"""Read-only DAV metadata parser tests; no provider or credential access."""
import importlib.util
from pathlib import Path
import pytest

ROOT=Path(__file__).resolve().parents[1]
spec=importlib.util.spec_from_file_location('storage_inventory',ROOT/'tools/bootstrap-recovery/inventory-storage-share.py')
module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)


def body(path, kind='file', size='16', origin=''):
    collection='<d:collection/>' if kind=='dir' else ''
    return f'''<d:multistatus xmlns:d="DAV:"><d:response><d:href>{origin}{path}</d:href>
    <d:propstat><d:status>HTTP/1.1 200 OK</d:status><d:prop><d:resourcetype>{collection}</d:resourcetype>
    <d:getcontentlength>{size}</d:getcontentlength></d:prop></d:propstat></d:response></d:multistatus>'''.encode()


def test_only_closed_safe_metadata_is_returned():
    raw=body(module.BASE+'bootstrap.tar.age')
    assert module.parse_listing(raw,'')==[{'name':'bootstrap.tar.age','directory':False,'bytes':16}]


@pytest.mark.parametrize('path,origin',[(module.BASE+'%2e%2e/else.age',''),
    ('/other/account/backup.age',''),(module.BASE+'backup.age','https://unapproved.invalid')])
def test_foreign_and_escaping_references_refuse(path,origin):
    with pytest.raises(module.Refused):module.parse_listing(body(path,origin=origin),'')


def test_non_numeric_size_and_oversized_response_refuse():
    with pytest.raises(module.Refused):module.parse_listing(body(module.BASE+'backup.age',size='not-a-size'),'')
    with pytest.raises(module.Refused):module.parse_listing(b'X'*(module.LIMIT+1),'')


def test_unrecognized_plaintext_files_are_not_exported():
    assert module.parse_listing(body(module.BASE+'private-password.txt'),'')==[]


def test_unrelated_authenticated_role_cannot_read_retrieval_credential(monkeypatch):
    calls=[]
    monkeypatch.setattr(module,'bao',lambda args:calls.append(args) or object())
    monkeypatch.setattr(module,'data',lambda result:{'data':{'policies':['default'],'path':'auth/netkingdom/oidc/callback'}})
    with pytest.raises(module.Refused):module.inventory()
    assert calls==[['token','lookup','-format=json']]