import io
import json
import unittest
from unittest.mock import patch

from user_engine.adapters.provisioning import HTTPIdentityProvisioningAdapter
from user_engine.ports import ProvisioningRequest


class Response(io.BytesIO):
    def __enter__(self): return self
    def __exit__(self, *args): return None


class ProvisioningAdapterTests(unittest.TestCase):
    @patch("user_engine.adapters.provisioning.urlopen")
    def test_provision_transports_idempotency_without_provider_leakage(self, opener):
        opener.return_value = Response(json.dumps({
            "provider": "netkingdom-lldap",
            "external_subject": "person-1",
            "status": "password_setup_required",
            "resumed": True,
        }).encode())
        adapter = HTTPIdentityProvisioningAdapter(
            base_url="http://provisioner", bearer_token="secret"
        )
        result = adapter.provision(ProvisioningRequest(
            user_id="person-1",
            tenant="tenant:friendly:binky",
            primary_email="person@example.test",
            display_name="Person",
            idempotency_key="idem-1234567890123456",
            correlation_id="corr-1",
        ))
        self.assertTrue(result.resumed)
        request = opener.call_args.args[0]
        self.assertEqual("Bearer secret", request.headers["Authorization"])
        self.assertIn(b"idem-1234567890123456", request.data)