"""
tests/test_remember_sentinel_guard.py — Verify that the _UNAUTHENTICATED
sentinel does NOT bypass the owner_id guard in the remember endpoint.

Regression test for 100yenadmin/electric-sheep#1544.
"""
from __future__ import annotations

import pytest

from cortex.api.deps import _UNAUTHENTICATED
from cortex.api.routes.memory.remember import _sanitize_auth_owner


class _FakeState:
    """Minimal request.state stub."""
    def __init__(self, owner_id=None):
        self.owner_id = owner_id


class _FakeRequest:
    """Minimal Request stub for the remember guard logic."""
    def __init__(self, state):
        self.state = state


def _remember_guard(body_owner_id, request):
    """Replicate the guard logic from remember.py for unit testing.

    Returns True if the guard would ALLOW the request (owner resolved),
    False if it would REJECT (raise HTTPException).
    """
    _auth_owner = _sanitize_auth_owner(request)
    if not body_owner_id and not _auth_owner:
        return False  # would raise HTTPException
    return True


class TestSanitizeAuthOwner:
    """Unit tests for the _sanitize_auth_owner helper."""

    def test_sentinel_returns_none(self):
        """_UNAUTHENTICATED sentinel must be converted to None."""
        req = _FakeRequest(_FakeState(owner_id=_UNAUTHENTICATED))
        assert _sanitize_auth_owner(req) is None

    def test_none_returns_none(self):
        """None owner_id passes through as None."""
        req = _FakeRequest(_FakeState(owner_id=None))
        assert _sanitize_auth_owner(req) is None

    def test_real_owner_passes_through(self):
        """A real owner_id string passes through unchanged."""
        req = _FakeRequest(_FakeState(owner_id="user-123"))
        assert _sanitize_auth_owner(req) == "user-123"

    def test_no_state_attribute_returns_none(self):
        """Missing owner_id attribute on state returns None gracefully."""
        class _NoAttrState:
            pass
        req = _FakeRequest(_NoAttrState())
        assert _sanitize_auth_owner(req) is None

    def test_sentinel_is_truthy(self):
        """Confirm the sentinel is truthy — without the fix it would bypass guards."""
        assert bool(_UNAUTHENTICATED) is True


class TestSentinelBypass:
    """Ensure _UNAUTHENTICATED sentinel is treated as 'no owner' in the guard."""

    def test_sentinel_blocked_by_guard(self):
        """With sentinel as auth owner and no body owner_id, guard should reject."""
        req = _FakeRequest(_FakeState(owner_id=_UNAUTHENTICATED))
        assert _remember_guard(body_owner_id=None, request=req) is False

    def test_none_blocked_by_guard(self):
        """With None auth owner and no body owner_id, guard should reject."""
        req = _FakeRequest(_FakeState(owner_id=None))
        assert _remember_guard(body_owner_id=None, request=req) is False

    def test_real_owner_passes_guard(self):
        """With a real owner_id, guard should allow."""
        req = _FakeRequest(_FakeState(owner_id="user-123"))
        assert _remember_guard(body_owner_id=None, request=req) is True

    def test_body_owner_passes_guard(self):
        """With body owner_id provided, guard should allow even with sentinel."""
        req = _FakeRequest(_FakeState(owner_id=_UNAUTHENTICATED))
        assert _remember_guard(body_owner_id="user-456", request=req) is True

    def test_no_state_blocked(self):
        """With no owner_id attribute at all, guard should reject."""
        req = _FakeRequest(_FakeState())
        assert _remember_guard(body_owner_id=None, request=req) is False
