from __future__ import annotations

import json
import unittest

from ops_hub.extension_contract import (
    CONTRACT_ID,
    CONTRACT_VERSION,
    PACKAGE_PATH,
    REUSE_SURFACE_ID,
    find_secret_violations,
    load_extension_package,
    package_sha256,
    validate_owner_invariants,
    validation_receipt,
)


class ExtensionContractTests(unittest.TestCase):
    def test_owner_package_is_valid_and_versioned(self) -> None:
        package = load_extension_package()
        validate_owner_invariants(package)
        self.assertEqual(package["descriptor"]["contract_id"], CONTRACT_ID)
        self.assertEqual(package["descriptor"]["contract_version"], CONTRACT_VERSION)
        self.assertEqual(package["manifest"]["reuse_surface_id"], REUSE_SURFACE_ID)

    def test_package_is_canonical_json_and_receipt_is_non_secret(self) -> None:
        package = load_extension_package()
        self.assertEqual(package, json.loads(PACKAGE_PATH.read_text(encoding="utf-8")))
        receipt = validation_receipt()
        self.assertTrue(receipt["ok"])
        self.assertEqual(len(package_sha256()), 64)
        self.assertEqual(receipt["secret_violations"], [])

    def test_secret_detection_reports_paths_without_values(self) -> None:
        value = {
            "nested": {"api_token": "do-not-return"},
            "database": "postgresql://runtime:do-not-return@example.invalid/hub",
        }
        self.assertEqual(find_secret_violations(value), ["$.nested.api_token", "$.database"])

    def test_service_catalog_handoff_and_event_boundary_are_declared(self) -> None:
        manifest = load_extension_package()["manifest"]
        self.assertIn("capability.operations.service-catalog", manifest["provides"])
        self.assertEqual(manifest["events_emitted"], ["ops.endpoint.verified"])
        self.assertEqual(manifest["events_consumed"], ["hub.progress.recorded"])
        self.assertIn("port.events.interaction", manifest["consumes"])


if __name__ == "__main__":
    unittest.main()