import unittest
from urllib.parse import parse_qs, urlparse

from user_engine.oidc import BrowserSession, OIDCClient, cookie_value


class OIDCClientTests(unittest.TestCase):
    def setUp(self):
        self.client = OIDCClient(
            issuer="https://kc.example",
            client_id="portal",
            redirect_uri="https://users.example/oidc/callback",
            audience="portal",
        )

    def test_begin_uses_s256_and_one_time_state(self):
        url = urlparse(self.client.begin())
        query = parse_qs(url.query)
        self.assertEqual(["S256"], query["code_challenge_method"])
        self.assertEqual(["portal"], query["client_id"])
        self.assertIn(query["state"][0], self.client.pending)
        self.assertNotIn(self.client.pending[query["state"][0]].verifier, url.query)

    def test_begin_can_forward_a_tenant_hint_without_changing_session_authority(self):
        url = urlparse(self.client.begin(tenant_hint="tenant:friendly:binky"))
        self.assertEqual(
            ["tenant:friendly:binky"], parse_qs(url.query)["tenant_hint"]
        )

    def test_opaque_session_and_cookie_parser(self):
        self.client.sessions["opaque"] = BrowserSession(
            claims={"sub": "person"}, expires_at=9999999999
        )
        self.assertEqual("person", self.client.claims("opaque")["sub"])
        self.assertEqual("", self.client.csrf_token("opaque"))
        self.assertEqual("opaque", cookie_value("x=1; ue_session=opaque", "ue_session"))
        self.client.logout("opaque")
        self.assertIsNone(self.client.claims("opaque"))

    def test_unknown_session_is_rejected(self):
        self.assertIsNone(self.client.claims("not-there"))