# Author: Sandeep Belgavi
from dataclasses import replace
import unittest
from pattern_10 import Gateway, HealthAdapter, fixture_claims, demo

class GatewayTests(unittest.TestCase):
    def setUp(self): self.provider = HealthAdapter(); self.gateway = Gateway(self.provider)
    def call(self, claims=None, tool='read_health', tenant='team-a', target='worker-7', now=100):
        return self.gateway.call(claims or fixture_claims(), tool, tenant, target, now)
    def denied(self, **kwargs):
        with self.assertRaises(PermissionError): self.call(**kwargs)
        self.assertEqual(self.provider.calls, 0)
    def test_wrong_audience(self): self.denied(claims=replace(fixture_claims(), audience='another-api'))
    def test_wrong_issuer(self): self.denied(claims=replace(fixture_claims(), issuer='untrusted'))
    def test_cross_tenant(self): self.denied(tenant='team-b')
    def test_expired(self): self.denied(now=200)
    def test_missing_scope(self): self.denied(claims=replace(fixture_claims(), scopes=frozenset()))
    def test_write_tool(self): self.denied(tool='restart_worker')
    def test_unbound_actor(self): self.denied(claims=replace(fixture_claims(), actor='another-agent'))
    def test_arbitrary_url(self): self.denied(target='http://internal-metadata/')
    def test_allowed_audit(self):
        self.assertEqual(self.call()['status'], 'degraded')
        self.assertEqual(self.gateway.audit[0]['subject'], 'operator-3')
        self.assertTrue(self.gateway.audit[0]['allowed'])
    def test_demo(self): self.assertEqual(demo(), {'status': 'degraded', 'provider_calls': 1, 'denied': 1})

if __name__ == '__main__': unittest.main()