"""A11: whole-tree audit_log single-writer scan assertion.

Extends the pre-existing ``NoAuditBypassTestCase`` in
``test_audit_automations_chain.py`` (which only scanned
``cloud/*.py`` at the top level) to the whole tree: every
``.py`` file under the repository root is scanned for a
direct audit_log insert code form, except the test fixtures
themselves.

Scope and exclusions, stated so a future red test is readable:

- Production code: exactly one hit is allowed, ``cloud/auth.py``
  (``audit_on_conn``, the unified port; ``AuthStore.audit`` is
  that function plus a commit/retry wrapper, not a second write
  path). Any new production hit -- any module, any subdirectory
  (``cloud/skills/...``, ``tools/``, ``deploy/``, ``host.py``,
  top level) -- turns this test red.
- Test fixtures excluded: ``cloud/tests/test_tamper_ledger.py``
  (tamper simulation) and ``cloud/tests/test_chat_history.py``
  (legacy-row simulation) deliberately insert audit_log rows
  into throwaway databases, and
  ``cloud/tests/test_automation_run_due.py`` (a fake PG
  connection whose ``execute`` matches intercepted audit_log
  SQL strings and records params in memory -- it executes no
  SQL at all). They are fixtures, not production writes, and
  were already documented as out of scope by the pre-existing
  test. They are listed by name here, not by a broad ``tests/``
  exclusion, so a new test file that starts writing audit_log
  directly would still turn this red.
- No pending production direct-write points were found at the
  time this test was added (2026-11-02): the full-tree scan
  returned only ``cloud/auth.py`` in production code. If a
  future scan finds one, do NOT silently fix production code
  under this test's name and do NOT land a red test: record
  the point in the delivery report and route the fix to its
  own batch.
"""

import re
import unittest
from pathlib import Path

_PATTERN = re.compile(r"INSERT\s+INTO\s+audit_log", re.IGNORECASE)
# Fixture files that deliberately insert audit_log rows into
# throwaway test databases (see module docstring).
_FIXTURE_FILES = {
    "cloud/tests/test_tamper_ledger.py",
    "cloud/tests/test_chat_history.py",
    "cloud/tests/test_automation_run_due.py",
}


class AuditLogSingleWriterTestCase(unittest.TestCase):
    def test_only_auth_writes_audit_log_tree_wide(self):
        repo_root = Path(__file__).resolve().parents[2]
        offenders = []
        for path in sorted(repo_root.rglob("*.py")):
            rel = path.relative_to(repo_root).as_posix()
            if rel in _FIXTURE_FILES:
                continue
            # Skip nothing else: .git contains no .py files, and
            # a work/host-worktrees checkout (if present) is a
            # separate worktree's copy of the code, not this
            # tree's production code.
            if rel.startswith("work/host-worktrees/"):
                continue
            text = path.read_text(encoding="utf-8", errors="replace")
            if _PATTERN.search(text):
                offenders.append(rel)
        self.assertEqual(offenders, ["cloud/auth.py"])


if __name__ == "__main__":
    unittest.main()