from eth_account import Account

from src.tools.hl_credential_matrix import build_credential_matrix


def _write_env(path, *, wallet, private_key, api_key):
    path.write_text(
        f"HL_WALLET_ADDRESS={wallet}\n"
        f"HL_API_PRIVATE_KEY={private_key}\n"
        "API Wallet Name=Hermes Agent\n"
        f"API Key={api_key}\n",
        encoding="utf-8",
    )


def test_credential_matrix_masks_and_detects_same_private_key(tmp_path):
    signer = Account.create()
    main_wallet = Account.create().address
    test_wallet = Account.create().address
    _write_env(tmp_path / "Mainnet.env", wallet=main_wallet, private_key=signer.key.hex(), api_key=Account.create().address)
    _write_env(tmp_path / "Testnet.env", wallet=test_wallet, private_key=signer.key.hex(), api_key=signer.address)

    result = build_credential_matrix(base_dir=tmp_path)

    assert result["warnings"] == ["same_private_key_used_in_both_envs"]
    rows = result["files"]
    assert [row["file"] for row in rows] == [str(tmp_path / "Mainnet.env"), str(tmp_path / "Testnet.env")]
    assert rows[0]["env_guess"] == "mainnet"
    assert rows[1]["env_guess"] == "testnet"
    assert rows[0]["private_key_matches_API_Key"] is False
    assert rows[1]["private_key_matches_API_Key"] is True
    assert rows[1]["safe_for_testnet_signed_probe"] is True
    assert signer.key.hex() not in str(result)


def test_credential_matrix_recommends_wallet_as_account_and_signer_as_derived(tmp_path):
    signer = Account.create()
    wallet = Account.create().address
    _write_env(tmp_path / "Testnet.env", wallet=wallet, private_key=signer.key.hex(), api_key=signer.address)

    result = build_credential_matrix(base_dir=tmp_path)
    row = result["files"][0]

    assert row["recommended_account_address"].startswith(wallet[:6])
    assert row["recommended_signer_address"].startswith(signer.address[:6])
    assert row["looks_like_api_wallet_private_key"] is True
    assert row["looks_like_main_wallet_private_key"] is False