import base64
from types import SimpleNamespace

import pytest
from pydantic import SecretStr

from app.domain import DomainError
from app.main import basic_auth, bearer_auth


def request_with(authorization: str):
    settings = SimpleNamespace(
        service_token=SecretStr("s" * 43),
        callback_username=SecretStr("callback-user"),
        callback_password=SecretStr("callback-password"),
    )
    return SimpleNamespace(
        headers={"Authorization": authorization},
        app=SimpleNamespace(state=SimpleNamespace(settings=settings)),
    )


@pytest.mark.asyncio
async def test_internal_api_requires_exact_bearer_token() -> None:
    await bearer_auth(request_with(f"Bearer {'s' * 43}"))
    with pytest.raises(DomainError) as error:
        await bearer_auth(request_with("Bearer wrong"))
    assert error.value.code == "unauthorized"


def test_callback_requires_exact_basic_credentials() -> None:
    encoded = base64.b64encode(b"callback-user:callback-password").decode()
    basic_auth(request_with(f"Basic {encoded}"))
    with pytest.raises(DomainError):
        basic_auth(request_with("Basic invalid"))