"""Tests for SecretsManagerClient."""

import json
from typing import Any
from unittest.mock import MagicMock, patch

import pytest

from auth0_client import SecretsManagerClient, TenantCredentials


def make_secret_response(
    client_id: str, client_secret: str, domain: str = 'example.auth0.com'
) -> dict[str, Any]:
    """Build a mock get_secret_value response."""
    return {
        'SecretString': json.dumps(
            {
                'auth0_domain': domain,
                'auth0_client_id': client_id,
                'auth0_client_secret': client_secret,
            }
        )
    }


@patch('boto3.client')
def test_get_tenant_credentials_returns_correct_values(
    mock_boto_client: MagicMock,
) -> None:
    """get_tenant_credentials returns TenantCredentials with correct values.

    :param mock_boto_client:
    :return:
    """
    mock_sm = MagicMock()
    mock_boto_client.return_value = mock_sm
    mock_sm.get_secret_value.return_value = make_secret_response(
        'my-client-id', 'my-client-secret', domain='my-tenant.auth0.com'
    )

    client = SecretsManagerClient()
    creds = client.get_tenant_credentials('my-tenant')

    assert isinstance(creds, TenantCredentials)
    assert creds.domain == 'my-tenant.auth0.com'
    assert creds.client_id == 'my-client-id'
    assert creds.client_secret == 'my-client-secret'


@patch('boto3.client')
def test_get_tenant_credentials_uses_correct_secret_name(
    mock_boto_client: MagicMock,
) -> None:
    """get_tenant_credentials fetches the secret with the expected name.

    :param mock_boto_client:
    :return:
    """
    mock_sm = MagicMock()
    mock_boto_client.return_value = mock_sm
    mock_sm.get_secret_value.return_value = make_secret_response('cid', 'sec')

    client = SecretsManagerClient()
    client.get_tenant_credentials('acme-corp')

    mock_sm.get_secret_value.assert_called_once_with(
        SecretId='shared/offboarding-automation/acme-corp/auth0_management_credentials'
    )


@patch('boto3.client')
def test_get_tenant_credentials_propagates_boto3_error(
    mock_boto_client: MagicMock,
) -> None:
    """get_tenant_credentials propagates exceptions from boto3.

    :param mock_boto_client:
    :return:
    """
    mock_sm = MagicMock()
    mock_boto_client.return_value = mock_sm
    mock_sm.get_secret_value.side_effect = Exception('ResourceNotFoundException')

    client = SecretsManagerClient()
    with pytest.raises(Exception, match='ResourceNotFoundException'):
        client.get_tenant_credentials('nonexistent-tenant')