#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Host-only policy mutation tests for Phase-1.0H."""

from __future__ import annotations

import argparse
import importlib.util
from pathlib import Path
import sys
from typing import Callable


def load_validator(path: Path):
    spec = importlib.util.spec_from_file_location("phase10h_validator", path)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


def require(condition: bool, message: str) -> None:
    if not condition:
        raise RuntimeError(message)


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()
    validator = load_validator(root / "tools/validate_retroarch_phase10h.py")
    record = validator.load_json(root / "manifests/retroarch/phase-1.0h-startup-args.json")
    phase10f = validator.load_json(root / "manifests/retroarch/phase-1.0f-startup-interval.json")
    cases: list[tuple[str, Callable[[], None]]] = []

    def case(name: str):
        def register(function: Callable[[], None]) -> Callable[[], None]:
            cases.append((name, function))
            return function
        return register

    @case("01 all authorizations remain false")
    def _() -> None:
        require(validator.all_false(record["authorizations"], validator.AUTHORIZATION_FIELDS), "authorization active")

    @case("02 connection authorization fails")
    def _() -> None:
        value = dict(record["authorizations"]); value["ps5_connection_authorized"] = True
        require(not validator.all_false(value, validator.AUTHORIZATION_FIELDS), "connection accepted")

    @case("03 no device action occurred")
    def _() -> None:
        require(validator.all_false(record["phase_actions"], validator.ACTION_FIELDS), "device action recorded")

    @case("04 exact artifact passes")
    def _() -> None:
        require(validator.artifact_is_exact(record["artifact"]), "artifact rejected")

    @case("05 different second build fails")
    def _() -> None:
        value = dict(record["artifact"]); value["clean_build_sha256"] = [validator.ARTIFACT_SHA256, "0" * 64]
        require(not validator.artifact_is_exact(value), "mismatch accepted")

    @case("06 execution eligibility fails")
    def _() -> None:
        value = dict(record["artifact"]); value["execution_eligible"] = True
        require(not validator.artifact_is_exact(value), "eligible artifact accepted")

    @case("07 minimal correction passes")
    def _() -> None:
        require(validator.correction_is_minimal(record["correction"]), "correction rejected")

    @case("08 content path fails")
    def _() -> None:
        value = dict(record["correction"]); value["content_path"] = "/data/content"
        require(not validator.correction_is_minimal(value), "content path accepted")

    @case("09 menu enable fails")
    def _() -> None:
        value = dict(record["correction"]); value["have_menu"] = True
        require(not validator.correction_is_minimal(value), "menu accepted")

    @case("10 argc one fails")
    def _() -> None:
        value = dict(record["correction"]); value["modeled_argc"] = 1
        require(not validator.correction_is_minimal(value), "argc one accepted")

    @case("11 exact H protocol passes")
    def _() -> None:
        require(validator.protocol_is_fail_closed(record["result_protocol"]), "protocol rejected")

    @case("12 F magic fails")
    def _() -> None:
        value = dict(record["result_protocol"]); value["magic"] = "CHD10F01"
        require(not validator.protocol_is_fail_closed(value), "F magic accepted")

    @case("13 ungated protocol activation fails")
    def _() -> None:
        value = dict(record["result_protocol"]); value["protocol_activation_authorized"] = True
        require(not validator.protocol_is_fail_closed(value), "active tracked protocol accepted")

    @case("14 retry fails")
    def _() -> None:
        value = dict(record["result_protocol"]); value["target_write_retry"] = True
        require(not validator.protocol_is_fail_closed(value), "retry accepted")

    @case("15 ELF matches Phase F")
    def _() -> None:
        require(validator.elf_matches_phase10f(record["elf"], phase10f), "ELF rejected")

    @case("16 RWX fails")
    def _() -> None:
        value = dict(record["elf"]); value["rwx_load_segment_count"] = 1
        require(not validator.elf_matches_phase10f(value, phase10f), "RWX accepted")

    @case("17 new DT_NEEDED fails")
    def _() -> None:
        value = dict(record["elf"]); value["dt_needed"] = list(value["dt_needed"]) + ["unexpected.sprx"]
        require(not validator.elf_matches_phase10f(value, phase10f), "module accepted")

    @case("18 Phase G authority is consumed")
    def _() -> None:
        require(record["prior_evidence"]["authorization_consumed"] is True and record["prior_evidence"]["authority_inherited"] is False, "authority inherited")

    @case("19 host result is not hardware evidence")
    def _() -> None:
        require(record["tests"]["hardware_evidence_from_phase10h"] is False, "host evidence promoted")

    @case("20 inactive approval grants nothing")
    def _() -> None:
        text = (root / "docs/approvals/phase-1.0h-device-test-template.md").read_text(encoding="utf-8")
        require("ps5_connection_authorized=false" in text and "result_receive_authorized=false" in text, "template authorizes action")

    @case("21 no target artifact is tracked")
    def _() -> None:
        tracked = validator.git(root, "ls-files").splitlines()
        require(not any(path.lower().endswith((".elf", ".self", ".sprx", ".pkg", ".map")) for path in tracked), "artifact tracked")

    @case("22 normalized disassembly is reproducible")
    def _() -> None:
        require(record["elf"]["normalized_disassembly_sha256"] == [validator.DISASSEMBLY_SHA256] * 2, "disassembly differs")

    failures: list[str] = []
    for name, function in cases:
        try:
            function(); print(f"PASS {name}")
        except Exception as error:  # noqa: BLE001 - mutation harness
            failures.append(f"{name}: {error}"); print(f"FAIL {name}: {error}")
    if failures:
        return 1
    print(f"Phase-1.0H policy tests passed: {len(cases)}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())