feat: prepare ARR for controlled public deployment

tests/test_company_reports_publishing.py

@@ -0,0 +1,140 @@
+from __future__ import annotations
+
+import json
+import tempfile
+import unittest
+from datetime import date
+from pathlib import Path
+from typing import Optional
+
+from company_reports.contracts import BatchSnapshot, ErrorCode
+from company_reports.core import build_company_report
+from company_reports.publishing import (
+    AtomicReportPublisher,
+    BuiltWorkbook,
+    PublicationError,
+    sha256_file,
+)
+from company_reports.repository import FileMetadata, RepositoryError, ReservedReport
+
+
+class FakeRepository:
+    def __init__(self, fail_activation: bool = False):
+        self.fail_activation = fail_activation
+        self.activated: Optional[tuple] = None
+        self.failed: Optional[tuple] = None
+
+    def activate_report(
+        self,
+        reservation: ReservedReport,
+        artifact: FileMetadata,
+        result_json: FileMetadata,
+    ) -> None:
+        if self.fail_activation:
+            raise RepositoryError(ErrorCode.PUBLISH_FAILED, "synthetic activation failed")
+        self.activated = (reservation, artifact, result_json)
+
+    def mark_failed(
+        self,
+        reservation: ReservedReport,
+        code: str,
+        safe_message: str,
+    ) -> None:
+        self.failed = (reservation, code, safe_message)
+
+
+def empty_report():
+    return build_company_report(
+        "HanaTour",
+        2026,
+        7,
+        date(2026, 7, 10),
+        BatchSnapshot((), (), (), {}),
+    )
+
+
+class CompanyReportPublishingTests(unittest.TestCase):
+    def test_publish_archives_prior_current_and_activates_new_version(self):
+        with tempfile.TemporaryDirectory(prefix="company-report-publish-test-") as temp_dir:
+            project_root = Path(temp_dir) / "project"
+            output_root = project_root / "outputs" / "company_reports"
+            work_dir = project_root / "staging"
+            project_root.mkdir(parents=True)
+            work_dir.mkdir()
+            report = empty_report()
+            month_root = output_root / "2026" / "07"
+            month_root.mkdir(parents=True)
+            current = month_root / report.filename
+            current.write_bytes(b"synthetic-old-workbook")
+            built_path = work_dir / report.filename
+            built_path.write_bytes(b"synthetic-new-workbook")
+            built = BuiltWorkbook(
+                path=built_path,
+                sha256=sha256_file(built_path),
+                byte_size=built_path.stat().st_size,
+                summary={},
+            )
+            reservation = ReservedReport(44, 2, report.company)
+            repository = FakeRepository()
+            publisher = AtomicReportPublisher(project_root, output_root)
+
+            outcome = publisher.publish(
+                report, reservation, built, repository, work_dir
+            )
+
+            self.assertEqual(current.read_bytes(), b"synthetic-new-workbook")
+            self.assertEqual(outcome.archive_path.read_bytes(), b"synthetic-new-workbook")
+            legacy = list((month_root / "archive" / "legacy").rglob(report.filename))
+            self.assertEqual(len(legacy), 1)
+            self.assertEqual(legacy[0].read_bytes(), b"synthetic-old-workbook")
+            self.assertEqual(current.stat().st_mode & 0o777, 0o600)
+            result = json.loads(outcome.result_path.read_text(encoding="utf-8"))
+            self.assertEqual(result["status"], "success")
+            self.assertEqual(result["row_count"], 0)
+            self.assertNotIn("group_code", outcome.result_path.read_text(encoding="utf-8").lower())
+            self.assertIsNotNone(repository.activated)
+            artifact = repository.activated[1]
+            self.assertEqual(
+                artifact.storage_key,
+                "outputs/company_reports/2026/07/archive/v0002/HanaTour-July-2026.xlsx",
+            )
+            self.assertIsNone(repository.failed)
+
+    def test_activation_failure_restores_prior_current_and_removes_new_version_files(self):
+        with tempfile.TemporaryDirectory(prefix="company-report-publish-test-") as temp_dir:
+            project_root = Path(temp_dir) / "project"
+            output_root = project_root / "outputs" / "company_reports"
+            work_dir = project_root / "staging"
+            project_root.mkdir(parents=True)
+            work_dir.mkdir()
+            report = empty_report()
+            month_root = output_root / "2026" / "07"
+            month_root.mkdir(parents=True)
+            current = month_root / report.filename
+            current.write_bytes(b"synthetic-old-workbook")
+            built_path = work_dir / report.filename
+            built_path.write_bytes(b"synthetic-new-workbook")
+            built = BuiltWorkbook(
+                path=built_path,
+                sha256=sha256_file(built_path),
+                byte_size=built_path.stat().st_size,
+                summary={},
+            )
+            reservation = ReservedReport(45, 3, report.company)
+            repository = FakeRepository(fail_activation=True)
+            publisher = AtomicReportPublisher(project_root, output_root)
+
+            with self.assertRaises(PublicationError) as caught:
+                publisher.publish(report, reservation, built, repository, work_dir)
+
+            self.assertEqual(caught.exception.code, ErrorCode.PUBLISH_FAILED)
+            self.assertEqual(current.read_bytes(), b"synthetic-old-workbook")
+            version_root = month_root / "archive" / "v0003"
+            self.assertFalse((version_root / report.filename).exists())
+            self.assertFalse((version_root / "HanaTour-v0003.result.json").exists())
+            self.assertEqual(repository.failed[0], reservation)
+            self.assertEqual(repository.failed[1], ErrorCode.PUBLISH_FAILED)
+
+
+if __name__ == "__main__":
+    unittest.main()