from __future__ import annotations

import importlib.util
import json
from pathlib import Path

import pytest

SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "import_repopulse_gitea_token.py"
SPEC = importlib.util.spec_from_file_location("repopulse_import_host", SCRIPT)
assert SPEC is not None and SPEC.loader is not None
host_import = importlib.util.module_from_spec(SPEC)
SPEC.loader.exec_module(host_import)


def test_reads_only_fixed_token_key(tmp_path, monkeypatch):
    path = tmp_path / "deploy.env"
    path.write_text("REPOPULSE_GITEA_URL=https://example.invalid\nREPOPULSE_GITEA_TOKEN=test-value\n")
    path.chmod(0o600)
    monkeypatch.setattr(host_import.os, "geteuid", lambda: 0, raising=False)
    assert host_import.read_legacy_token(path) == "test-value"
    path.write_text("REPOPULSE_GITEA_TOKEN=one\nREPOPULSE_GITEA_TOKEN=two\n")
    with pytest.raises(ValueError, match="duplicated"):
        host_import.read_legacy_token(path)


def test_import_passes_token_only_on_stdin(monkeypatch):
    observed = {}

    def fake_run(argv, *, input, capture_output, check, timeout):
        observed.update({"argv": argv, "input": input, "capture_output": capture_output})

        class Result:
            returncode = 0
            stdout = json.dumps({"status": "imported", "secretRef": "REPOPULSE_GITEA_TOKEN"}).encode()

        return Result()

    monkeypatch.setattr(host_import.subprocess, "run", fake_run)
    assert host_import.import_token("sensitive-test-value") == "imported"
    assert observed["input"] == b"sensitive-test-value"
    assert "sensitive-test-value" not in " ".join(observed["argv"])
    assert observed["capture_output"] is True