import pytest

from src.domain.project_auth.migration_boundary import (
    LEGACY_SOURCE_BOUNDARY_UNAVAILABLE,
    authorize_current_head_boundary,
)


def test_legacy_boundary_starts_authority_at_verified_current_head():
    boundary = authorize_current_head_boundary(
        repository="P2HS/golden",
        branch="main",
        current_source_sha="abc123",
        managed_runtime_fingerprint="sha256:runtime",
        semantic_fingerprint="sha256:semantic",
        binding_fingerprint="sha256:binding",
        dependency_fingerprint="sha256:dependencies",
        lockfile_status="certified_migration_metadata",
        ownership_evidence="P2HS_MANAGED_UNMODIFIED",
    )

    assert boundary.historical_boundary_status == LEGACY_SOURCE_BOUNDARY_UNAVAILABLE
    assert boundary.current_source_sha == "abc123"


def test_current_head_boundary_rejects_unproven_runtime():
    with pytest.raises(ValueError, match="unmodified_managed_runtime"):
        authorize_current_head_boundary(
            repository="P2HS/golden",
            branch="main",
            current_source_sha="abc123",
            managed_runtime_fingerprint="sha256:runtime",
            semantic_fingerprint="sha256:semantic",
            binding_fingerprint="sha256:binding",
            dependency_fingerprint="sha256:dependencies",
            lockfile_status="certified_migration_metadata",
            ownership_evidence="UNRESOLVED",
        )