"""Bootstrap must preserve build isolation and fall back without leaking secrets."""

import importlib.util
from pathlib import Path
from types import SimpleNamespace

import pytest


@pytest.fixture
def installer():
    spec = importlib.util.spec_from_file_location(
        "ci_install", Path(__file__).parents[1] / "scripts/ci-install.py"
    )
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    return module


def test_scrub_credentials_and_signed_urls(installer):
    text = "https://user:fixture-secret@mirror.example/simple?token=fixture-token"
    assert installer.safe_output(text) == "https://mirror.example/[redacted-url]"


def test_install_environment_overrides_inherited_indexes(installer, monkeypatch):
    for key in (
        "PIP_NO_INDEX",
        "PIP_EXTRA_INDEX_URL",
        "PIP_FIND_LINKS",
        "PIP_NO_BUILD_ISOLATION",
    ):
        monkeypatch.setenv(key, "fixture")
    monkeypatch.setenv("PIP_CONSTRAINT", "supply-chain-constraints.txt")
    env = installer.install_env("https://pypi.org/simple")
    assert env["PIP_CONFIG_FILE"] == installer.os.devnull
    assert env["PIP_INDEX_URL"] == "https://pypi.org/simple"
    assert env["PIP_CONSTRAINT"] == "supply-chain-constraints.txt"
    assert all(
        key not in env
        for key in (
            "PIP_NO_INDEX",
            "PIP_EXTRA_INDEX_URL",
            "PIP_FIND_LINKS",
            "PIP_NO_BUILD_ISOLATION",
        )
    )


@pytest.mark.parametrize("fallback_succeeds", [True, False])
def test_sequential_fallback_keeps_editable_and_isolation(
    installer, monkeypatch, capsys, fallback_succeeds
):
    calls = []
    monkeypatch.setenv(
        "CI_PIP_INDEX_URL", "https://user:fixture-secret@mirror.example/simple"
    )
    monkeypatch.setenv("CI_PIP_FALLBACK_INDEX_URL", "https://pypi.org/simple")

    def run(command, **kwargs):
        if "config" in command:
            return SimpleNamespace(
                returncode=0,
                stdout="global.index-url='https://user:fixture-secret@mirror.example/simple'\n",
            )
        calls.append((command, kwargs["env"]))
        return SimpleNamespace(
            returncode=0 if len(calls) == 2 and fallback_succeeds else 1,
            stdout="Could not fetch https://user:fixture-secret@mirror.example/simple?token=fixture-token\n",
        )

    monkeypatch.setattr(installer.subprocess, "run", run)
    if fallback_succeeds:
        installer.main()
    else:
        with pytest.raises(SystemExit):
            installer.main()
    assert len(calls) == 2
    assert calls[1][1]["PIP_INDEX_URL"] == "https://pypi.org/simple"
    assert all(
        command[-2:] == ["-e", ".[test]"] and "--no-build-isolation" not in command
        for command, _ in calls
    )
    output = capsys.readouterr().out
    assert "fixture-secret" not in output and "fixture-token" not in output
    assert "mirror.example" in output and "pypi.org" in output


def test_docker_locked_install_has_independent_index_and_fallback(
    installer, monkeypatch
):
    monkeypatch.setattr(installer.sys, "argv", ["install.py", "--locked"])
    monkeypatch.setenv("CI_PIP_INDEX_URL", "https://ci.example/simple")
    monkeypatch.setenv("DOCKER_PIP_INDEX_URL", "https://docker.example/simple")
    monkeypatch.setenv("DOCKER_PIP_FALLBACK_INDEX_URL", "https://pypi.org/simple")
    calls = []

    def run(command, **kwargs):
        if "config" in command:
            return SimpleNamespace(returncode=0, stdout="")
        calls.append((command, kwargs["env"]))
        return SimpleNamespace(returncode=0 if len(calls) == 2 else 1, stdout="")

    monkeypatch.setattr(installer.subprocess, "run", run)
    installer.main()
    assert [env["PIP_INDEX_URL"] for _, env in calls] == [
        "https://docker.example/simple",
        "https://pypi.org/simple",
    ]
    assert all(command[-2:] == ["-r", "requirements.lock"] for command, _ in calls)