from __future__ import annotations

import pytest
from backup_tool.ssh_source import SSHSourcePublicConfig
from pydantic import ValidationError

VALID_CONFIG = {
    "hostname": "backup.example.test",
    "port": 22,
    "username": "backup",
    "host_key": "ssh-ed25519 AQID",
    "root": "/",
}


def test_ssh_source_config_is_closed_and_canonical() -> None:
    config = SSHSourcePublicConfig.model_validate(VALID_CONFIG)

    assert config.model_dump() == VALID_CONFIG


@pytest.mark.parametrize(
    "field,value",
    [
        ("hostname", "backup user@example.test"),
        ("hostname", "ssh://backup.example.test"),
        ("port", 0),
        ("port", 65536),
        ("username", "backup user"),
        ("username", "backup/root"),
        ("host_key", "ssh-ed25519 not-base64!"),
        ("host_key", "ssh-rsa AQID"),
        ("root", "/data"),
    ],
)
def test_ssh_source_config_rejects_invalid_public_values(field: str, value: object) -> None:
    invalid = {**VALID_CONFIG, field: value}

    with pytest.raises(ValidationError):
        SSHSourcePublicConfig.model_validate(invalid)


def test_ssh_source_config_rejects_non_public_connection_options() -> None:
    with pytest.raises(ValidationError):
        SSHSourcePublicConfig.model_validate({**VALID_CONFIG, "password": "not-allowed"})

    with pytest.raises(ValidationError):
        SSHSourcePublicConfig.model_validate({**VALID_CONFIG, "remote_command": "not-allowed"})