import stat

import pytest

from inkwell import sealing
from inkwell.config import Config


def test_a_sealed_value_opens_for_its_own_setting_only():
    stored = sealing.seal("hunter2", "smtp_password")
    assert stored.startswith(sealing.PREFIX) and "hunter2" not in stored
    assert sealing.unseal(stored, "smtp_password") == "hunter2"
    # Copied onto another setting's row, it does not open there.
    assert sealing.unseal(stored, "backup_s3_secret_key") is None


def test_sealing_the_same_value_twice_gives_different_text():
    assert sealing.seal("x", "k") != sealing.seal("x", "k")


def test_the_key_file_is_made_once_readable_only_by_the_server():
    sealing.seal("x", "k")
    path = sealing.key_path()
    assert path.parent == Config.data_root()
    assert stat.S_IMODE(path.stat().st_mode) == 0o600
    first = path.read_bytes()
    sealing.seal("y", "k")
    assert path.read_bytes() == first


def test_a_value_from_before_sealing_reads_as_it_is():
    assert sealing.unseal("hunter2", "smtp_password") == "hunter2"
    assert sealing.unseal("v1.looks-versioned", "smtp_password") == "v1.looks-versioned"


def test_reading_never_creates_a_key():
    assert sealing.unseal(sealing.PREFIX + "AAAA", "k") is None
    assert not sealing.key_path().exists()


def test_a_replaced_key_or_a_damaged_value_reads_as_unreadable():
    stored = sealing.seal("hunter2", "k")
    assert sealing.unseal(stored[:-4] + "AAAA", "k") is None
    assert sealing.unseal(sealing.PREFIX + "not base64!", "k") is None
    sealing.key_path().unlink()
    sealing.seal("other", "k")  # a new key
    assert sealing.unseal(stored, "k") is None


def test_a_data_folder_that_cannot_be_written_refuses_to_seal(tmp_path, monkeypatch):
    blocked = tmp_path / "file-not-dir"
    blocked.write_text("")
    monkeypatch.setattr(Config, "DATA_DIR", str(blocked))
    with pytest.raises(sealing.SealError):
        sealing.seal("hunter2", "k")