"""token_expiry.py on synthetic JWTs (NK-WP-0058-T05): only the expiry is printed."""
import base64
import datetime as dt
import importlib.util
import json
from pathlib import Path

REPO = Path(__file__).resolve().parents[3]
spec = importlib.util.spec_from_file_location('token_expiry', REPO / 'tools/agent-status/token_expiry.py')
te = importlib.util.module_from_spec(spec)
spec.loader.exec_module(te)


def jwt(exp):
    enc = lambda d: base64.urlsafe_b64encode(json.dumps(d).encode()).decode().rstrip('=')
    return f"{enc({'alg': 'RS256'})}.{enc({'exp': exp, 'sub': 'synthetic'})}.c2lnbmF0dXJl"


def test_prints_expiry_only(tmp_path, capsys):
    exp = int((dt.datetime.now(dt.timezone.utc) + dt.timedelta(hours=12)).timestamp())
    token = tmp_path / 't'
    token.write_text(jwt(exp) + '\n')
    assert te.main([str(token)]) == 0
    out = capsys.readouterr().out
    assert out.startswith('agent-status-token: valid until ')
    assert '(12.0 h)' in out or '(11.9 h)' in out
    assert jwt(exp) not in out and 'synthetic' not in out


def test_expired_missing_and_malformed_fail(tmp_path, capsys):
    old = tmp_path / 'old'
    old.write_text(jwt(int(dt.datetime(2020, 1, 1, tzinfo=dt.timezone.utc).timestamp())))
    assert te.main([str(old)]) == 1
    bad = tmp_path / 'bad'
    bad.write_text('not-a-token')
    assert te.main([str(bad)]) == 1
    assert te.main([str(tmp_path / 'absent')]) == 1
    assert 'not-a-token' not in capsys.readouterr().out