"""Real wrapping semantics in a disposable local OpenBao, not estate authority."""
import json
import re

from secrets_engine.openbao import OpenBaoClient
from tests.test_integration_bao import bao_dev, pytestmark  # noqa: F401


def test_native_wrap_path_ttl_and_one_time_unwrap(bao_dev):
    written=bao_dev._run(['kv','put','-format=json','secret/d3-wrap-fixture',
                          'marker=synthetic-wrapped-integration-value'])
    assert written.returncode==0
    wrapped=bao_dev.wrap_kv_get('secret','d3-wrap-fixture',ttl='60s')
    assert wrapped.creation_path=='secret/data/d3-wrap-fixture'
    assert wrapped.ttl=='60'
    assert wrapped.wrap_token not in repr(wrapped) and wrapped.wrap_token not in json.dumps(wrapped.evidence())
    recipient=OpenBaoClient(addr=bao_dev.addr,token=wrapped.wrap_token,bao_bin=bao_dev.bao_bin)
    first=recipient._run(['unwrap','-format=json'])
    assert first.returncode==0
    assert json.loads(first.stdout)['data']['data']['marker']=='synthetic-wrapped-integration-value'
    replay=recipient._run(['unwrap','-format=json'])
    assert replay.returncode==2 and not replay.stdout.strip()
    assert re.search(r'Code:\s*400\b',replay.stderr)
    assert '* wrapping token is not valid or does not exist' in replay.stderr