from __future__ import annotations

import pytest

from yuxi.channels.adapters.telegram.security import TelegramSecurityPolicy


class TestPairingFixes:
    def test_pairing_denies_unknown_user(self):
        policy = TelegramSecurityPolicy({"dm_policy": "pairing", "pairing_code": "abc123"})
        allowed, msg = policy.check_dm_policy("999")
        assert not allowed
        assert "not paired" in msg.lower()

    def test_pair_user_with_correct_code(self):
        policy = TelegramSecurityPolicy({"dm_policy": "pairing", "pairing_code": "abc123"})
        ok, msg = policy.pair_user("999", "abc123")
        assert ok
        assert "paired" in msg.lower()

    def test_pair_user_with_wrong_code(self):
        policy = TelegramSecurityPolicy({"dm_policy": "pairing", "pairing_code": "abc123"})
        ok, msg = policy.pair_user("999", "wrong_code")
        assert not ok
        assert "invalid" in msg.lower()

    def test_paired_user_is_allowed(self):
        policy = TelegramSecurityPolicy({"dm_policy": "pairing", "pairing_code": "abc123"})
        policy.pair_user("999", "abc123")
        allowed, msg = policy.check_dm_policy("999")
        assert allowed

    def test_unpair_user(self):
        policy = TelegramSecurityPolicy({"dm_policy": "pairing", "pairing_code": "abc123"})
        policy.pair_user("999", "abc123")
        assert policy.unpair_user("999")
        allowed, msg = policy.check_dm_policy("999")
        assert not allowed

    def test_unpair_nonexistent_user(self):
        policy = TelegramSecurityPolicy({"dm_policy": "pairing", "pairing_code": "abc123"})
        assert not policy.unpair_user("999")

    def test_allowlist_still_works(self):
        policy = TelegramSecurityPolicy({"dm_policy": "allowlist", "allow_from": ["tg:111"]})
        assert policy.check_dm_policy("111")[0]
        assert not policy.check_dm_policy("999")[0]

    def test_open_still_works(self):
        policy = TelegramSecurityPolicy({"dm_policy": "open"})
        allowed, msg = policy.check_dm_policy("any_user")
        assert allowed

    def test_disabled_still_works(self):
        policy = TelegramSecurityPolicy({"dm_policy": "disabled"})
        allowed, msg = policy.check_dm_policy("any_user")
        assert not allowed

    def test_verify_pairing_code_timing_safe(self):
        policy = TelegramSecurityPolicy({"pairing_code": "secret123"})
        assert policy.verify_pairing_code("secret123")
        assert not policy.verify_pairing_code("wrong")

    def test_autogenerated_pairing_code(self):
        policy = TelegramSecurityPolicy({"dm_policy": "pairing"})
        assert len(policy._pairing_code) == 12