from src.domain.project_auth.auth_contract import authz_policy_fingerprint


def test_authz_policy_fingerprint_is_stable_and_order_sensitive_only_semantically() -> None:
    first = {
        "roles": [{"name": "admin", "permissions": ["project.read", "project.write"]}],
        "audiences": ["staff", "customer"],
    }
    reordered = {
        "audiences": ["staff", "customer"],
        "roles": [{"permissions": ["project.read", "project.write"], "name": "admin"}],
    }
    changed = {
        **first,
        "roles": [{"name": "admin", "permissions": ["project.read"]}],
    }
    assert authz_policy_fingerprint(first) == authz_policy_fingerprint(reordered)
    assert authz_policy_fingerprint(first) != authz_policy_fingerprint(changed)