"""The shadow-state script only changes projects the drift report marks SAFE."""

import json
import os
import tempfile

from scripts.authz_v2_set_projection_state import SAFE, _safe_projects


def test_only_safe_projects_are_eligible():
    rows = [
        {"project_id": "a", "classification": SAFE},
        {"project_id": "b", "classification": "DRIFT"},
        {"project_id": "c", "classification": "BLOCKED"},
    ]
    fd, path = tempfile.mkstemp(suffix=".json")
    try:
        with os.fdopen(fd, "w", encoding="utf-8") as fh:
            json.dump(rows, fh)
        assert _safe_projects(path) == {"a"}
    finally:
        os.remove(path)