"""The SDK transport names an unusable identity file instead of failing at dial.

openziti.load() accepts an unreadable or malformed identity, logs "configuration is invalid"
at the C layer and returns a context that only fails when something dials through it — as a
bare TypeError that reads like a missing intercept. env-dev-08 (2026-09-09) lost its identity
ACL to a tunneller rewrite and spent every tick reporting a mesh fault it did not have.
"""

from __future__ import annotations

import json

import pytest

from monky_deployd.transport import SdkTransport, TransportError


def _sdk(path):
    t = SdkTransport(str(path))
    return t


def test_missing_identity_is_named(tmp_path):
    with pytest.raises(TransportError) as e:
        _sdk(tmp_path / "absent.json")._check_identity_readable()
    assert "does not exist" in str(e.value)


def test_malformed_identity_is_named(tmp_path):
    p = tmp_path / "id.json"
    p.write_text("{not json")
    with pytest.raises(TransportError) as e:
        _sdk(p)._check_identity_readable()
    assert "not valid JSON" in str(e.value)


def test_unreadable_identity_points_at_the_group_grant(tmp_path, monkeypatch):
    p = tmp_path / "id.json"
    p.write_text(json.dumps({"ztAPI": "https://example.invalid"}))

    def _denied(*a, **k):
        raise PermissionError(13, "Permission denied")

    monkeypatch.setattr("builtins.open", _denied)
    with pytest.raises(TransportError) as e:
        _sdk(p)._check_identity_readable()
    msg = str(e.value)
    assert "not readable" in msg and "group" in msg


def test_a_good_identity_passes(tmp_path):
    p = tmp_path / "id.json"
    p.write_text(json.dumps({"ztAPI": "https://example.invalid"}))
    _sdk(p)._check_identity_readable()  # no raise