"""Gate for the Authorization v2 provisioning workflow: complete only when backfill is READY
and drift is SAFE. Shadow is entered only on complete, so these cases decide the rollout."""

from src.domain.project_auth.provisioning_v2 import BLOCKED, COMPLETE, decide


def test_ready_and_safe_completes():
    assert decide("READY", (), "SAFE", ()) == (COMPLETE, None)


def test_blocked_backfill_reports_its_reasons():
    status, reason = decide("BLOCKED", ("desired_owner_count_0",), "SAFE", ())
    assert status == BLOCKED
    assert reason == "backfill:desired_owner_count_0"


def test_drift_blocks_even_when_backfill_is_ready():
    status, reason = decide("READY", (), "DRIFT", ("role_changed:a@x.com",))
    assert status == BLOCKED
    assert reason == "drift:role_changed:a@x.com"


def test_blocked_drift_without_reasons_still_reports_the_classification():
    assert decide("READY", (), "BLOCKED", ()) == (BLOCKED, "drift:BLOCKED")