"""Tests for the auth helpers' OIDC user lookup.

kaya-oidc (0.0.6) namespaces session state per provider as
``oidc:{provider}:user``; these tests pin that contract so a kaya
upgrade that changes it again cannot silently break websocket
authentication or span tagging.
"""
from __future__ import annotations

import unittest
from types import SimpleNamespace
from typing import Any

from kaya.session import Session

from tavolo.platform.auth import get_ws_user, session_user


def _ws(session: Any) -> Any:
    return SimpleNamespace(session=session)


class SessionUserTest(unittest.TestCase):
    def test_finds_default_provider_user(self) -> None:
        user = session_user(Session("sid", {"oidc:default:user": {"sub": "alice"}}))
        assert user is not None
        self.assertEqual("alice", user.sub)

    def test_finds_user_of_any_provider(self) -> None:
        user = session_user(Session("sid", {"oidc:google:user": {"sub": "alice"}}))
        assert user is not None
        self.assertEqual("alice", user.sub)

    def test_ignores_flow_state_and_tokens(self) -> None:
        session = Session(
            "sid",
            {
                "oidc:default:state": "state",
                "oidc:default:id_token": "token",
                "oidc:default:access_token": "token",
            },
        )
        self.assertIsNone(session_user(session))

    def test_ignores_legacy_unprefixed_user_key(self) -> None:
        session = Session("sid", {"oidc_user": {"sub": "alice"}})
        self.assertIsNone(session_user(session))

    def test_ignores_malformed_user_claims(self) -> None:
        session = Session("sid", {"oidc:default:user": "alice"})
        self.assertIsNone(session_user(session))


class GetWsUserTest(unittest.TestCase):
    def test_returns_user_from_provider_namespaced_session(self) -> None:
        session = Session(
            "sid",
            {"oidc:default:user": {"sub": "alice", "preferred_username": "Alice"}},
        )
        user = get_ws_user(_ws(session))
        assert user is not None
        self.assertEqual("alice", user.sub)

    def test_missing_session_returns_none(self) -> None:
        self.assertIsNone(get_ws_user(SimpleNamespace()))