*** Settings ***
Documentation    Smoke tests for read-only action enforcement across all layers
Resource         ${CURDIR}/common.resource
Suite Setup      Setup Test Environment
Suite Teardown   Cleanup Test Environment

*** Variables ***
${HELPER}    ${CURDIR}/helper_security_readonly.py

*** Test Cases ***
ToolRuntime Blocks Write Tool On ReadOnly Plan
    [Documentation]    Verify ToolRuntime._enforce_capabilities raises ToolAccessDeniedError
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    runtime-blocks-write    cwd=${WORKSPACE}
    Log    ${result.stdout}
    Log    ${result.stderr}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    runtime-blocks-write-ok

ToolRuntime Allows ReadOnly Tool On ReadOnly Plan
    [Documentation]    Verify ToolRuntime allows read-only tools under a read-only plan
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    runtime-allows-readonly    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    runtime-allows-readonly-ok

SkillContext WriteGuard Blocks Write
    [Documentation]    Verify SkillContext.enforce_write_guard raises on read-only
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    skillctx-blocks-write    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    skillctx-blocks-write-ok

ChangeSet ReadOnly Rejects Write Tool
    [Documentation]    Verify ChangeSetCapture raises ReadOnlyViolationError for write tools
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    changeset-rejects-write    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    changeset-rejects-write-ok

ChangeSet ReadOnly Passes ReadOnly Tool
    [Documentation]    Verify ChangeSetCapture passes read-only tools through unchanged
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    changeset-passes-readonly    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    changeset-passes-readonly-ok

Error Message Contains Tool Name
    [Documentation]    Verify that access-denied errors include the tool name
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    error-contains-toolname    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    error-contains-toolname-ok