# 合同系统账密：只认环境变量或入参，仓库里没有默认密码。

from __future__ import annotations

from pathlib import Path

import pytest

from contract_create_node import (
    ContractCreateError,
    ContractCreateInput,
    resolve_contract_credentials,
)


# 不设 CONTRACT_USERNAME / CONTRACT_PASSWORD 且无入参时入口失败。
def test_resolve_credentials_requires_env(monkeypatch):
    monkeypatch.delenv("CONTRACT_USERNAME", raising=False)
    monkeypatch.delenv("CONTRACT_PASSWORD", raising=False)
    with pytest.raises(ContractCreateError, match="CONTRACT_USERNAME"):
        resolve_contract_credentials()


# 环境变量齐时返回账密。
def test_resolve_credentials_uses_env(monkeypatch):
    monkeypatch.setenv("CONTRACT_USERNAME", "u")
    monkeypatch.setenv("CONTRACT_PASSWORD", "p")
    assert resolve_contract_credentials() == ("u", "p")


# 入参优先于环境变量。
def test_resolve_credentials_prefers_explicit(monkeypatch):
    monkeypatch.setenv("CONTRACT_USERNAME", "env-u")
    monkeypatch.setenv("CONTRACT_PASSWORD", "env-p")
    assert resolve_contract_credentials("u", "p") == ("u", "p")


# ContractCreateInput 不再内置测试账密。
def test_create_input_has_no_default_password():
    spec = ContractCreateInput(
        job_id="j",
        supplier_name="s",
        order_date="2026-10-01",
        source_type="",
    )
    assert spec.username == ""
    assert spec.password == ""


# 合同包源码里搜不到默认账号 10007228。
def test_source_has_no_hardcoded_contract_account():
    root = Path(__file__).resolve().parent.parent
    skipped = {"tests", ".venv", "__pycache__"}
    hits: list[str] = []
    for path in root.rglob("*"):
        if any(part in skipped for part in path.parts):
            continue
        if path.suffix not in {".py", ".md", ".json"}:
            continue
        text = path.read_text(encoding="utf-8")
        if "10007228" in text:
            hits.append(str(path.relative_to(root)))
    assert hits == []