"""OpenRouter key resolution from OpenBao, then the environment."""

import subprocess
from pathlib import Path

from llm_connect.config import clear_openbao_key_cache, resolve_api_key


def _bao(stdout: str = "", code: int = 0):
    def run(argv, **kwargs):
        return subprocess.CompletedProcess(argv, code, stdout=stdout, stderr="")

    return run


def test_explicit_key_skips_openbao(monkeypatch) -> None:
    monkeypatch.setattr("llm_connect.config.subprocess.run", _bao("from-bao"))
    clear_openbao_key_cache()
    assert resolve_api_key(explicit="caller-key") == "caller-key"


def test_auto_prefers_openbao_over_the_environment(monkeypatch) -> None:
    monkeypatch.setenv("LLM_CONNECT_KEY_SOURCE", "auto")
    monkeypatch.setenv("OPENROUTER_API_KEY", "from-env")
    monkeypatch.setattr("llm_connect.config.subprocess.run", _bao("from-bao\n"))
    clear_openbao_key_cache()
    assert resolve_api_key() == "from-bao"


def test_denied_openbao_falls_back_to_the_environment(monkeypatch) -> None:
    monkeypatch.setenv("LLM_CONNECT_KEY_SOURCE", "auto")
    monkeypatch.setenv("OPENROUTER_API_KEY", "from-env")
    monkeypatch.setattr("llm_connect.config.subprocess.run", _bao(code=1))
    clear_openbao_key_cache()
    assert resolve_api_key() == "from-env"


def test_openbao_source_ignores_the_environment(monkeypatch) -> None:
    monkeypatch.setenv("LLM_CONNECT_KEY_SOURCE", "openbao")
    monkeypatch.setenv("OPENROUTER_API_KEY", "from-env")
    monkeypatch.setattr("llm_connect.config.subprocess.run", _bao(code=1))
    clear_openbao_key_cache()
    assert resolve_api_key() is None


def test_env_source_does_not_call_openbao(monkeypatch) -> None:
    monkeypatch.setenv("LLM_CONNECT_KEY_SOURCE", "env")
    monkeypatch.setenv("OPENROUTER_API_KEY", "from-env")

    def fail(*args, **kwargs):
        raise AssertionError("bao should not be called")

    monkeypatch.setattr("llm_connect.config.subprocess.run", fail)
    clear_openbao_key_cache()
    assert resolve_api_key() == "from-env"


def test_custom_path_is_tried_before_the_defaults(monkeypatch) -> None:
    seen: list[str] = []

    def run(argv, **kwargs):
        seen.append(argv[-1])
        if argv[-1] == "platform/suppliers/openrouter/custom":
            return subprocess.CompletedProcess(argv, 0, stdout="custom-key\n", stderr="")
        return subprocess.CompletedProcess(argv, 1, stdout="", stderr="")

    monkeypatch.setenv("LLM_CONNECT_KEY_SOURCE", "openbao")
    monkeypatch.setenv("LLM_CONNECT_OPENROUTER_BAO_PATH", "platform/suppliers/openrouter/custom")
    monkeypatch.setattr("llm_connect.config.subprocess.run", run)
    clear_openbao_key_cache()
    assert resolve_api_key() == "custom-key"
    assert seen[0] == "platform/suppliers/openrouter/custom"


def test_key_file_is_used_when_openbao_and_env_are_empty(tmp_path: Path, monkeypatch) -> None:
    key_file = tmp_path / "apikey-openrouter.txt"
    key_file.write_text("file-key\n", encoding="utf-8")
    monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
    monkeypatch.setenv("LLM_CONNECT_KEY_SOURCE", "auto")
    monkeypatch.setattr("llm_connect.config.subprocess.run", _bao(code=1))
    clear_openbao_key_cache()
    assert resolve_api_key(key_file_paths=[key_file]) == "file-key"