import textwrap
import pytest
from steward.config import load_bootstrap, _resolve_secret_key


def test_load_bootstrap_from_yaml(tmp_path):
    cfg_file = tmp_path / "config.yaml"
    cfg_file.write_text(textwrap.dedent("""\
        database:
          url: postgresql+asyncpg://user:pass@localhost/steward
        secret_key: test-secret
    """))
    cfg = load_bootstrap(cfg_file)
    assert cfg["database_url"] == "postgresql+asyncpg://user:pass@localhost/steward"
    assert cfg["secret_key"] == "test-secret"


def test_env_var_database_url_overrides_yaml(tmp_path, monkeypatch):
    cfg_file = tmp_path / "config.yaml"
    cfg_file.write_text("database:\n  url: original\nsecret_key: s\n")
    monkeypatch.setenv("STEWARD_DATABASE_URL", "overridden")
    cfg = load_bootstrap(cfg_file)
    assert cfg["database_url"] == "overridden"


def test_env_var_secret_key_overrides_yaml(tmp_path, monkeypatch):
    cfg_file = tmp_path / "config.yaml"
    cfg_file.write_text("database:\n  url: x\nsecret_key: from-yaml\n")
    monkeypatch.setenv("STEWARD_SECRET_KEY", "from-env")
    cfg = load_bootstrap(cfg_file)
    assert cfg["secret_key"] == "from-env"


def test_missing_database_url_raises(tmp_path):
    cfg_file = tmp_path / "config.yaml"
    cfg_file.write_text("secret_key: s\n")
    with pytest.raises(ValueError, match="Database URL is required"):
        load_bootstrap(cfg_file)


# ── secret key resolution ──────────────────────────────────────────────────────

def test_secret_key_existing_file_is_reused(tmp_path, monkeypatch):
    key_file = tmp_path / "secret.key"
    key_file.write_text("persisted-key\n")
    monkeypatch.setattr("steward.config._SECRET_KEY_FILE", key_file)
    monkeypatch.delenv("STEWARD_SECRET_KEY", raising=False)
    assert _resolve_secret_key({}) == "persisted-key"


def test_secret_key_generated_and_persisted_when_writable(tmp_path, monkeypatch):
    key_file = tmp_path / "sub" / "secret.key"   # parent doesn't exist yet
    monkeypatch.setattr("steward.config._SECRET_KEY_FILE", key_file)
    monkeypatch.delenv("STEWARD_SECRET_KEY", raising=False)
    key = _resolve_secret_key({})
    assert key and key_file.read_text().strip() == key


def test_secret_key_unpersistable_raises_instead_of_ephemeral(tmp_path, monkeypatch):
    # A file sits where a directory is needed, so mkdir/write fails → must raise
    # (an ephemeral key would silently orphan every encrypted secret).
    blocker = tmp_path / "blocker"
    blocker.write_text("not a dir")
    monkeypatch.setattr("steward.config._SECRET_KEY_FILE", blocker / "secret.key")
    monkeypatch.delenv("STEWARD_SECRET_KEY", raising=False)
    with pytest.raises(RuntimeError, match="could not persist"):
        _resolve_secret_key({})