import pytest

from voice_transcriptor.services.credentials import CredentialError, CredentialService


class FakeKeyring:
    def __init__(self) -> None:
        self.value: str | None = None
        self.calls: list[tuple[str, str, str | None]] = []

    def get_password(self, service: str, account: str) -> str | None:
        self.calls.append(("get", service, account))
        return self.value

    def set_password(self, service: str, account: str, value: str) -> None:
        self.calls.append(("set", service, account, value))
        self.value = value


def test_get_api_key_uses_stable_keyring_service_and_account() -> None:
    backend = FakeKeyring()
    backend.value = "secret"

    assert CredentialService(backend).get_api_key() == "secret"
    assert backend.calls == [("get", "voice-transcriptor", "openai-api-key")]


def test_has_api_key_reflects_keyring_value() -> None:
    backend = FakeKeyring()
    service = CredentialService(backend)

    assert service.has_api_key() is False
    backend.value = "secret"
    assert service.has_api_key() is True


def test_set_api_key_rejects_blank_values() -> None:
    backend = FakeKeyring()

    with pytest.raises(CredentialError, match="API key"):
        CredentialService(backend).set_api_key("  \t")

    assert backend.calls == []


def test_set_api_key_persists_nonblank_value() -> None:
    backend = FakeKeyring()

    CredentialService(backend).set_api_key("secret")

    assert backend.calls == [("set", "voice-transcriptor", "openai-api-key", "secret")]


@pytest.mark.parametrize("method", ["get_password", "set_password"])
def test_backend_failures_are_sanitized(method: str) -> None:
    class FailingKeyring:
        def get_password(self, service: str, account: str) -> str | None:
            raise RuntimeError("backend leaked secret")

        def set_password(self, service: str, account: str, value: str) -> None:
            raise RuntimeError("backend leaked secret")

    service = CredentialService(FailingKeyring())

    with pytest.raises(CredentialError) as caught:
        if method == "get_password":
            service.get_api_key()
        else:
            service.set_api_key("secret")

    assert "secret" not in str(caught.value).lower()
    assert caught.value.__cause__ is None