"""Tests for the Cloud-grant JWT signing-secret fallback fix (audit finding F-02)."""
import pytest

from src.core.security.cloud_tokens import _signing_secret


def _clear_cloud_token_env(monkeypatch):
    for key in ("CLOUD_GRANT_JWT_SECRET", "ENVIRONMENT", "JWT_SECRET"):
        monkeypatch.delenv(key, raising=False)


def test_signing_secret_raises_outside_dev_when_unset(monkeypatch):
    _clear_cloud_token_env(monkeypatch)
    monkeypatch.setenv("ENVIRONMENT", "prod")
    with pytest.raises(RuntimeError, match="CLOUD_GRANT_JWT_SECRET"):
        _signing_secret()


def test_signing_secret_falls_back_in_dev_when_unset(monkeypatch):
    _clear_cloud_token_env(monkeypatch)
    monkeypatch.setenv("ENVIRONMENT", "dev")
    monkeypatch.setenv("JWT_SECRET", "dev-only-fallback")
    assert _signing_secret() == "dev-only-fallback"


def test_signing_secret_uses_dedicated_secret_when_set(monkeypatch):
    _clear_cloud_token_env(monkeypatch)
    monkeypatch.setenv("ENVIRONMENT", "prod")
    monkeypatch.setenv("CLOUD_GRANT_JWT_SECRET", "a-real-dedicated-secret")
    assert _signing_secret() == "a-real-dedicated-secret"