"""
Tests for Proxmox authentication helpers.
"""

import os
from unittest.mock import patch

import pytest

from proxmox_mcp.utils.auth import load_auth_from_env, normalize_token_name


def test_normalize_token_name_accepts_bare_name():
    assert normalize_token_name("devin@pve", "devin-codex") == "devin-codex"


def test_normalize_token_name_accepts_full_token_id():
    assert normalize_token_name("devin@pve", "devin@pve!devin-codex") == "devin-codex"


def test_normalize_token_name_rejects_mismatched_full_token_id():
    with pytest.raises(ValueError, match="different user"):
        normalize_token_name("devin@pve", "root@pam!devin-codex")


def test_load_auth_from_env_normalizes_full_token_id():
    env = {
        "PROXMOX_USER": "devin@pve",
        "PROXMOX_TOKEN_NAME": "devin@pve!devin-codex",
        "PROXMOX_TOKEN_VALUE": "secret-value",
    }
    with patch.dict(os.environ, env, clear=False):
        auth = load_auth_from_env()

    assert auth.user == "devin@pve"
    assert auth.token_name == "devin-codex"
    assert auth.token_value == "secret-value"