"""workflow-script/v1 composite: exact layer order and credential env export.

Script nodes get their CP write credential only through this composite
(the legacy WF-COMP-26 mount is removed), so the layering is load-bearing.
"""
from __future__ import annotations

from pathlib import Path

import yaml

_ROOT = Path(__file__).resolve().parents[2] / "harnesses"


def _load(kind_dir: str, name: str) -> dict:
    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())


def test_workflow_script_layers_shared_variables_cp_service_token_repo_readonly():
    doc = _load("composites", "workflow-script")
    assert doc["layers"] == [
        {"context": "shared-variables/v1"},
        {"context": "cp-service-token/v1"},
        {"context": "repo-readonly/v1"},
    ]


def test_workflow_script_env_exports_cp_service_token_file():
    doc = _load("composites", "workflow-script")
    env: dict = dict(doc.get("env") or {})
    for layer in doc["layers"]:
        (kind, ref), = layer.items()
        name = ref.split("/")[0]
        env.update(_load(kind + "s", name).get("env") or {})
    assert env["CP_SERVICE_TOKEN_FILE"] == "/run/agent/cp-service-token/token"