import contextlib
import importlib.util
import io
from pathlib import Path
import unittest
from unittest.mock import patch


SCRIPT = Path(__file__).resolve().parents[1] / "skills" / "updating-gitea-repositories" / "scripts" / "credential_win_oauth.py"
spec = importlib.util.spec_from_file_location("credential_win_oauth_unit_test", SCRIPT)
vault = importlib.util.module_from_spec(spec)
spec.loader.exec_module(vault)


class VaultHelperTest(unittest.TestCase):
    def setUp(self):
        self.namespace = "gitea-oauth-" + "a" * 32
        self.fields = {"protocol": "https", "host": "example.invalid", "username": "oauth2",
                       "password": "fake-access", "password_expiry_utc": "9999999999", "oauth_refresh_token": "fake-refresh"}

    def test_empty_namespace_cannot_get_or_store_unverified_identity(self):
        with patch.object(vault, "credential_lock", return_value=contextlib.nullcontext()), \
             patch.object(vault, "read_record", return_value=None), \
             patch.object(vault, "write_record") as write:
            for operation in ("get", "store"):
                with self.subTest(operation=operation), self.assertRaises(vault.VaultError):
                    vault.run(self.namespace, operation, self.fields, io.BytesIO())
            write.assert_not_called()

    def test_refuses_cross_site_refresh_endpoint_before_sending_token(self):
        with patch.object(vault, "oauth_setting", side_effect=["client", "https://other.invalid/token"]), \
             patch.object(vault, "build_opener") as opener, self.assertRaises(vault.VaultError):
            vault.refresh_record("https", "example.invalid", self.fields)
        opener.assert_not_called()

    def test_missing_context_fails_closed(self):
        with self.assertRaises(vault.VaultError):
            vault.run(self.namespace, "get", {"protocol": "https", "host": "example.invalid"}, io.BytesIO())


if __name__ == "__main__":
    unittest.main()