#!/usr/bin/env python3

import importlib.util
import tempfile
import unittest
from pathlib import Path
from unittest import mock


PROJECT_ROOT = Path(__file__).resolve().parents[1]
MODULE_PATH = PROJECT_ROOT / "tools" / "check-secrets.py"
SPEC = importlib.util.spec_from_file_location("check_secrets", MODULE_PATH)
MODULE = importlib.util.module_from_spec(SPEC)
assert SPEC.loader is not None
SPEC.loader.exec_module(MODULE)


class SnapshotScannerTests(unittest.TestCase):
    def test_snapshot_without_git_scans_regular_files(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            (root / "safe.txt").write_text("safe\n", encoding="utf-8")
            (root / ".venv").mkdir()
            (root / ".venv" / "ignored.txt").write_text(
                "JWEBOT_EDGE_STEAM_API_KEY=not-for-scan\n",
                encoding="utf-8",
            )
            with mock.patch.object(MODULE, "ROOT", root), mock.patch.object(
                MODULE,
                "has_git_repository",
                return_value=False,
            ):
                self.assertEqual(MODULE.tracked_paths(), ["safe.txt"])
                self.assertEqual(MODULE.scan_tracked(), [])

    def test_snapshot_scanner_reports_fingerprint_not_value(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            (root / "config.env").write_text(
                "JWEBOT_EDGE_STEAM_API_KEY=local-sensitive-value\n",
                encoding="utf-8",
            )
            with mock.patch.object(MODULE, "ROOT", root), mock.patch.object(
                MODULE,
                "has_git_repository",
                return_value=False,
            ):
                findings = MODULE.scan_tracked()

            self.assertEqual(findings[0][0], "populated_secret")
            self.assertEqual(findings[0][1], "config.env")
            self.assertNotIn("local-sensitive-value", str(findings))


if __name__ == "__main__":
    unittest.main()