# tests/test_headers_emit.py
"""headers_scan.py --emit json — maps missing_headers strings to contract JSON. headers is IMPRECISE
(precision depends on aiming it at the real header-config file) → level=warning (never blocks raw)."""
import json, os, subprocess

ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
HDR = os.path.join(ROOT, "domains", "security", "detectors", "headers", "headers_scan.py")
CELLS = os.path.join(ROOT, "domains", "security", "detectors", "headers", "cells")

def _emit(f):
    p = subprocess.run(["python3", HDR, "--emit", "json", f], capture_output=True, text=True, timeout=60)
    return json.loads(p.stdout)

def test_red_missing_headers_emit_warnings():
    out = _emit(os.path.join(CELLS, "headers_vuln.ts"))
    assert out["detector"] == "headers"
    assert out["findings"], f"vuln config must emit missing-header findings; got {out}"
    assert all(f["level"] == "warning" and f["class"] == "S11" for f in out["findings"])
    assert any("missing security response header" in f["symbol"].lower() for f in out["findings"])

def test_green_all_headers_present_emit_empty():
    out = _emit(os.path.join(CELLS, "headers_safe.ts"))
    assert out["findings"] == [], f"safe config must emit nothing; got {out}"