"""Unit tests for the Azure integration hooks. No real Azure tenant or
credentials involved -- azure-identity/azure-keyvault-secrets are mocked at
the boundary."""
from __future__ import annotations

from unittest.mock import MagicMock, patch

from a2a_passport.integrations.azure import entra_id_verifier, secret_from_key_vault


def test_entra_id_verifier_derives_jwks_and_issuer():
    tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
    verifier = entra_id_verifier(tenant_id=tenant_id)
    assert verifier._issuer == f"https://login.microsoftonline.com/{tenant_id}/v2.0"
    assert (
        verifier._jwks_client.uri
        == f"https://login.microsoftonline.com/{tenant_id}/discovery/v2.0/keys"
    )


def test_secret_from_key_vault():
    mock_secret = MagicMock()
    mock_secret.value = "my-vault-secret"
    mock_client_instance = MagicMock()
    mock_client_instance.get_secret.return_value = mock_secret

    with (
        patch("azure.identity.DefaultAzureCredential") as mock_cred,
        patch(
            "azure.keyvault.secrets.SecretClient", return_value=mock_client_instance
        ) as mock_client_cls,
    ):
        value = secret_from_key_vault("https://my-vault.vault.azure.net/", "my-secret-name")

    assert value == "my-vault-secret"
    mock_client_cls.assert_called_once_with(
        vault_url="https://my-vault.vault.azure.net/", credential=mock_cred.return_value
    )
    mock_client_instance.get_secret.assert_called_once_with("my-secret-name")
