"""Computed production evidence; catalog lifecycle fields remain untouched."""

from __future__ import annotations

from enum import StrEnum
from pydantic import BaseModel, ConfigDict, Field


class EvidenceState(StrEnum):
    APPLICABLE = "applicable"
    NOT_APPLICABLE = "not_applicable"
    PROVEN = "proven"
    MISSING = "missing"
    DEFERRED = "deferred"


class EvidenceResult(BaseModel):
    model_config = ConfigDict(extra="forbid", frozen=True)

    dimension: str
    state: EvidenceState
    source: str | None = None
    detail: str | None = None


class CapabilityProductionEvidence(BaseModel):
    model_config = ConfigDict(extra="forbid", frozen=True)

    capability_id: str
    contract_version: str
    results: tuple[EvidenceResult, ...] = ()

    @property
    def status(self) -> str:
        states = {result.state for result in self.results}
        if EvidenceState.MISSING in states:
            return "capability_gap"
        if EvidenceState.DEFERRED in states:
            return "deferred"
        return "production_ready"


class ProjectCapabilityReadiness(BaseModel):
    model_config = ConfigDict(extra="forbid", frozen=True)

    project_id: str
    capability_id: str
    production_status: str
    configuration_status: str = "ready"
    gaps: tuple[str, ...] = ()

    @property
    def status(self) -> str:
        if self.production_status != "production_ready":
            return "capability_gap"
        return "ready" if self.configuration_status == "ready" and not self.gaps else "configuration_required"


def production_status_for(results: list[EvidenceResult]) -> str:
    """Compute status from evidence; there is intentionally no writable flag."""

    return CapabilityProductionEvidence(
        capability_id="_evaluation",
        contract_version="1",
        results=tuple(results),
    ).status


def auth_production_evidence(
    *,
    capability_id: str = "auth",
    contract_version: str = "auth.v1",
    contract_present: bool,
    cloud_projection_matches: bool,
    sdk_operations_available: bool,
    authorization_proven: bool,
    isolation_proven: bool,
    failure_semantics_proven: bool,
    conformance_tests_passed: bool,
    reconciliation_strategy_defined: bool,
) -> CapabilityProductionEvidence:
    """Build auth evidence from checks; no caller can set production-ready."""

    checks = {
        "semantic_contract": contract_present,
        "cloud_implementation": cloud_projection_matches,
        "sdk_operation": sdk_operations_available,
        "authorization": authorization_proven,
        "project_isolation": isolation_proven,
        "failure_semantics": failure_semantics_proven,
        "conformance_tests": conformance_tests_passed,
        "reconciliation_strategy": reconciliation_strategy_defined,
    }
    return CapabilityProductionEvidence(
        capability_id=capability_id,
        contract_version=contract_version,
        results=tuple(
            EvidenceResult(
                dimension=dimension,
                state=EvidenceState.PROVEN if passed else EvidenceState.MISSING,
                source="phase4_auth_conformance",
            )
            for dimension, passed in checks.items()
        ),
    )