from __future__ import annotations

from pathlib import Path
from types import SimpleNamespace

from cpv3.modules.transcription import service as transcription_service


class _FakeSSLContext:
    def __init__(self) -> None:
        self.loaded_cafile: str | None = None

    def load_verify_locations(self, *, cafile: str) -> None:
        self.loaded_cafile = cafile


def test_build_salute_ssl_context_uses_default_context(monkeypatch) -> None:
    fake_context = _FakeSSLContext()

    monkeypatch.setattr(
        transcription_service,
        "get_settings",
        lambda: SimpleNamespace(
            salute_ssl_verify=True,
            salute_ca_cert_path=None,
        ),
    )
    monkeypatch.setattr(
        transcription_service.ssl,
        "create_default_context",
        lambda: fake_context,
    )

    ssl_context = transcription_service._build_salute_ssl_context()

    assert ssl_context is fake_context
    assert fake_context.loaded_cafile is None


def test_build_salute_ssl_context_loads_custom_ca(monkeypatch) -> None:
    fake_context = _FakeSSLContext()
    custom_ca_path = Path("/tmp/salute-ca.pem")

    monkeypatch.setattr(
        transcription_service,
        "get_settings",
        lambda: SimpleNamespace(
            salute_ssl_verify=True,
            salute_ca_cert_path=custom_ca_path,
        ),
    )
    monkeypatch.setattr(
        transcription_service.ssl,
        "create_default_context",
        lambda: fake_context,
    )

    ssl_context = transcription_service._build_salute_ssl_context()

    assert ssl_context is fake_context
    assert fake_context.loaded_cafile == str(custom_ca_path)


def test_build_salute_ssl_context_disables_verification(monkeypatch) -> None:
    unverified_context = object()

    monkeypatch.setattr(
        transcription_service,
        "get_settings",
        lambda: SimpleNamespace(
            salute_ssl_verify=False,
            salute_ca_cert_path=None,
        ),
    )
    monkeypatch.setattr(
        transcription_service.ssl,
        "_create_unverified_context",
        lambda: unverified_context,
    )

    ssl_context = transcription_service._build_salute_ssl_context()

    assert ssl_context is unverified_context


def test_get_salute_auth_header_value_returns_basic_header(monkeypatch) -> None:
    monkeypatch.setattr(
        transcription_service,
        "get_settings",
        lambda: SimpleNamespace(
            salute_auth_key="  encoded-credentials  ",
        ),
    )

    header_value = transcription_service._get_salute_auth_header_value()

    assert header_value == "Basic encoded-credentials"


def test_get_salute_auth_header_value_raises_when_missing(monkeypatch) -> None:
    monkeypatch.setattr(
        transcription_service,
        "get_settings",
        lambda: SimpleNamespace(
            salute_auth_key="   ",
        ),
    )

    try:
        transcription_service._get_salute_auth_header_value()
    except RuntimeError as exc:
        assert str(exc) == transcription_service.ERROR_SALUTE_AUTH_KEY_MISSING
    else:
        raise AssertionError("Expected RuntimeError for missing SaluteSpeech auth key")