import importlib.util
from pathlib import Path
import unittest
from unittest.mock import patch
from urllib.error import HTTPError

SCRIPT = Path(__file__).resolve().parents[1] / "skills" / "updating-gitea-repositories" / "scripts" / "credential_probe.py"
spec = importlib.util.spec_from_file_location("credential_probe", SCRIPT)
credential_probe = importlib.util.module_from_spec(spec)
spec.loader.exec_module(credential_probe)


class ProbeTests(unittest.TestCase):
    def test_rejects_different_or_credential_bearing_remote(self):
        for remote in ("https://other.invalid/a/b.git", "https://user:fake-secret@gitea.invalid/a/b.git", "https://gitea.invalid/a/b.git?token=fake-secret"):
            with self.subTest(case=remote.split("@")[0]):
                with self.assertRaises(credential_probe.ProbeError):
                    credential_probe.git_read_url("https://gitea.invalid", remote)

    def test_redirect_is_not_followed(self):
        handler = credential_probe.NoRedirect()
        self.assertIsNone(handler.redirect_request(None, None, 302, "", {}, "https://other.invalid"))

    def test_unauthorized_is_reported_without_credentials(self):
        class RejectingOpener:
            def open(self, request, timeout):
                raise HTTPError(request.full_url, 401, "unauthorized", {}, None)
        result = credential_probe.check_requests("https://gitea.invalid", "fictional-alice", b"fictional-secret", "https://gitea.invalid/team/repo.git", RejectingOpener())
        self.assertEqual(result, ("http_401", "http_401"))
        self.assertNotIn("fictional-secret", str(result))

    def test_different_account_is_rejected_before_network(self):
        class Helper:
            def get(self, request):
                return {"username": b"different", "password": b"fictional-secret"}
        with self.assertRaises(credential_probe.ProbeError):
            credential_probe.load_credential("https://gitea.invalid", "fictional-alice", Helper())


if __name__ == "__main__":
    unittest.main()