#!/usr/bin/env python3
"""Distribution-certificate cap policy and action wiring tests."""
from __future__ import annotations

import os
import sys
import unittest
from contextlib import redirect_stdout
from io import StringIO
from pathlib import Path
from unittest import mock

sys.path.insert(0, str(Path(__file__).resolve().parent))

import cert_factory  # noqa: E402


ACTION_YAML = Path(__file__).resolve().parents[1] / "action.yml"


class CertificateCapPolicyTests(unittest.TestCase):
    def test_invalid_policy_fails_before_provider_call(self):
        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "rotate-all"}, clear=True):
            with mock.patch.object(cert_factory, "request") as request:
                with self.assertRaisesRegex(SystemExit, "invalid CERTIFICATE_CAP_POLICY"):
                    cert_factory.create_distribution_cert("token", "csr")
        request.assert_not_called()

    def test_fail_policy_preserves_every_certificate_on_cap(self):
        response = mock.MagicMock(status_code=409)
        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
            with (mock.patch.object(cert_factory, "request", return_value=response) as request,
                  redirect_stdout(StringIO())):
                with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
                    cert_factory.create_distribution_cert("token", "csr")
        request.assert_called_once()
        self.assertEqual(request.call_args.args[:2], ("POST", "/certificates"))

    def test_default_policy_never_revokes_or_retries_a_full_cap(self):
        capped = mock.MagicMock(status_code=409)
        with mock.patch.dict(os.environ, {}, clear=True):
            with (mock.patch.object(cert_factory, "request", return_value=capped) as request,
                  redirect_stdout(StringIO())):
                with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
                    cert_factory.create_distribution_cert("token", "csr")
        request.assert_called_once()

    def test_historical_destructive_setting_is_refused_before_contacting_apple(self):
        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "revoke-oldest"}, clear=True):
            with mock.patch.object(cert_factory, "request") as request:
                with self.assertRaisesRegex(SystemExit, "Automatic certificate revocation is disabled"):
                    cert_factory.create_distribution_cert("token", "csr")
        request.assert_not_called()


class CertificateCapActionWiringTests(unittest.TestCase):
    def test_action_exposes_policy_and_persists_partial_cache_before_failure(self):
        source = ACTION_YAML.read_text(encoding="utf-8")
        self.assertRegex(
            source,
            r"(?m)^  certificate-cap-policy:\n(?:    .*\n)*?    default: \"fail\"$",
        )
        self.assertIn("CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}", source)
        self.assertIn("SIGNING_PREP_EXIT=$signing_exit", source)
        self.assertIn("env.SIGNING_PREP_EXIT != '0'", source)
        commit_at = source.index("- name: Commit + push staged bot changes")
        failure_at = source.index("- name: Re-raise signing preparation failure")
        self.assertLess(commit_at, failure_at)


if __name__ == "__main__":
    unittest.main()