import pytest
from unittest.mock import patch, MagicMock
from openvpncertupdate import (
    revoke_issued, build_client_full, gen_crl, copy_crl, EasyRSAError,
)


def ok_result():
    r = MagicMock(); r.returncode = 0; r.stderr = ""; return r

def err_result():
    r = MagicMock(); r.returncode = 1; r.stderr = "oops"; return r


@patch("openvpncertupdate.subprocess.run")
def test_revoke_includes_required_args(mock_run):
    mock_run.return_value = ok_result()
    revoke_issued("/er", "/pki", "alice", "capass")
    args = mock_run.call_args[0][0]
    assert args[0] == "/er/easyrsa"
    assert "--batch" in args
    assert "--pki=/pki" in args
    assert "--passin=pass:capass" in args
    assert "revoke-issued" in args
    assert "alice" in args


@patch("openvpncertupdate.subprocess.run")
def test_revoke_omits_passin_when_empty(mock_run):
    mock_run.return_value = ok_result()
    revoke_issued("/er", "/pki", "alice", "")
    args = mock_run.call_args[0][0]
    assert not any(a.startswith("--passin") for a in args)


@patch("openvpncertupdate.subprocess.run")
def test_revoke_raises_on_failure(mock_run):
    mock_run.return_value = err_result()
    with pytest.raises(EasyRSAError, match="revoke-issued"):
        revoke_issued("/er", "/pki", "alice", "")


@patch("openvpncertupdate.subprocess.run")
def test_build_client_full_args(mock_run):
    mock_run.return_value = ok_result()
    build_client_full("/er", "/pki", "bob", "keypass", "capass")
    args = mock_run.call_args[0][0]
    assert "--passout=pass:keypass" in args
    assert "--passin=pass:capass" in args
    assert "build-client-full" in args
    assert "bob" in args


@patch("openvpncertupdate.subprocess.run")
def test_gen_crl_args(mock_run):
    mock_run.return_value = ok_result()
    gen_crl("/er", "/pki", "capass")
    args = mock_run.call_args[0][0]
    assert "gen-crl" in args


@patch("openvpncertupdate.shutil.copy2")
@patch("openvpncertupdate.os.chmod")
def test_copy_crl_copies_and_chmods(mock_chmod, mock_copy):
    copy_crl("/pki", "/etc/openvpn/crl.pem")
    mock_copy.assert_called_once_with("/pki/crl.pem", "/etc/openvpn/crl.pem")
    mock_chmod.assert_called_once_with("/etc/openvpn/crl.pem", 0o644)