"""Local teaching fixture, not an identity service or production authorization layer.
Run: python3 trace-access-boundary.py
Only synthetic data; no network or third-party dependencies.
"""
from dataclasses import dataclass, replace
import unittest

CANARY = "SYNTHETIC-SECRET-DO-NOT-USE"


@dataclass(frozen=True)
class Identity:
    tenant: str
    role: str
    incident: str = ""
    expires: int = 0


class EvidenceStore:
    def __init__(self):
        self.record = {"tenant": "alpha", "incident": "INC-1",
                       "ref": "opaque-demo-reference", "raw": CANARY}
        self.audit = []

    def query(self, identity, surface, reference, now):
        # In production identity must come from a verified server-side session.
        same_record = (identity.tenant == self.record["tenant"]
                       and reference == self.record["ref"])
        if surface in {"trace_search", "export"}:
            allowed = same_record and identity.role in {"debugger", "incident"}
            result = {"message": "credential rejected", "ref": reference}
        elif surface == "raw":
            allowed = (same_record and identity.role == "incident"
                       and identity.incident == self.record["incident"]
                       and now < identity.expires)
            result = {"raw": self.record["raw"]}
        else:
            allowed = False
            result = {}
        # Do not copy the payload or supplied reference into denial telemetry.
        self.audit.append({"surface": surface, "allowed": allowed})
        if not allowed:
            raise PermissionError("unavailable")
        return result


class BoundaryTests(unittest.TestCase):
    def setUp(self):
        self.store = EvidenceStore()
        self.debugger = Identity("alpha", "debugger")
        self.responder = Identity("alpha", "incident", "INC-1", 200)
        self.ref = self.store.record["ref"]

    def test_debugger_search_and_export_are_sanitized(self):
        for surface in ("trace_search", "export"):
            result = self.store.query(self.debugger, surface, self.ref, 100)
            self.assertEqual(result["ref"], self.ref)
            self.assertNotIn(CANARY, repr(result))

    def test_debugger_cannot_resolve_known_reference(self):
        with self.assertRaises(PermissionError):
            self.store.query(self.debugger, "raw", self.ref, 100)

    def test_active_incident_role_can_read_raw(self):
        result = self.store.query(self.responder, "raw", self.ref, 100)
        self.assertEqual(result["raw"], CANARY)
        self.assertNotIn(CANARY, repr(self.store.audit))

    def test_expired_or_wrong_incident_cannot_read_raw(self):
        for identity in (replace(self.responder, expires=100),
                         replace(self.responder, incident="INC-2")):
            with self.assertRaises(PermissionError):
                self.store.query(identity, "raw", self.ref, 100)

    def test_cross_tenant_denied_on_every_surface(self):
        for surface in ("trace_search", "export", "raw"):
            with self.assertRaises(PermissionError):
                self.store.query(replace(self.responder, tenant="beta"),
                                 surface, self.ref, 100)

    def test_missing_and_forbidden_have_same_public_error(self):
        errors = []
        for ref in (self.ref, "nonexistent"):
            with self.assertRaises(PermissionError) as error:
                self.store.query(self.debugger, "raw", ref, 100)
            errors.append(str(error.exception))
        self.assertEqual(errors, ["unavailable", "unavailable"])


if __name__ == "__main__":
    unittest.main(verbosity=2)