import copy

import pytest

from secrets_engine.catalog import validate_entry
from secrets_engine.errors import DeliveryError
from secrets_engine.exec_delivery import (
    _npm_userconfig,
    _registry_authkey,
    exec_with_secret,
)
from tests.test_catalog import VALID


def test_registry_authkey_strips_scheme_and_trails_slash():
    assert (
        _registry_authkey("https://forgejo.coulomb.social/api/packages/coulomb/npm/")
        == "//forgejo.coulomb.social/api/packages/coulomb/npm/"
    )
    # missing trailing slash is added
    assert _registry_authkey("https://host/api/npm") == "//host/api/npm/"


def test_npm_userconfig_writes_registry_and_token_ref_not_value():
    registry = "https://forgejo.coulomb.social/api/packages/coulomb/npm/"
    with _npm_userconfig(registry, "@whynot", "NPM_AUTH_TOKEN") as path:
        body = path.read_text()
        assert f"@whynot:registry={registry}" in body
        # token is referenced via env expansion, never written literally
        assert "${NPM_AUTH_TOKEN}" in body
        assert "//forgejo.coulomb.social/api/packages/coulomb/npm/:_authToken" in body
        # file is mode 0600
        assert (path.stat().st_mode & 0o077) == 0
    # cleaned up on context exit
    assert not path.exists()


def test_exec_env_injects_only_selected_declared_field(monkeypatch):
    data = copy.deepcopy(VALID)
    data["fields"] = ["primary", "selected_value"]
    entry = validate_entry(data)

    def fake_fetch(_client, got_entry, field):
        assert got_entry == entry
        assert field == "selected_value"
        return "test-secret-value"

    def fake_spawn(command, env, secret):
        assert command == ["probe"]
        assert secret == "test-secret-value"
        assert env["SELECTED_VALUE"] == "test-secret-value"
        assert "PRIMARY" not in env
        return 0

    monkeypatch.setattr("secrets_engine.exec_delivery._fetch_value", fake_fetch)
    monkeypatch.setattr("secrets_engine.exec_delivery._spawn", fake_spawn)
    assert (
        exec_with_secret(
            object(), entry, "selected_value", ["probe"], mode="exec-env"
        )
        == 0
    )


def test_exec_rejects_undeclared_field_before_fetch(monkeypatch):
    entry = validate_entry(VALID)
    monkeypatch.setattr(
        "secrets_engine.exec_delivery._fetch_value",
        lambda *_args, **_kwargs: pytest.fail("must not fetch undeclared field"),
    )
    with pytest.raises(DeliveryError):
        exec_with_secret(object(), entry, "other_field", ["probe"], mode="exec-env")