import os
import shutil
import subprocess
import tempfile
import unittest
from pathlib import Path


@unittest.skipUnless(
    all(shutil.which(tool) for tool in ("agenix", "age", "ssh-keygen")),
    "requires agenix, age, and ssh-keygen on PATH",
)
class AgenixRulesTests(unittest.TestCase):
    def test_decrypt_from_outside_rules_directory(self):
        with tempfile.TemporaryDirectory(prefix="agenix-rules-test-") as raw:
            root = Path(raw)
            secrets = root / "secrets"
            secrets.mkdir()
            elsewhere = root / "elsewhere"
            elsewhere.mkdir()
            key = root / "identity"
            subprocess.run(
                ["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", str(key)],
                check=True,
            )
            public_key = key.with_suffix(".pub").read_text().strip()
            rules = secrets / "secrets.nix"
            rules.write_text(
                '{ "knot-env.age".publicKeys = [ "' + public_key + '" ]; }\n'
            )
            plaintext = b"KNOT_MASTER_KEY=" + b"A" * 43 + b"=\n"
            encrypted = subprocess.run(
                ["age", "-r", public_key], input=plaintext, capture_output=True, check=True
            )
            (secrets / "knot-env.age").write_bytes(encrypted.stdout)
            result = subprocess.run(
                ["agenix", "-d", "knot-env.age", "-i", str(key)],
                cwd=elsewhere,
                env={**os.environ, "AGENIX_RULES": str(rules)},
                capture_output=True,
                check=True,
            )
            self.assertEqual(result.stdout, plaintext)


if __name__ == "__main__":
    unittest.main()