[devpi_password.surfaces]]
type = "store"
"""


@pytest.fixture
def golden_minimal() -> str:
    return GOLDEN_MINIMAL


@pytest.fixture
def golden_maximal() -> str:
    return GOLDEN_MAXIMAL
