"""gateway.trust_env — one config key controls aiohttp proxy-env honoring at every adapter site (#48820)."""
import pytest

from gateway.platforms import base as gw_base

def _write_config(tmp_path, monkeypatch, body: str) -> None:
    # load_config caches on (path, mtime) — a fresh tmp HERMES_HOME per test is a fresh cache key.
    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
    (tmp_path / "config.yaml").write_text(body)

@pytest.mark.parametrize(
    "yaml_body, expected",
    [("gateway:\n  trust_env: false\n", False), ("gateway:\n  trust_env: true\n", True), ("{}\n", True)],
)
def test_gateway_trust_env_reads_config(tmp_path, monkeypatch, yaml_body, expected):
    """gateway.trust_env in config.yaml drives the shared helper; absent → True (default)."""
    _write_config(tmp_path, monkeypatch, yaml_body)
    assert gw_base.gateway_trust_env() is expected
    # The generic-proxy discovery path is gated by the same knob; explicit per-platform vars are not.
    monkeypatch.setenv("HTTPS_PROXY", "http://127.0.0.1:7890")
    monkeypatch.delenv("NO_PROXY", raising=False)
    monkeypatch.delenv("no_proxy", raising=False)
    assert (gw_base.resolve_proxy_url() is not None) is expected
    monkeypatch.setenv("X_PLATFORM_PROXY", "http://127.0.0.1:1080")
    assert gw_base.resolve_proxy_url("X_PLATFORM_PROXY") == "http://127.0.0.1:1080"

class TestResolveProxyUrlMultiplexScope:
    """A secondary multiplex profile's own TELEGRAM_PROXY/DISCORD_PROXY/etc. must gate its
    adapter, not the default profile's YAML-to-env bridge output sitting in the shared
    process's os.environ (the #72348 class, applied to this shared chokepoint used by
    Telegram, Discord, Mattermost, Matrix, SMS, and Slack)."""

    def test_scoped_profile_uses_its_own_value(self, monkeypatch):
        from agent.secret_scope import reset_secret_scope, set_multiplex_active, set_secret_scope

        monkeypatch.setenv("DISCORD_PROXY", "http://default-profile-proxy:8080")
        monkeypatch.delenv("NO_PROXY", raising=False)
        monkeypatch.delenv("no_proxy", raising=False)

        set_multiplex_active(True)
        token = set_secret_scope({"DISCORD_PROXY": "http://secondary-profile-proxy:9090"})
        try:
            assert gw_base.resolve_proxy_url("DISCORD_PROXY") == "http://secondary-profile-proxy:9090"
        finally:
            reset_secret_scope(token)
            set_multiplex_active(False)

    def test_scoped_profile_without_own_value_does_not_borrow_default(self, monkeypatch):
        from agent.secret_scope import reset_secret_scope, set_multiplex_active, set_secret_scope

        monkeypatch.setenv("DISCORD_PROXY", "http://default-profile-proxy:8080")
        monkeypatch.delenv("NO_PROXY", raising=False)
        monkeypatch.delenv("no_proxy", raising=False)

        set_multiplex_active(True)
        token = set_secret_scope({})
        try:
            assert gw_base.resolve_proxy_url("DISCORD_PROXY") is None
        finally:
            reset_secret_scope(token)
            set_multiplex_active(False)

    def test_unscoped_default_profile_still_reads_env(self, monkeypatch):
        """Control: outside multiplex (or the default profile), the legacy env read is
        unchanged."""
        monkeypatch.setenv("DISCORD_PROXY", "http://default-profile-proxy:8080")
        monkeypatch.delenv("NO_PROXY", raising=False)
        monkeypatch.delenv("no_proxy", raising=False)
        assert gw_base.resolve_proxy_url("DISCORD_PROXY") == "http://default-profile-proxy:8080"