from __future__ import annotations

import json
import subprocess
import tempfile
import unittest
from dataclasses import replace
from pathlib import Path

from vpn_egressctl.doctor import Doctor
from vpn_egressctl.renderer_1_13_19 import render_bytes
from vpn_egressctl.uri import parse_hysteria2_uri

from tests.helpers import FakeRunner, make_policy


class DoctorTests(unittest.TestCase):
    def prepare(self, directory: str, uri: str):
        root = Path(directory)
        policy = make_policy(root)
        endpoint = parse_hysteria2_uri(uri)
        Path(policy.runtime.uri_path).parent.mkdir(parents=True)
        Path(policy.runtime.uri_path).write_text(uri + "\n", encoding="utf-8")
        Path(policy.sing_box.config_path).write_bytes(render_bytes(policy, endpoint))
        return policy

    def test_endpoint_exclusion_is_an_error(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            policy = self.prepare(directory, "hy2://auth@example.com")
            policy = replace(
                policy,
                network=replace(
                    policy.network,
                    route_exclude_address=policy.network.route_exclude_address + ("8.8.8.8/32",),
                ),
            )
            doctor = Doctor(
                policy,
                runner=FakeRunner(),
                resolver=lambda *args: [(None, None, None, None, ("8.8.8.8", 443))],
            )
            checks = doctor.run()
        selected = [check for check in checks if check.name == "endpoint-exclusion"]
        self.assertEqual(selected[0].level, "ERROR")

    def test_insecure_tls_is_reported_without_secret(self) -> None:
        secret = "NEVER-LOG-ME"
        with tempfile.TemporaryDirectory() as directory:
            policy = self.prepare(directory, f"hy2://{secret}@example.com?insecure=1")
            doctor = Doctor(
                policy,
                runner=FakeRunner(),
                resolver=lambda *args: [(None, None, None, None, ("8.8.4.4", 443))],
            )
            checks = doctor.run()
        output = json.dumps([check.message for check in checks])
        self.assertNotIn(secret, output)
        selected = [check for check in checks if check.name == "tls-insecure"]
        self.assertEqual(selected[0].level, "WARN")


if __name__ == "__main__":
    unittest.main()