import base64
import importlib.util
from pathlib import Path
import unittest
import yaml

spec = importlib.util.spec_from_file_location('vergabe', Path(__file__).with_name('vergabe-client-rollout.py'))
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)


class RegistrationTests(unittest.TestCase):
    def secret(self, clients):
        self.config = {'issuer': 'https://kc.coulomb.social', 'authelia': {'issuer': 'https://auth.coulomb.social'},
                       'clients': clients}
        raw = yaml.safe_dump(self.config, sort_keys=False)
        return {'data': {'config.yaml': base64.b64encode(raw.encode()).decode()}}

    def test_adds_only_exact_public_client_and_is_idempotent(self):
        prior = {'clientId': 'existing', 'clientType': 'public',
                 'redirectUris': ['https://existing.example/callback']}
        secret = self.secret([prior])
        encoded, changed = module.replacement(secret)
        self.assertTrue(changed)
        result = yaml.safe_load(base64.b64decode(encoded))
        self.assertEqual(dict(self.config, clients=[prior, module.CLIENT]), result)
        secret['data']['config.yaml'] = encoded
        self.assertEqual((encoded, False), module.replacement(secret))

    def test_no_existing_client_rewrite_and_new_binary_invalid_fields_refused(self):
        for client in [dict(module.CLIENT, redirectUris=['https://wrong.example/']),
                       {'clientId': 'existing', 'roles': ['operator']}]:
            with self.assertRaises(module.rollout.Refused):
                module.replacement(self.secret([client]))