import hashlib
import hmac

from gitea_microvm_runner import controller


def test_accepts_matching_queued_job(monkeypatch):
    monkeypatch.setattr(controller, "LABEL", "kind-microvm")
    assert controller.accepts({
        "action": "queued",
        "workflow_job": {"id": 47, "labels": ["linux", "kind-microvm"]},
    }) == (True, "47")


def test_rejects_other_actions_labels_and_boolean_id(monkeypatch):
    monkeypatch.setattr(controller, "LABEL", "kind-microvm")
    assert controller.accepts({"action": "completed", "workflow_job": {"id": 1, "labels": ["kind-microvm"]}}) == (False, None)
    assert controller.accepts({"action": "queued", "workflow_job": {"id": 1, "labels": ["host"]}}) == (False, None)
    assert controller.accepts({"action": "queued", "workflow_job": {"id": True, "labels": ["kind-microvm"]}}) == (False, None)


def test_signature_accepts_gitea_and_prefixed_forms(tmp_path, monkeypatch):
    secret = b"test-secret"
    body = b'{"action":"queued"}'
    secret_file = tmp_path / "secret"
    secret_file.write_bytes(secret)
    monkeypatch.setattr(controller, "WEBHOOK_SECRET_FILE", secret_file)
    digest = hmac.new(secret, body, hashlib.sha256).hexdigest()
    assert controller.valid_signature(body, digest)
    assert controller.valid_signature(body, f"sha256={digest}")
    assert not controller.valid_signature(body, "bad")