"""Tests for the shared secrets cache wrapper.

Caching and rotation semantics belong to aws-secretsmanager-caching and
are covered by its own suite — we only verify that our thin wrapper
delegates correctly.
"""

from unittest.mock import MagicMock, patch

from src.connectors import secrets


class TestGetSecret:
    """Tests for get_secret."""

    def test_delegates_to_cache(self) -> None:
        """get_secret forwards the ARN to SecretCache.get_secret_string."""
        arn = 'arn:aws:secretsmanager:us-east-1:123:secret:test'
        fake_cache = MagicMock()
        fake_cache.get_secret_string.return_value = 'my-secret'
        with patch.object(secrets, '_get_cache', return_value=fake_cache):
            result = secrets.get_secret(arn)

        assert result == 'my-secret'
        fake_cache.get_secret_string.assert_called_once_with(arn)


class TestInvalidate:
    """Tests for invalidate."""

    def test_delegates_to_cache_refresh(self) -> None:
        """invalidate forwards the ARN to SecretCache.refresh_secret_now."""
        arn = 'arn:aws:secretsmanager:us-east-1:123:secret:rotated'
        fake_cache = MagicMock()
        with patch.object(secrets, '_get_cache', return_value=fake_cache):
            secrets.invalidate(arn)

        fake_cache.refresh_secret_now.assert_called_once_with(arn)

    # End-to-end rotation is covered by aws-secretsmanager-caching's own
    # test suite; a local test that stubs get_secret_string would give
    # false confidence because it bypasses the cache entirely.