"""The remote worker's own guards: where its token goes, and what node code gets."""

import argparse

import pytest
from fluksio_worker import agent
from fluksio_worker.worker_main import _Reporter


@pytest.mark.parametrize(
    ("url", "trusted"),
    [
        ("wss://engine.example.com/api/v1/workers/attach", True),
        ("https://engine.example.com/api/v1/artifacts", True),
        ("ws://127.0.0.1:8000/api/v1/workers/attach", True),
        ("ws://127.1.2.3:8000/api/v1/workers/attach", True),
        ("ws://[::1]:8000/api/v1/workers/attach", True),
        ("ws://localhost:8000/api/v1/workers/attach", True),
        ("ws://192.0.2.10:8000/api/v1/workers/attach", False),
        ("ws://engine.local:8000/api/v1/workers/attach", False),
        ("http://192.0.2.10:8000/api/v1/artifacts", False),
    ],
)
def test_only_tls_or_this_machine_is_handed_the_token(url: str, trusted: bool) -> None:
    assert agent._encrypted_or_local(url) is trusted


def test_a_cleartext_engine_elsewhere_needs_insecure(
    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
) -> None:
    url = "ws://192.0.2.10:8000/api/v1/workers/attach"
    with pytest.raises(SystemExit):
        agent.main(["--url", url, "--token", "t"])
    assert "--insecure" in capsys.readouterr().err

    async def attached(self: agent.Agent) -> None:
        return None

    monkeypatch.setattr(agent.Agent, "serve_forever", attached)
    assert agent.main(["--url", url, "--token", "t", "--insecure"]) == 0


def test_node_code_does_not_get_the_hosts_credentials(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    monkeypatch.setenv("FLUKSIO_WORKER_TOKEN", "worker-token")
    monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "not-for-nodes")
    monkeypatch.setenv("CUDA_VISIBLE_DEVICES", "2")
    args = argparse.Namespace(
        url="wss://engine.example.com/api/v1/workers/attach",
        artifact_url="",
        token="worker-token",
    )

    env = agent.Agent(args).env

    assert "FLUKSIO_WORKER_TOKEN" not in env
    assert "AWS_SECRET_ACCESS_KEY" not in env
    assert env["CUDA_VISIBLE_DEVICES"] == "2"
    assert "PATH" in env
    # Put back on purpose: the artifact store is reached with it.
    assert env["FLUKSIO_ARTIFACT_URL"] == "https://engine.example.com/api/v1/artifacts"


@pytest.mark.parametrize(
    "digest",
    [
        "sha256:../../../etc/passwd",
        "sha256:" + "a" * 63,
        "sha256:" + "A" * 64,
        "md5:" + "a" * 64,
    ],
)
def test_only_a_whole_digest_is_opened(digest: str) -> None:
    """The digest is joined into a path, so anything else could read any file."""
    with pytest.raises(ValueError, match="not an artifact reference"):
        _Reporter("fluksio").load_artifact({"digest": digest})