"""Deploy-key identity is the FINGERPRINT, not the title (SPEC-P4 §7c).

The doctor's coverage (C5) and unregistered-actual (C3) checks must use content
identity — so a repo that carries the fleet key under a DIFFERENT title is neither
paged as a coverage gap nor as a steward-class rogue (aligns with the 0.3.0 sync fix).
"""

from __future__ import annotations

from mgf.secrets.doctor import Doctor
from mgf.secrets.forge import DeployKey
from mgf.secrets.registry import load
from tests._fakes import FakeForge, FakeWoodpecker

FLEET = """\
[fleet_key]
family = "mgf"
kind = "ssh-deploy-key"
purpose = "fleet clone key"
consumers = ["clone"]
recovery = "re-add"
state = "active"
policy = { allowed_repos = "*", blast_radius = "read" }
rotation = { class = "static-key", staged = true }
verify = { probe = "forge-key-fingerprint" }
surfaces = [ { type = "forge-deploy-key", repos = "ALL_MANAGED", readonly = true, title = "ci-clone-2026" } ]
"""


def _reg(tmp_path):
    (tmp_path / "SECRETS.toml").write_text(FLEET, encoding="utf-8")
    return load([tmp_path / "SECRETS.toml"])


def test_repo_with_fleet_key_under_a_different_title_is_covered_and_governed(tmp_path) -> None:
    reg = _reg(tmp_path)
    # repo-a carries the fleet key under its declared title -> defines the canonical fp.
    # repo-b carries the SAME key (fp:X) under a DIFFERENT title (mgf-uitest-web shape).
    fp = "SHA256:CANON"
    forge = FakeForge(
        {
            "repo-a": [DeployKey(title="ci-clone-2026", fingerprint=fp, read_only=True)],
            "repo-b": [
                DeployKey(title="woodpecker-ci-clone (read-only)", fingerprint=fp, read_only=True)
            ],
        }
    )
    wp = FakeWoodpecker(repos=[(1, "repo-a"), (2, "repo-b")])
    report = Doctor(reg, fed_root=tmp_path, woodpecker=wp, forge=forge).run(["forge"])
    # C5: repo-b is NOT a coverage gap (covered by fingerprint, not title).
    assert not [
        f for f in report.findings if f.check == "C5" and f.evidence.get("repo") == "repo-b"
    ]
    # C3: repo-b's differently-titled key is NOT flagged ungoverned (same content).
    assert not [
        f for f in report.findings if f.check == "C3" and f.evidence.get("repo") == "repo-b"
    ]
    assert report.exit_code() == 0


def test_genuinely_absent_key_is_still_a_coverage_gap(tmp_path) -> None:
    reg = _reg(tmp_path)
    fp = "SHA256:CANON"
    forge = FakeForge(
        {
            "repo-a": [DeployKey(title="ci-clone-2026", fingerprint=fp, read_only=True)],
            "repo-b": [],  # readable, carries NOTHING -> a real gap
        }
    )
    wp = FakeWoodpecker(repos=[(1, "repo-a"), (2, "repo-b")])
    report = Doctor(reg, fed_root=tmp_path, woodpecker=wp, forge=forge).run(["forge"])
    assert any(f.check == "C5" and f.evidence.get("repo") == "repo-b" for f in report.findings)


def test_unrelated_key_by_content_and_title_is_still_ungoverned(tmp_path) -> None:
    reg = _reg(tmp_path)
    forge = FakeForge(
        {
            "repo-a": [
                DeployKey(title="ci-clone-2026", fingerprint="SHA256:CANON", read_only=True),
                DeployKey(title="rogue", fingerprint="SHA256:OTHER", read_only=True),
            ],
        }
    )
    wp = FakeWoodpecker(repos=[(1, "repo-a")])
    report = Doctor(reg, fed_root=tmp_path, woodpecker=wp, forge=forge).run(["forge"])
    assert any(f.check == "C3" and f.evidence.get("title") == "rogue" for f in report.findings)
