"""Round-trip tests for the DPAPI-backed secrets store.

These are skipped automatically on non-Windows so the test suite stays cross-
platform.  On Windows, DPAPI is part of the OS — no extra deps required.
"""
from __future__ import annotations

import sys
import unittest

from proxy_chain_manager import secrets_store


@unittest.skipUnless(sys.platform == "win32", "DPAPI only on Windows")
class TestSecretsStore(unittest.TestCase):
    def test_empty_passthrough(self) -> None:
        self.assertEqual(secrets_store.encrypt(""), "")
        self.assertEqual(secrets_store.decrypt(""), "")

    def test_legacy_plaintext_passthrough(self) -> None:
        # Anything without the DPAPI: prefix decrypts to itself so migration
        # from plaintext files is automatic on first read.
        self.assertEqual(secrets_store.decrypt("legacy_pw"), "legacy_pw")

    def test_round_trip_ascii(self) -> None:
        secret = "hunter2!"
        token = secrets_store.encrypt(secret)
        self.assertTrue(token.startswith("DPAPI:v1:"))
        self.assertEqual(secrets_store.decrypt(token), secret)

    def test_round_trip_unicode(self) -> None:
        secret = "пароль · 🔐 · café"
        token = secrets_store.encrypt(secret)
        self.assertEqual(secrets_store.decrypt(token), secret)

    def test_double_encrypt_idempotent(self) -> None:
        token = secrets_store.encrypt("once")
        again = secrets_store.encrypt(token)
        self.assertEqual(token, again)

    def test_is_encrypted_helper(self) -> None:
        self.assertFalse(secrets_store.is_encrypted(""))
        self.assertFalse(secrets_store.is_encrypted("plaintext"))
        self.assertTrue(secrets_store.is_encrypted(secrets_store.encrypt("x")))


if __name__ == "__main__":
    unittest.main()