import base64,importlib.util,json,unittest
from pathlib import Path
import yaml
spec=importlib.util.spec_from_file_location('rollout',Path(__file__).with_name('authentication-policy-rollout.py'))
module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
class PolicyMigration(unittest.TestCase):
    def secret(self):
        raw='''# exact bytes outside reviewed fields must survive
issuer: https://fixture.test
authelia:
  issuer: https://primary.test
clients:
  - clientId: user-engine-portal
    clientType: public
    grantTypes: [authorization_code]
  - clientId: untouched
    mfaRequired: true
    clientSecret: fixture-secret
  - clientId: vergabe-demo-company
    clientType: public
    grantTypes: [authorization_code]
privacyidea:
  requireForAll: true
'''
        return {'data':{'config.yaml':base64.b64encode(raw.encode()).decode(),'key.pem':'fixture-key'}}
    def test_exact_migration_preserves_siblings_and_retries(self):
        secret=self.secret();value,changed=module.replacement(secret);self.assertTrue(changed)
        raw=base64.b64decode(value).decode();self.assertIn('# exact bytes',raw);self.assertIn('    clientSecret: fixture-secret\n',raw)
        config=yaml.safe_load(raw);self.assertTrue(config['privacyidea']['requireForAll'])
        self.assertTrue(config['clients'][0]['mfaOptional']);self.assertTrue(config['clients'][2]['mfaOptional'])
        secret['data']['config.yaml']=value;again,changed=module.replacement(secret);self.assertFalse(changed);self.assertEqual(value,again)
    def test_explicit_or_duplicate_registration_refused(self):
        for edit in [lambda s:s.replace('    clientType: public','    mfaRequired: false\n    clientType: public',1),lambda s:s.replace('clientId: untouched','clientId: user-engine-portal')]:
            secret=self.secret();secret['data']['config.yaml']=base64.b64encode(edit(base64.b64decode(secret['data']['config.yaml']).decode()).encode()).decode()
            with self.assertRaises(module.Refused):module.replacement(secret)