import pathlib
import sys
import unittest

sys.path.insert(0, str(pathlib.Path(__file__).parents[1]))
from provisioner import (
    _directory_username,
    _oidc_subject,
    _username,
    dispatch,
    DriftResult,
    LLDAPProvisioner,
    Result,
)


class Fake:
    def provision(self, payload): return Result("p", "u", "password_setup_required", False)
    def suspend(self, subject): return Result("p", subject, "suspended", False)
    def reactivate(self, subject): return Result("p", subject, "active", False)
    def deprovision(self, subject): return Result("p", subject, "deprovisioned", False)
    def drift(self, payload): return DriftResult("p", payload["external_subject"], "drifted", ("group:missing:t:users",))
    def reconcile(self, payload): return DriftResult("p", payload["external_subject"], "reconciled", (), ("group:added:t:users",))


class ProvisionerTests(unittest.TestCase):
    def test_username_is_stable_and_sanitized(self):
        self.assertEqual("bernd.worsch", _username("Bernd.Worsch@binky-hedgehog.com"))

    def test_oidc_subject_is_canonical_ldap_dn(self):
        self.assertEqual(
            "uid=bernd.worsch,ou=people,dc=netkingdom,dc=local",
            _oidc_subject("bernd.worsch"),
        )

    def test_directory_lifecycle_normalizes_canonical_ldap_dn(self):
        subject = "uid=bernd.worsch,ou=people,dc=netkingdom,dc=local"
        self.assertEqual("bernd.worsch", _directory_username(subject))
        self.assertEqual("bernd.worsch", _directory_username("bernd.worsch"))

    def test_preferred_username_is_honored_and_validated(self):
        self.assertEqual("chosen.name", _username("other@example.test", "Chosen.Name"))
        with self.assertRaisesRegex(ValueError, "invalid"):
            _username("other@example.test", "not allowed!")
        with self.assertRaisesRegex(ValueError, "reserved"):
            _username("other@example.test", "admin")

    def test_dispatch_requires_idempotency(self):
        with self.assertRaisesRegex(ValueError, "idempotency_key"):
            dispatch(Fake(), "/v1/identities/suspend", {
                "external_subject": "u", "correlation_id": "c"
            })

    def test_lifecycle_dispatch(self):
        result = dispatch(Fake(), "/v1/identities/suspend", {
            "external_subject": "u",
            "idempotency_key": "1234567890123456",
            "correlation_id": "c",
        })
        self.assertEqual("suspended", result.status)

    def test_drift_and_reconcile_dispatch(self):
        payload = {
            "external_subject": "u",
            "tenant": "t",
            "primary_email": "u@example.com",
            "idempotency_key": "1234567890123456",
            "correlation_id": "c",
        }
        drift = dispatch(Fake(), "/v1/identities/drift", payload)
        reconciled = dispatch(Fake(), "/v1/identities/reconcile", payload)
        self.assertEqual("drifted", drift.status)
        self.assertEqual("reconciled", reconciled.status)

    def test_missing_directory_user_is_normalized(self):
        provisioner = LLDAPProvisioner(base_url="http://directory", admin_password="unused")
        provisioner._gql = lambda *_args, **_kwargs: (_ for _ in ()).throw(
            ValueError("User not found")
        )
        self.assertIsNone(provisioner._user("token", "absent"))