from __future__ import annotations

from types import SimpleNamespace


def test_push_docker_image_prefers_tls_verified_skopeo_when_ca_provided(
    tmp_path, monkeypatch
):
    from knoe.core import env

    ca = tmp_path / "registry-ca.pem"
    ca.write_text("dummy-ca")
    monkeypatch.setenv("PROLE_REGISTRY_CA_CERT", str(ca))

    monkeypatch.setattr(env.shutil, "which", lambda name: "/usr/bin/skopeo" if name == "skopeo" else None)
    monkeypatch.setattr(env.shutil, "copyfile", lambda _src, _dst: None)

    calls: list[list[str]] = []

    def fake_run(cmd, capture_output=True, text=True):
        calls.append(list(cmd))
        if cmd[:2] == ["docker", "push"]:
            return SimpleNamespace(returncode=1, stdout="", stderr="x509: unknown authority")

        # Secure skopeo path should be used and succeed.
        assert cmd[0] == "/usr/bin/skopeo"
        assert "--dest-tls-verify=true" in cmd
        assert "--dest-cert-dir" in cmd
        assert "--dest-tls-verify=false" not in cmd
        return SimpleNamespace(returncode=0, stdout="", stderr="")

    monkeypatch.setattr(env.subprocess, "run", fake_run)

    ok = env._push_docker_image("myrddin.knoe.org:5000/knoe-db:18-118")
    assert ok is True
    assert len(calls) == 2


def test_push_docker_image_auto_detects_repo_cert_for_myrddin(monkeypatch):
    """Regression: when no env var is provided, prefer repo-shipped certs (Ansible knoe_ssl role)."""

    from knoe.core import env

    monkeypatch.delenv("PROLE_REGISTRY_CA_CERT", raising=False)
    monkeypatch.delenv("REGISTRY_CA_CERT", raising=False)
    monkeypatch.delenv("PROLE_REGISTRY_CERT_DIR", raising=False)

    monkeypatch.setattr(
        env.shutil,
        "which",
        lambda name: "/usr/bin/skopeo" if name == "skopeo" else None,
    )
    monkeypatch.setattr(env.shutil, "copyfile", lambda _src, _dst: None)

    calls: list[list[str]] = []

    def fake_run(cmd, capture_output=True, text=True):
        calls.append(list(cmd))
        if cmd[:2] == ["docker", "push"]:
            return SimpleNamespace(
                returncode=1, stdout="", stderr="x509: unknown authority"
            )

        assert cmd[0] == "/usr/bin/skopeo"
        assert "--dest-tls-verify=true" in cmd
        assert "--dest-cert-dir" in cmd
        assert "--dest-tls-verify=false" not in cmd
        return SimpleNamespace(returncode=0, stdout="", stderr="")

    monkeypatch.setattr(env.subprocess, "run", fake_run)

    ok = env._push_docker_image("myrddin.knoe.org:5000/knoe-db:18-118")
    assert ok is True
    assert len(calls) == 2