"""load_components must see the root application, not just its dependencies, and must not choke
on a missing "version" key."""
from sec_sbom import load_components


def test_load_components_reads_root_and_every_declared_component(sbom):
    components = load_components(sbom)

    assert len(components) == 7, (
        f"expected the root application plus 6 declared components (7 total), got {len(components)}: "
        f"{sorted(components)}"
    )
    root = components["pkg:generic/f1-service@1.0.0"]
    assert root.name == "f1-service" and root.version == "1.0.0", (
        f"root component must come from sbom['metadata']['component'], got {root!r}"
    )
    auth = components["pkg:pypi/mycorp-auth@0.4.0"]
    assert (auth.name, auth.version) == ("mycorp-auth", "0.4.0"), (
        f"expected name='mycorp-auth' version='0.4.0' for pkg:pypi/mycorp-auth@0.4.0, got {auth!r}"
    )