from __future__ import annotations

from pathlib import Path

import httpx

from reyna_cli.gitea_direct import GiteaClient, GiteaCredentials, load_credentials, redact_sensitive


def test_load_credentials_prefers_environment_without_exposing_token(monkeypatch):
    monkeypatch.setenv("REYNA_GITEA_TOKEN", "test-token-value")
    monkeypatch.setenv("REYNA_GITEA_URL", "https://git.example.test/")

    credentials = load_credentials()

    assert credentials.token == "test-token-value"
    assert credentials.source == "REYNA_GITEA_TOKEN"
    assert credentials.public_dict() == {
        "configured": True,
        "host": "git.example.test",
        "source": "REYNA_GITEA_TOKEN",
    }
    assert "token" not in credentials.public_dict()


def test_load_credentials_reads_git_credentials_file(monkeypatch, tmp_path: Path):
    credentials_file = tmp_path / "credentials"
    credentials_file.write_text(
        "https://adolforeyna:stored-secret@git.reynafamily.com\n",
        encoding="utf-8",
    )
    monkeypatch.delenv("REYNA_GITEA_TOKEN", raising=False)
    monkeypatch.delenv("GITEA_TOKEN", raising=False)
    monkeypatch.setenv("GIT_CREDENTIALS_FILE", str(credentials_file))

    credentials = load_credentials()

    assert credentials.username == "adolforeyna"
    assert credentials.token == "stored-secret"
    assert credentials.source == "GIT_CREDENTIALS_FILE"
    assert "stored-secret" not in str(credentials.public_dict())


def test_repo_response_is_redacted_and_requests_authenticated_endpoint():
    requests: list[httpx.Request] = []

    def handler(request: httpx.Request) -> httpx.Response:
        requests.append(request)
        return httpx.Response(
            200,
            json={
                "full_name": "adolforeyna/reyna-cli",
                "permissions": {"push": True},
                "token": "response-secret",
            },
        )

    client = GiteaClient(
        GiteaCredentials("adolforeyna", "request-secret", "test", "https://git.example.test"),
        transport=httpx.MockTransport(handler),
    )

    result = client.repo("adolforeyna/reyna-cli")

    assert requests[0].url.path == "/api/v1/repos/adolforeyna/reyna-cli"
    assert requests[0].headers["authorization"] == "token request-secret"
    assert result["permissions"]["push"] is True
    assert result["token"] == "[REDACTED]"
    assert "response-secret" not in str(result)


def test_remote_credential_helper_can_make_a_safe_api_request(monkeypatch):
    credentials = GiteaCredentials("", "", "Pi 5 git credential helper", "https://git.example.test")
    assert credentials.public_dict()["configured"] is True
    client = GiteaClient(credentials)
    monkeypatch.setattr(client, "_remote_get", lambda path: {"full_name": "adolforeyna/reyna-cli"})

    assert client.repo("adolforeyna/reyna-cli") == {"full_name": "adolforeyna/reyna-cli"}


def test_redact_sensitive_handles_nested_api_values():
    assert redact_sensitive(
        {"password": "one", "nested": [{"access_token": "two"}], "name": "safe"}
    ) == {"password": "[REDACTED]", "nested": [{"access_token": "[REDACTED]"}], "name": "safe"}