"""Tests for the LOCAL real_profile_pin patch (browser.real_profile_pin).

Native behavior: snapshot copies whichever Chromium profile was last used
(Local State -> profile.last_used). The pin lets a machine with a work
profile and a personal profile lock each Hermes install to one identity so
last-used roulette can never give the agent the wrong principal.

Invariants under test:
- pin set + exists       -> pinned profile is copied, last_used ignored
- pin set + missing      -> FAIL CLOSED (error), never silently last_used
- pin unset              -> native last_used behavior, byte-for-byte
"""
import json

from tests.tools.test_browser_real_profile import _auth_db


class TestRealProfilePin:
    def _make_profile(self, root, last_used="Profile 2"):
        """Synthetic Chromium user-data-dir with two profiles + last_used."""
        for prof in ("Default", "Profile 2", "Profile 4"):
            (root / prof / "Network").mkdir(parents=True)
            _auth_db((root / prof / "Cookies"), f"cookies-{prof}")
            _auth_db((root / prof / "Login Data"), f"logins-{prof}")
            (root / prof / "Preferences").write_text("{}")
        (root / "Crashpad").mkdir()
        (root / "Local State").write_text(
            json.dumps({"os_crypt": {}, "profile": {"last_used": last_used}})
        )
        return root

    def test_pin_wins_over_last_used(self, tmp_path, monkeypatch):
        import hermes_cli.browser_connect as bc

        src = self._make_profile(tmp_path / "real", last_used="Profile 4")
        home = tmp_path / "hermes-home"
        monkeypatch.setattr(bc, "get_hermes_home", lambda: home)
        monkeypatch.setattr(bc, "_real_profile_pin", lambda: "Profile 2")

        dst, err = bc.snapshot_real_profile("chrome", src=str(src))
        assert err is None and dst
        got = _auth_db((home / "browser-profile" / "chrome" / "Default" / "Cookies"))
        assert got == "cookies-Profile 2", "pin must override last_used"

    def test_bad_pin_fails_closed(self, tmp_path, monkeypatch):
        import hermes_cli.browser_connect as bc

        src = self._make_profile(tmp_path / "real")
        monkeypatch.setattr(bc, "get_hermes_home", lambda: tmp_path / "hh")
        monkeypatch.setattr(bc, "_real_profile_pin", lambda: "Profile 99")

        dst, err = bc.snapshot_real_profile("chrome", src=str(src))
        assert dst is None
        assert err and "real_profile_pin" in err and "Profile 99" in err
        # Nothing may have been copied when the pin failed closed
        assert not (tmp_path / "hh" / "browser-profile" / "chrome" / "Default").exists()

    def test_no_pin_keeps_native_last_used(self, tmp_path, monkeypatch):
        import hermes_cli.browser_connect as bc

        src = self._make_profile(tmp_path / "real", last_used="Profile 4")
        home = tmp_path / "hermes-home"
        monkeypatch.setattr(bc, "get_hermes_home", lambda: home)
        monkeypatch.setattr(bc, "_real_profile_pin", lambda: None)

        dst, err = bc.snapshot_real_profile("chrome", src=str(src))
        assert err is None and dst
        got = _auth_db((home / "browser-profile" / "chrome" / "Default" / "Cookies"))
        assert got == "cookies-Profile 4", "no pin = native last_used"

    def test_re_sync_respects_pin_when_last_used_flips(self, tmp_path, monkeypatch):
        """The wrong-principal regression: session 2 with different last_used
        must NOT overlay a different profile's auth onto the pinned copy."""
        import hermes_cli.browser_connect as bc

        src = self._make_profile(tmp_path / "real", last_used="Profile 2")
        home = tmp_path / "hermes-home"
        monkeypatch.setattr(bc, "get_hermes_home", lambda: home)
        monkeypatch.setattr(bc, "_real_profile_pin", lambda: "Profile 2")

        dst1, err1 = bc.snapshot_real_profile("chrome", src=str(src))
        assert err1 is None

        # User browses HM (Profile 4) in between; last_used flips.
        (src / "Local State").write_text(
            json.dumps({"os_crypt": {}, "profile": {"last_used": "Profile 4"}})
        )
        _auth_db((src / "Profile 2" / "Cookies"), "cookies-Profile 2-v2")

        dst2, err2 = bc.snapshot_real_profile("chrome", src=str(src))
        assert err2 is None and dst2 == dst1
        got = _auth_db((home / "browser-profile" / "chrome" / "Default" / "Cookies"))
        assert got == "cookies-Profile 2-v2", "auth re-sync must stay on the pin"