#!/usr/bin/env python3
"""Verify the illustrative permission matrix for CFD-READONLY-20260823."""

from __future__ import annotations

import csv
import pathlib
import sys

EXPECTED_FINAL = {
    "pl_actuals": "allowed",
    "budget_v3": "allowed",
    "cost_center_headcount_totals": "allowed",
    "payroll_register": "blocked",
    "vendor_bank_fields": "blocked",
    "mapping_write_synonym": "blocked",
}


def main() -> int:
    path = pathlib.Path(__file__).with_name(
        "permission-matrix-CFD-READONLY-20260823.csv"
    )
    with path.open(newline="", encoding="utf-8") as handle:
        rows = list(csv.DictReader(handle))
    actual = {row["object_name"]: row["final_read_only_role"] for row in rows}
    if actual != EXPECTED_FINAL:
        print("FAIL: final permission matrix does not match the desk log.", file=sys.stderr)
        return 1
    allowed = sum(value == "allowed" for value in actual.values())
    blocked = sum(value == "blocked" for value in actual.values())
    if (allowed, blocked) != (3, 3):
        print("FAIL: expected three allowed and three blocked objects.", file=sys.stderr)
        return 1
    print("OK: permission matrix matches desk log CFD-READONLY-20260823.")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())