import importlib.util
import json
import os
import tempfile
import unittest
from pathlib import Path

ROOT = Path(__file__).parent
REGISTRY = ROOT / "registry" / "enterprise-identity-registry.json"
os.environ["GH_ENTERPRISE_IDENTITY_REGISTRY"] = str(REGISTRY)
os.environ["GH_ENTERPRISE_RECEIPT_KEY"] = "test-only-key-that-is-longer-than-32-bytes"
spec = importlib.util.spec_from_file_location("enterprise_identity_service", ROOT / "enterprise_identity_service.py")
service = importlib.util.module_from_spec(spec)
spec.loader.exec_module(service)


class EnterpriseIdentityTests(unittest.TestCase):
    def test_age_is_species_and_never_an_individual_identity(self):
        registry = service.load_registry()
        self.assertEqual(registry["persona_identity_governance"]["species"], "AGE")
        self.assertFalse(registry["persona_identity_governance"]["age_is_individual_number_namespace"])
        for human in registry["humans"]:
            for persona in human["personas"]:
                self.assertEqual(persona["species"], "AGE")
                self.assertFalse(persona["current_persona_identity"].startswith("AGE-"))

    def test_five_humans_route_to_five_private_work_repositories(self):
        registry = service.load_registry()
        self.assertEqual(len(registry["humans"]), 5)
        self.assertEqual(len({item["repository"] for item in registry["humans"]}), 5)
        self.assertTrue(all(item["repository"].split("/")[0] == item["username"] for item in registry["humans"]))
        self.assertTrue(all(service.public_projection(registry, item)["work_entry"]["domain"] == "ZERO_SENSE_DOMAIN" for item in registry["humans"]))
        self.assertEqual(service.find_human(registry, "TCS-GL-0007∞")["username"], "feimao")
        self.assertIsNone(service.find_human(registry, "TCS-GL-9999∞"))

    def test_credentials_are_parsed_but_never_part_of_a_receipt(self):
        encoded = service.base64.b64encode(b"feimao:temporary-secret").decode()
        self.assertEqual(service.parse_basic(f"Basic {encoded}"), ("feimao", "temporary-secret"))
        receipt = service.signed_receipt({"receipt_id":"R1","human_number":"TCS-GL-0007∞","username":"feimao"})
        self.assertNotIn("password", json.dumps(receipt).lower())
        self.assertNotIn("temporary-secret", json.dumps(receipt))

    def test_database_separates_relationship_and_responsibility_receipts(self):
        with tempfile.TemporaryDirectory() as temp:
            old = service.DB_PATH
            service.DB_PATH = str(Path(temp) / "identity.sqlite3")
            try:
                db = service.database()
                tables = {row[0] for row in db.execute("select name from sqlite_master where type='table'")}
                self.assertIn("relationship_receipts", tables)
                self.assertIn("responsibility_receipts", tables)
                db.close()
            finally:
                service.DB_PATH = old


if __name__ == "__main__":
    unittest.main()