from __future__ import annotations

import pytest
from sqlmodel import Session, SQLModel, create_engine

from backend.app.db.models import Secret
from backend.app.services import repopulse_target_credential as target


def test_fixed_target_credential_is_durable_and_collision_safe(tmp_path, monkeypatch):
    monkeypatch.setattr(
        target.secret_store,
        "secret_storage_status",
        lambda: {"productionReady": True},
    )
    engine = create_engine(f"sqlite:///{tmp_path / 'credentials.db'}")
    SQLModel.metadata.create_all(engine)
    first_intent = "rpa-" + "a" * 20

    with Session(engine) as session:
        first_id, first_secret = target.get_or_create_repopulse_target_credential(
            session, intent_id=first_intent
        )
        row = session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC")
        assert row is not None
        assert first_secret.decode("ascii") not in row.encrypted_value

    with Session(engine) as session:
        replay_id, replay_secret = target.get_or_create_repopulse_target_credential(
            session, intent_id=first_intent
        )
        assert (replay_id, replay_secret) == (first_id, first_secret)
        with pytest.raises(
            target.RepoPulseTargetCredentialError, match="target_credential_collision"
        ):
            target.get_or_create_repopulse_target_credential(
                session, intent_id="rpa-" + "b" * 20
            )

    with Session(engine) as session:
        row = session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC")
        assert row is not None
        row.metadata_json = {}
        session.add(row)
        session.commit()
        with pytest.raises(
            target.RepoPulseTargetCredentialError, match="target_credential_collision"
        ):
            target.get_or_create_repopulse_target_credential(
                session, intent_id=first_intent
            )


def test_fixed_target_credential_requires_production_secret_store(
    tmp_path, monkeypatch
):
    monkeypatch.setattr(
        target.secret_store,
        "secret_storage_status",
        lambda: {"productionReady": False},
    )
    engine = create_engine(f"sqlite:///{tmp_path / 'credentials.db'}")
    SQLModel.metadata.create_all(engine)
    with Session(engine) as session:
        with pytest.raises(
            target.RepoPulseTargetCredentialError, match="secret_store_not_ready"
        ):
            target.get_or_create_repopulse_target_credential(
                session, intent_id="rpa-" + "a" * 20
            )
        assert session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC") is None