stack/tests/api/test_auth_main.py

"""Tests for api.auth.__main__ CLI entry point."""

from __future__ import annotations

import sys
from unittest.mock import patch

import pytest


@pytest.fixture()
def _valid_env(monkeypatch):
    monkeypatch.setenv("ROOT_KEY", "aa" * 16)


class TestMain:
    def test_no_args(self):
        from api.auth.__main__ import main

        with patch.object(sys, "argv", ["prog"]):
            assert main() == 1

    def test_bad_command(self):
        from api.auth.__main__ import main

        with patch.object(sys, "argv", ["prog", "bad", "abc123"]):
            assert main() == 1

    def test_missing_root_key(self, monkeypatch):
        monkeypatch.delenv("ROOT_KEY", raising=False)
        from api.auth.__main__ import main

        with patch.object(sys, "argv", ["prog", "derive", "abc123"]):
            assert main() == 1

    def test_invalid_hex_root_key(self, monkeypatch):
        monkeypatch.setenv("ROOT_KEY", "not-hex")
        from api.auth.__main__ import main

        with patch.object(sys, "argv", ["prog", "derive", "abc123"]):
            assert main() == 1

    def test_short_root_key(self, monkeypatch):
        monkeypatch.setenv("ROOT_KEY", "aabb")
        from api.auth.__main__ import main

        with patch.object(sys, "argv", ["prog", "derive", "abc123"]):
            assert main() == 1

    @pytest.mark.usefixtures("_valid_env")
    def test_derive(self, capsys):
        from api.auth.__main__ import main

        with patch.object(sys, "argv", ["prog", "derive", "abc123"]):
            assert main() == 0

        out = capsys.readouterr().out
        assert "=" in out

    @pytest.mark.usefixtures("_valid_env")
    def test_derive_redacted(self, capsys):
        from api.auth.__main__ import main

        with patch.object(sys, "argv", ["prog", "derive", "abc123", "--redact"]):
            assert main() == 0

        out = capsys.readouterr().out
        assert "..." in out

    @pytest.mark.usefixtures("_valid_env")
    def test_provision(self, tmp_path):
        from api.auth.__main__ import main

        env_file = tmp_path / ".env"
        with (
            patch.object(sys, "argv", ["prog", "provision", "abc123"]),
            patch("api.auth.__main__.Path", return_value=env_file),
            patch("api.auth.provision.provision") as mock_prov,
        ):
            from api.auth.provision import ProvisionResult

            mock_prov.return_value = ProvisionResult(
                postgres=True, gitea=True, env_written=True
            )
            result = main()
            assert result == 0

    @pytest.mark.usefixtures("_valid_env")
    def test_bootstrap(self, tmp_path):
        from api.auth.__main__ import main

        env_file = tmp_path / ".env"
        with (
            patch.object(sys, "argv", ["prog", "bootstrap", "abc123"]),
            patch("api.auth.__main__.Path", return_value=env_file),
            patch("api.auth.provision.bootstrap") as mock_boot,
        ):
            from api.auth.provision import ProvisionResult

            mock_boot.return_value = ProvisionResult(env_written=True)
            assert main() == 0

    @pytest.mark.usefixtures("_valid_env")
    def test_provision_with_errors(self, tmp_path):
        """provision command returns non-zero when both postgres and gitea fail."""
        from api.auth.__main__ import main

        env_file = tmp_path / ".env"
        with (
            patch.object(sys, "argv", ["prog", "provision", "abc123"]),
            patch("api.auth.__main__.Path", return_value=env_file),
            patch("api.auth.provision.provision") as mock_prov,
        ):
            from api.auth.provision import ProvisionResult

            mock_prov.return_value = ProvisionResult(
                postgres=False,
                gitea=False,
                env_written=True,
                errors=[
                    ("postgres", Exception("pg down")),
                    ("gitea", Exception("g down")),
                ],
            )
            result = main()
            assert result == 1

    @pytest.mark.usefixtures("_valid_env")
    def test_provision_partial_success(self, tmp_path):
        """provision returns 0 when postgres fails but gitea succeeds."""
        from api.auth.__main__ import main

        env_file = tmp_path / ".env"
        with (
            patch.object(sys, "argv", ["prog", "provision", "abc123"]),
            patch("api.auth.__main__.Path", return_value=env_file),
            patch("api.auth.provision.provision") as mock_prov,
        ):
            from api.auth.provision import ProvisionResult

            mock_prov.return_value = ProvisionResult(
                postgres=False,
                gitea=True,
                env_written=True,
                errors=[("postgres", Exception("pg down"))],
            )
            result = main()
            assert result == 0

    @pytest.mark.usefixtures("_valid_env")
    def test_deploy(self, tmp_path):
        from api.auth.__main__ import main

        env_file = tmp_path / ".env"
        with (
            patch.object(sys, "argv", ["prog", "deploy", "abc123"]),
            patch("api.auth.__main__.Path", return_value=env_file),
            patch("api.auth.deploy.deploy") as mock_deploy,
        ):
            from api.auth.provision import ProvisionResult

            mock_deploy.return_value = ProvisionResult(env_written=True)
            result = main()
            assert result == 0

    @pytest.mark.usefixtures("_valid_env")
    def test_deploy_with_errors(self, tmp_path):
        from api.auth.__main__ import main

        env_file = tmp_path / ".env"
        with (
            patch.object(sys, "argv", ["prog", "deploy", "abc123"]),
            patch("api.auth.__main__.Path", return_value=env_file),
            patch("api.auth.deploy.deploy") as mock_deploy,
        ):
            from api.auth.provision import ProvisionResult

            mock_deploy.return_value = ProvisionResult(
                env_written=False,
                errors=[("provision", Exception("fail"))],
            )
            result = main()
            assert result == 1

    @pytest.mark.usefixtures("_valid_env")
    def test_verify_success(self):
        from api.auth.__main__ import main

        with (
            patch.object(sys, "argv", ["prog", "verify", "abc123"]),
            patch("api.auth.deploy.verify_all", return_value=[]),
        ):
            result = main()
        assert result == 0

    @pytest.mark.usefixtures("_valid_env")
    def test_verify_failure(self):
        from api.auth.__main__ import main

        with (
            patch.object(sys, "argv", ["prog", "verify", "abc123"]),
            patch("api.auth.deploy.verify_all", return_value=["check failed"]),
        ):
            result = main()
        assert result == 1

    @pytest.mark.usefixtures("_valid_env")
    def test_bootstrap_with_errors(self, tmp_path):
        from api.auth.__main__ import main

        env_file = tmp_path / ".env"
        with (
            patch.object(sys, "argv", ["prog", "bootstrap", "abc123"]),
            patch("api.auth.__main__.Path", return_value=env_file),
            patch("api.auth.provision.bootstrap") as mock_boot,
        ):
            from api.auth.provision import ProvisionResult

            mock_boot.return_value = ProvisionResult(
                env_written=True,
                errors=[("postgres", Exception("pg down"))],
            )
            result = main()
            assert result == 0

    def test_dunder_main_line(self):
        """__main__ block is reachable (pragma: test run via subprocess not needed)."""

        import api.auth.__main__ as m

        assert callable(m.main)