"""Illustrative tenant-scoped policy, exhaustive over its finite 48-case matrix."""
import csv,json
from pathlib import Path
ROLES=['owner','editor','viewer','billing']
ACTIONS=['read','edit','invite','export','billing','delete']
PERMISSIONS={'owner':set(ACTIONS),'editor':{'read','edit'},'viewer':{'read'},'billing':{'read','billing'}}
EXPECTED={'owner':[True]*6,'editor':[True,True,False,False,False,False],'viewer':[True,False,False,False,False,False],'billing':[True,False,False,False,True,False]}
def authorize(role,action,member_tenant,resource_tenant,authenticated=True,active=True):
    if not authenticated:return False,'unauthenticated'
    if not active or not member_tenant or not resource_tenant:return False,'membership or tenant missing'
    if member_tenant!=resource_tenant:return False,'tenant mismatch'
    if role not in PERMISSIONS or action not in ACTIONS:return False,'unknown policy input'
    if action not in PERMISSIONS[role]:return False,'permission absent'
    return True,'explicit permission in matching tenant'
def run():
    rows=[]
    for role in ROLES:
        for same in [True,False]:
            for i,action in enumerate(ACTIONS):
                allowed,reason=authorize(role,action,'tenant-a','tenant-a' if same else 'tenant-b')
                assert allowed==(EXPECTED[role][i] if same else False)
                rows.append(dict(role=role,scope='same tenant' if same else 'other tenant',action=action,allowed=allowed,reason=reason))
    summary=[dict(role=role,allowed=sum(r['allowed'] for r in rows if r['role']==role),denied=sum(not r['allowed'] for r in rows if r['role']==role)) for role in ROLES]
    assert len(rows)==48 and sum(r['allowed'] for r in rows)==11
    assert all(not r['allowed'] for r in rows if r['scope']=='other tenant')
    edges=[]
    for name,args in [('unknown role',('superadmin','read','tenant-a','tenant-a')),('unknown action',('owner','transfer','tenant-a','tenant-a')),('unauthenticated',('owner','read','tenant-a','tenant-a',False)),('missing tenant',('owner','read',None,'tenant-a')),('revoked membership',('owner','read','tenant-a','tenant-a',True,False))]:
        allowed,reason=authorize(*args);assert not allowed;edges.append(dict(case=name,allowed=allowed,reason=reason))
    return dict(scope='Proposed policy with trusted inputs supplied directly. 48 matrix cases plus 5 separate negative inputs. No real identity provider, HTTP route, database filter or penetration test.',rows=rows,summary=summary,edgeCases=edges)
if __name__=='__main__':
    result=run();assert result==run();p=Path(__file__).resolve().parent;(p/'results.json').write_text(json.dumps(result,indent=2)+'\n')
    with (p/'results.csv').open('w',newline='') as f:w=csv.DictWriter(f,fieldnames=result['rows'][0].keys());w.writeheader();w.writerows(result['rows'])
    print(json.dumps(result,indent=2))