"""Unit tests for Ansible credential argv/env construction (task 548)."""
import json

from steward.ansible.executor import ansible_env, build_credentials


def test_no_creds_is_empty():
    assert build_credentials({}, "/td") == ([], [])
    assert build_credentials(None, "/td") == ([], [])


def test_ssh_key_via_file():
    args, files = build_credentials({"ssh_private_key": "KEYDATA"}, "/td")
    assert args == ["--private-key", "/td/id_key"]
    assert files == [("/td/id_key", "KEYDATA\n")]


def test_ssh_key_keeps_existing_trailing_newline():
    _, files = build_credentials({"ssh_private_key": "KEY\n"}, "/td")
    assert files == [("/td/id_key", "KEY\n")]


def test_vault_password_via_file():
    args, files = build_credentials({"vault_password": "vpw"}, "/td")
    assert args == ["--vault-password-file", "/td/vault_pass"]
    assert files == [("/td/vault_pass", "vpw\n")]


def test_become_password_uses_vars_file_not_argv():
    pw = "p@ss word"
    args, files = build_credentials({"become_password": pw}, "/td")
    assert args == ["-e", "@/td/become.yml"]
    assert files[0][0] == "/td/become.yml"
    assert files[0][1] == "ansible_become_password: " + json.dumps(pw) + "\n"
    # The password must never appear on the command line.
    assert pw not in " ".join(args)


def test_all_three_combined():
    args, files = build_credentials(
        {"ssh_private_key": "K", "vault_password": "V", "become_password": "B"}, "/td")
    assert "--private-key" in args
    assert "--vault-password-file" in args
    assert "-e" in args
    assert len(files) == 3


def test_ansible_env_host_key_checking_toggle():
    assert ansible_env({"host_key_checking": True}, {})["ANSIBLE_HOST_KEY_CHECKING"] == "True"
    assert ansible_env({"host_key_checking": False}, {})["ANSIBLE_HOST_KEY_CHECKING"] == "False"
    assert ansible_env({}, {})["ANSIBLE_HOST_KEY_CHECKING"] == "False"
    assert ansible_env(None, {})["ANSIBLE_HOST_KEY_CHECKING"] == "False"


def test_ansible_env_preserves_base():
    env = ansible_env({}, {"FOO": "bar"})
    assert env["FOO"] == "bar"