"""Synthetic owner-lane checks; run with python3 scripts/test_keycape_client_repair.py."""
import base64
import importlib.util
import json
import unittest
from pathlib import Path

import yaml

spec = importlib.util.spec_from_file_location(
    "csoc_repair", Path(__file__).with_name("keycape-client-repair.py"),
)
adapter = importlib.util.module_from_spec(spec)
spec.loader.exec_module(adapter)


class RepairTests(unittest.TestCase):
    def setUp(self):
        self.rollout = adapter.configure(Path.home() / "net-kingdom/sso-mfa/k8s/keycape")

    def fixture(self, clients):
        raw = ("# keep comment\nauthelia:\n  issuer: https://auth.example.invalid\n"
               "  clientSecret: synthetic-marker\nclients:\n" +
               yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) +
               "tokenLifetime: 15m\n")
        return {"data": {"config.yaml": base64.b64encode(raw.encode()).decode(),
                         "key.pem": "synthetic-key"}}, raw

    def test_insert_preserves_bytes_and_is_idempotent(self):
        secret, raw = self.fixture([{"clientId": "existing", "clientType": "public"}])
        encoded, changed = self.rollout.replacement(secret)
        updated = base64.b64decode(encoded).decode()
        self.assertTrue(changed)
        self.assertTrue(updated.startswith(raw[:raw.index("tokenLifetime:")]))
        self.assertTrue(updated.endswith("tokenLifetime: 15m\n"))
        expected = yaml.safe_load(raw)
        expected["clients"].append(self.rollout.portal.CLIENT)
        self.assertEqual(yaml.safe_load(updated), expected)
        self.assertEqual(secret["data"]["key.pem"], "synthetic-key")
        secret["data"]["config.yaml"] = encoded
        self.assertEqual(self.rollout.replacement(secret), (encoded, False))

    def test_refuses_different_or_duplicate_registration(self):
        client = self.rollout.portal.CLIENT
        for clients in [[dict(client, redirectUris=["https://other.invalid/callback"])],
                        [dict(client, allowedScopes=["openid", "admin"])],
                        [client, client]]:
            with self.subTest(clients=clients), self.assertRaises(self.rollout.Refused):
                self.rollout.replacement(self.fixture(clients)[0])


if __name__ == "__main__":
    unittest.main()