"""Unit tests for API key auth module."""

import asyncio

import pytest
from fastapi import HTTPException
from pytest_mock import MockerFixture

from ai_evals import auth


@pytest.fixture(autouse=True)
def clear_cache() -> None:
    auth.invalidate_key_cache()


def test_get_expected_key_fetches_from_secrets_manager(mocker: MockerFixture) -> None:
    mocker.patch("ai_evals.auth.config.ENVIRONMENT", "qa")
    mock_boto = mocker.patch("ai_evals.auth.boto3.client")
    mock_boto.return_value.get_secret_value.return_value = {"SecretString": "test-key"}

    result = auth.get_expected_key()

    assert result == "test-key"
    mock_boto.return_value.get_secret_value.assert_called_once()


def test_get_expected_key_returns_cached_value(mocker: MockerFixture) -> None:
    mocker.patch("ai_evals.auth.config.ENVIRONMENT", "qa")
    mock_boto = mocker.patch("ai_evals.auth.boto3.client")
    mock_boto.return_value.get_secret_value.return_value = {"SecretString": "test-key"}

    auth.get_expected_key()
    auth.get_expected_key()

    mock_boto.return_value.get_secret_value.assert_called_once()


def test_invalidate_key_cache_forces_refetch(mocker: MockerFixture) -> None:
    mocker.patch("ai_evals.auth.config.ENVIRONMENT", "qa")
    mock_boto = mocker.patch("ai_evals.auth.boto3.client")
    mock_boto.return_value.get_secret_value.return_value = {"SecretString": "test-key"}

    auth.get_expected_key()
    auth.invalidate_key_cache()
    auth.get_expected_key()

    assert mock_boto.return_value.get_secret_value.call_count == 2


def test_verify_api_key_passes_for_valid_key(mocker: MockerFixture) -> None:
    mocker.patch("ai_evals.auth.get_expected_key", return_value="valid-key")

    asyncio.run(auth.verify_api_key("valid-key"))


def test_verify_api_key_raises_403_for_invalid_key(mocker: MockerFixture) -> None:
    mocker.patch("ai_evals.auth.get_expected_key", return_value="valid-key")

    with pytest.raises(HTTPException) as exc_info:
        asyncio.run(auth.verify_api_key("wrong-key"))

    assert exc_info.value.status_code == 403