from __future__ import annotations

import pytest
from fastapi import HTTPException

from agent_platform.auth import UserIdentity, decode_openwebui_identity, issue_internal_identity, verify_service_bearer


def test_signed_identity_is_verified(identity_jwt: str, settings) -> None:
    identity = decode_openwebui_identity(identity_jwt, settings.openwebui_forward_jwt_secret)
    assert identity.user_id == "user-123"
    assert identity.email == "user@example.test"


def test_invalid_identity_is_rejected(settings) -> None:
    with pytest.raises(HTTPException) as error:
        decode_openwebui_identity("not-a-jwt", settings.openwebui_forward_jwt_secret)
    assert error.value.status_code == 401


def test_internal_identity_can_be_reissued_from_verified_claims(settings) -> None:
    expected = UserIdentity("user-123", "user@example.test", "Test User", "user")
    token = issue_internal_identity(expected, settings.openwebui_forward_jwt_secret)
    assert decode_openwebui_identity(token, settings.openwebui_forward_jwt_secret) == expected


def test_service_bearer_uses_exact_match() -> None:
    verify_service_bearer("Bearer expected", "expected")
    with pytest.raises(HTTPException) as error:
        verify_service_bearer("Bearer expect", "expected")
    assert error.value.status_code == 401