"""Validate the bundled Lark configuration check without credentials or network."""
from pathlib import Path
import subprocess
import sys
import tempfile
import unittest

ROOT = Path(__file__).parent / "project-seeds/__global__/skills/lark-cli"
CHECK = ROOT / "lark-shared/scripts/check_proxy.py"


class LarkProxyConfigTest(unittest.TestCase):
    def setUp(self):
        self.temp = tempfile.TemporaryDirectory()
        self.addCleanup(self.temp.cleanup)
        cli = Path(self.temp.name) / "lark-cli"
        # The check must only find the binary, never execute it or make a request.
        cli.write_text("#!/bin/sh\nexit 99\n")
        cli.chmod(0o755)
        self.env = {
            "PATH": self.temp.name,
            "LARKSUITE_CLI_AUTH_PROXY": "http://127.0.0.1:16384",
            "LARKSUITE_CLI_PROXY_KEY": "synthetic-key-must-never-be-printed",
            "LARKSUITE_CLI_APP_ID": "cli_test",
            "LARKSUITE_CLI_BRAND": "feishu",
            "LARKSUITE_CLI_DEFAULT_AS": "bot",
            "LARKSUITE_CLI_STRICT_MODE": "bot",
        }

    def check(self, env):
        result = subprocess.run([sys.executable, str(CHECK)], env=env, capture_output=True, text=True)
        self.assertNotIn(self.env["LARKSUITE_CLI_PROXY_KEY"], result.stdout + result.stderr)
        return result

    def test_valid_config_is_not_reported_as_connectivity(self):
        result = self.check(self.env)
        self.assertEqual(result.returncode, 0, result.stderr)
        self.assertIn("not checked", result.stdout)

    def test_missing_config_fails_even_with_direct_credentials(self):
        for name in self.env:
            if name == "PATH":
                continue
            with self.subTest(variable=name):
                env = self.env.copy()
                del env[name]
                env["LARKSUITE_CLI_APP_SECRET"] = "unused-direct-secret"
                env["DS_PROXY_URL"] = "http://127.0.0.1:8080"
                result = self.check(env)
                self.assertNotEqual(result.returncode, 0)
                self.assertIn(name, result.stderr)
                self.assertNotIn("unused-direct-secret", result.stdout + result.stderr)

    def test_rejects_invalid_endpoint_and_identity(self):
        for name, value in [
            ("LARKSUITE_CLI_AUTH_PROXY", "https://open.feishu.cn"),
            ("LARKSUITE_CLI_AUTH_PROXY", "http://0.0.0.0:16384"),
            ("LARKSUITE_CLI_AUTH_PROXY", "http://127.0.0.1:16384/lark"),
            ("LARKSUITE_CLI_AUTH_PROXY", "http://user:secret@127.0.0.1:16384"),
            ("LARKSUITE_CLI_AUTH_PROXY", "http://127.0.0.1:bad"),
            ("LARKSUITE_CLI_DEFAULT_AS", "user"),
            ("LARKSUITE_CLI_STRICT_MODE", "off"),
            ("LARKSUITE_CLI_BRAND", "unknown"),
        ]:
            with self.subTest(variable=name, value=value):
                env = self.env.copy()
                env[name] = value
                self.assertNotEqual(self.check(env).returncode, 0)

    def test_missing_bundled_binary_is_actionable(self):
        env = self.env.copy()
        env["PATH"] = "/nonexistent"
        result = self.check(env)
        self.assertNotEqual(result.returncode, 0)
        self.assertIn("lark-cli", result.stderr)

    def test_all_skills_have_frontmatter_and_shared_reference(self):
        expected = {"lark-shared", "lark-base", "lark-doc", "lark-im", "lark-openapi-explorer", "lark-sheets", "lark-wiki"}
        self.assertEqual({p.parent.name for p in ROOT.glob("*/SKILL.md")}, expected)
        for name in expected:
            text = (ROOT / name / "SKILL.md").read_text()
            self.assertTrue(text.startswith("---\n"))
            metadata = text.split("---", 2)[1]
            self.assertIn("name: " + name, metadata)
            self.assertIn("description:", metadata)
            if name != "lark-shared":
                self.assertTrue((ROOT / name / "../lark-shared/SKILL.md").is_file())


if __name__ == "__main__":
    unittest.main()