import tempfile
import unittest
from pathlib import Path
from device_auth import DeviceStore


class DeviceAuthTests(unittest.TestCase):
    def setUp(self):
        self.root = tempfile.TemporaryDirectory()
        self.store = DeviceStore(Path(self.root.name) / 'auth.db')

    def tearDown(self):
        self.root.cleanup()

    def test_pairing_is_single_use_and_devices_have_independent_credentials(self):
        code = self.store.create_code()
        first = self.store.enroll(code, 'one')
        with self.assertRaises(PermissionError):
            self.store.enroll(code, 'replay')
        second = self.store.enroll(self.store.create_code(), 'two')
        self.assertNotEqual(first['token'], second['token'])
        self.assertEqual(first['deviceId'], self.store.authenticate(first['token']))
        self.store.revoke(first['deviceId'])
        with self.assertRaises(PermissionError):
            self.store.authenticate(first['token'])
        self.assertEqual(second['deviceId'], self.store.authenticate(second['token']))

    def test_expired_pairing_and_unknown_tokens_are_rejected(self):
        with self.assertRaises(PermissionError):
            self.store.enroll(self.store.create_code(lifetime=-1), 'expired')
        with self.assertRaises(PermissionError):
            self.store.authenticate('old-shared-apk-token')

    def test_database_contains_hashes_not_bearer_tokens(self):
        enrolled = self.store.enroll(self.store.create_code(), 'phone')
        with self.store.connect() as db:
            value = db.execute('SELECT token_hash FROM devices').fetchone()[0]
        self.assertNotEqual(enrolled['token'], value)
        self.assertEqual(64, len(value))


if __name__ == '__main__':
    unittest.main()