"""Unit tests for the AWS integration hooks. No real AWS account or
credentials involved -- boto3 calls are mocked at the boundary."""
from __future__ import annotations

import json
from unittest.mock import MagicMock, patch

import pytest

from a2a_passport.integrations.aws import cognito_verifier, secret_from_secrets_manager


def test_cognito_verifier_derives_jwks_and_issuer():
    verifier = cognito_verifier(user_pool_id="us-east-1_AbCdEfGhI", region="us-east-1")
    assert verifier._issuer == "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_AbCdEfGhI"
    assert (
        verifier._jwks_client.uri
        == "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_AbCdEfGhI/.well-known/jwks.json"
    )


def test_secret_from_secrets_manager_plain_string():
    mock_client = MagicMock()
    mock_client.get_secret_value.return_value = {"SecretString": "plain-secret-value"}
    with patch("boto3.client", return_value=mock_client) as mock_boto3_client:
        value = secret_from_secrets_manager("my-secret", region="us-east-1")
    assert value == "plain-secret-value"
    mock_boto3_client.assert_called_once_with("secretsmanager", region_name="us-east-1")
    mock_client.get_secret_value.assert_called_once_with(SecretId="my-secret")


def test_secret_from_secrets_manager_json_key_extraction():
    mock_client = MagicMock()
    mock_client.get_secret_value.return_value = {
        "SecretString": json.dumps({"client_secret": "nested-value", "other": "ignored"})
    }
    with patch("boto3.client", return_value=mock_client):
        value = secret_from_secrets_manager("my-secret", key="client_secret")
    assert value == "nested-value"


def test_secret_from_secrets_manager_binary_secret_raises():
    mock_client = MagicMock()
    mock_client.get_secret_value.return_value = {"SecretBinary": b"not supported"}
    with patch("boto3.client", return_value=mock_client):
        with pytest.raises(RuntimeError, match="SecretString"):
            secret_from_secrets_manager("my-secret")
