from __future__ import annotations

import json
from pathlib import Path
import tempfile
import unittest

from govoplan_ops.backend.infrastructure import deployment_capability_status


class InfrastructureCapabilityTests(unittest.TestCase):
    def test_reads_bounded_non_secret_capability_receipt(self) -> None:
        with tempfile.TemporaryDirectory(prefix="govoplan-ops-capabilities-") as root:
            path = Path(root) / "capabilities.json"
            path.write_text(
                json.dumps(
                    {
                        "schema_version": 1,
                        "installation_id": "govoplan-test",
                        "profile": "evaluation",
                        "capabilities": [
                            {
                                "id": "mail.smtp",
                                "label": "SMTP delivery",
                                "state": "available_unconfigured",
                                "source": "operator-supplied",
                                "detail": "Mail needs a profile.",
                                "endpoint": {},
                                "secret_refs": ["env:SMTP_CREDENTIAL_REF"],
                                "dependent_modules": ["mail"],
                            }
                        ],
                        "post_install_tasks": [
                            {
                                "id": "mail.smtp-profile",
                                "resume_key": "govoplan-test:mail.smtp-profile:v1",
                                "capability_id": "mail.smtp",
                                "state": "pending",
                                "owner_module": "mail",
                                "summary": "Configure Mail.",
                                "required_inputs": ["credential envelope reference"],
                                "secret_boundary": "credential-envelope-reference-only",
                            }
                        ],
                    }
                ),
                encoding="utf-8",
            )

            result = deployment_capability_status(path)

        self.assertTrue(result["available"])
        self.assertEqual("mail.smtp", result["capabilities"][0]["id"])
        self.assertEqual("mail.smtp-profile", result["post_install_tasks"][0]["id"])

    def test_rejects_inline_secret_instead_of_reference(self) -> None:
        with tempfile.TemporaryDirectory(prefix="govoplan-ops-capabilities-") as root:
            path = Path(root) / "capabilities.json"
            path.write_text(
                json.dumps(
                    {
                        "schema_version": 1,
                        "installation_id": "govoplan-test",
                        "profile": "evaluation",
                        "capabilities": [
                            {
                                "id": "mail.smtp",
                                "label": "SMTP delivery",
                                "state": "configured",
                                "source": "operator-supplied",
                                "detail": "Configured.",
                                "endpoint": {},
                                "secret_refs": ["plaintext-secret"],
                                "dependent_modules": [],
                            }
                        ],
                        "post_install_tasks": [],
                    }
                ),
                encoding="utf-8",
            )

            result = deployment_capability_status(path)

        self.assertFalse(result["available"])
        self.assertIn("environment references", str(result["error"]))


if __name__ == "__main__":
    unittest.main()