#!/usr/bin/env bash
set -uo pipefail

# CASAN Plan-09 tie-in — unified governance evidence report tests.
# Deterministic. Proves the report aggregates all governance cores, certifies a
# clean run, and refuses to certify (fail-able gate) when the control-plane audit
# chain is tampered.

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
GR="$PROJECT_ROOT/.specify/scripts/bash/governance-report.py"
CPS="$PROJECT_ROOT/.specify/scripts/bash/control-plane-settings.py"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT
export CASAN_CP_STORE_FILE="$WORK/store.json"

PASS=0; FAIL=0
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }

echo "===== Plan-09 unified governance evidence report ====="

# 1) clean run => CERTIFIED, report file written, all controls present
python3 "$GR" --out "$WORK/gov.json" --gate >"$WORK/1.out" 2>&1
RC=$?
if [[ "$RC" -eq 0 ]] && grep -q "badge=CERTIFIED" "$WORK/1.out"; then
  pass "clean run is CERTIFIED"
else
  cat "$WORK/1.out"; fail "clean run not certified (rc=$RC)"
fi
[[ -f "$WORK/gov.json" ]] && pass "report artifact written" || fail "no report artifact"
CTRL="$(python3 -c "import json;d=json.load(open('$WORK/gov.json'));print(all(d['controls_present'].values()))" 2>/dev/null)"
[[ "$CTRL" == "True" ]] && pass "all governance controls present" || fail "controls missing ($CTRL)"

# 2) traceability summary embedded
TF="$(python3 -c "import json;print(json.load(open('$WORK/gov.json'))['traceability']['failed'])" 2>/dev/null)"
[[ "$TF" == "0" ]] && pass "traceability summary embedded (failed=0)" || fail "traceability summary wrong (failed=$TF)"

# 3) tamper control-plane audit => NOT certified (fail-able gate)
python3 "$CPS" set compression.enabled true --actor a@x --reason r >/dev/null 2>&1
python3 - "$CASAN_CP_STORE_FILE" <<'PY'
import json, sys
d = json.load(open(sys.argv[1]))
d["audit"][0]["value"] = "tampered"
json.dump(d, open(sys.argv[1], "w"))
PY
set +e
python3 "$GR" --out "$WORK/gov2.json" --gate >"$WORK/3.out" 2>"$WORK/3.err"; RC=$?
set -e 2>/dev/null || true
[[ "$RC" -eq 1 ]] && grep -q "badge=NOT_CERTIFIED" "$WORK/3.out" \
  && pass "tampered audit ⇒ NOT_CERTIFIED (fail-able)" || fail "tamper did not block certification (rc=$RC)"

echo ""
echo "===== GOVERNANCE-REPORT SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1