from unittest.mock import patch

from rein_openweights.credentials import resolve_openrouter_api_key


def test_explicit_env_var_short_circuits(monkeypatch):
    monkeypatch.setenv("OPENROUTER_API_KEY", "sk-explicit")
    assert resolve_openrouter_api_key() == "sk-explicit"


def test_falls_back_to_bao_kv_when_no_approle(monkeypatch, tmp_path):
    monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
    monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path / "missing"))

    with patch("rein_openweights.credentials._bao", return_value="sk-from-vault") as bao:
        key = resolve_openrouter_api_key()

    assert key == "sk-from-vault"
    bao.assert_called_once()
    assert bao.call_args.args[0] == "kv"


def test_approle_lane_exchanges_token_before_kv_read(monkeypatch, tmp_path):
    monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
    role_id = tmp_path / "role_id"
    secret_id = tmp_path / "secret_id"
    role_id.write_text("role-123")
    secret_id.write_text("secret-456")
    monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path))

    calls = []

    def fake_bao(*args, env=None):
        calls.append(args)
        if args[0] == "write":
            return "vault-token"
        return "sk-from-vault"

    with patch("rein_openweights.credentials._bao", side_effect=fake_bao):
        key = resolve_openrouter_api_key()

    assert key == "sk-from-vault"
    assert calls[0][0] == "write"
    assert calls[1][0] == "kv"


def test_returns_none_when_bao_fails(monkeypatch, tmp_path):
    monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
    monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path / "missing"))


def test_uses_standard_approle_directory_by_default(monkeypatch, tmp_path):
    monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
    monkeypatch.delenv("REIN_OPENWEIGHTS_APPROLE_DIR", raising=False)
    role_id = tmp_path / "role_id"
    secret_id = tmp_path / "secret_id"
    role_id.write_text("role-123")
    secret_id.write_text("secret-456")
    monkeypatch.setattr("rein_openweights.credentials._DEFAULT_APPROLE_DIR", tmp_path)

    calls = []

    def fake_bao(*args, env=None):
        calls.append(args)
        return "vault-token" if args[0] == "write" else "sk-from-vault"

    with patch("rein_openweights.credentials._bao", side_effect=fake_bao):
        assert resolve_openrouter_api_key() == "sk-from-vault"

    assert [call[0] for call in calls] == ["write", "kv"]

    from rein_openweights.credentials import CredentialError

    with patch("rein_openweights.credentials._bao", side_effect=CredentialError("boom")):
        assert resolve_openrouter_api_key() is None