"""Injected proxy responses only. Real 403 observations are recorded separately."""
import io,json,unittest,urllib.error
from unittest.mock import patch
from infinbot_proxy import read_proxy_json,proxy_target,ProxyError,check_account
from verify_live_feeds_standalone import read_json,account_credentials,ForesixaLiveFeedVerifier
from alpaca_rotation_check import AlpacaCredentialRotationCheck

class Reply:
    def __init__(self,data,content_type='application/json'):
        self.status=200;self.headers={'Content-Type':content_type};self.raw=json.dumps(data).encode()
    def read(self,limit):return self.raw[:limit]
    def __enter__(self):return self
    def __exit__(self,*args):pass

class ProxyTests(unittest.TestCase):
    def test_legacy_urls_are_sent_only_to_pinned_proxy_without_credentials(self):
        requests=[]
        class Opener:
            def open(self,request,**kwargs):requests.append(request);return Reply({})
        for host in ('api.alpaca.markets','paper-api.alpaca.markets'):
            read_proxy_json('https://'+host+'/v2/account',opener=Opener())
        self.assertTrue(all(r.full_url=='https://sotality.com/v2/account' for r in requests))
        self.assertTrue(all(r.get_method()=='GET' and dict(r.header_items())=={'Accept':'application/json'} for r in requests))
    def test_sensitive_headers_are_never_forwarded_by_compatibility_transport(self):
        requests=[]
        class Opener:
            def open(self,request,**kwargs):requests.append(request);return Reply({})
        with patch('infinbot_proxy.urllib.request.build_opener',return_value=Opener()):
            read_json('https://paper-api.alpaca.markets/v2/account',{'APCA-API-KEY-ID':'TEST_ONLY','APCA-API-SECRET-KEY':'TEST_ONLY'})
        self.assertEqual(dict(requests[0].header_items()),{'Accept':'application/json'})
    def test_403_and_redirect_are_failures_without_retry_or_fallback(self):
        for code in (403,302):
            calls=[]
            class Opener:
                def open(self,request,**kwargs):
                    calls.append(request.full_url);raise urllib.error.HTTPError(request.full_url,code,'private error omitted',{},io.BytesIO(b'PRIVATE_BODY_NOT_DISPLAYED'))
            with self.assertRaises(ProxyError) as caught:read_proxy_json('https://sotality.com/v2/account',opener=Opener())
            self.assertEqual(caught.exception.http_status,code);self.assertEqual(calls,['https://sotality.com/v2/account'])
            self.assertNotIn('PRIVATE_BODY',str(caught.exception))
    def test_html_200_does_not_validate_account(self):
        class Opener:
            def open(self,*args,**kwargs):return Reply({},'text/html')
        with self.assertRaises(ProxyError):read_proxy_json('https://sotality.com/v2/account',opener=Opener())
    def test_order_untrusted_host_and_credential_query_routes_block(self):
        for url in ('https://sotality.com/v2/orders','https://attacker.invalid/v2/account','https://sotality.com/v2/stocks/bars?api_key=TEST','https://sotality.com/v2/account?mode=live'):
            with self.assertRaises(ProxyError):proxy_target(url)
    def test_account_validation_does_not_claim_upstream_storage_or_mode(self):
        account={'id':'ISOLATED_TEST','status':'ACTIVE','trading_blocked':False,'cash':'1','equity':'1','buying_power':'1'}
        with patch('infinbot_proxy.read_proxy_json',return_value=account):report=check_account()
        self.assertEqual(report['status'],'PROXY_ACCOUNT_READ_VALIDATED');self.assertEqual(report['upstream_account_mode'],'UNVERIFIED')
        self.assertFalse(report['upstream_token_storage_verified']);self.assertFalse(report['engine_started'])
    def test_default_rotation_never_opens_private_pair_files(self):
        with patch('alpaca_rotation_check.credentials') as loader:
            result=AlpacaCredentialRotationCheck().run('/not/read/old.json','/not/read/new.json','paper');loader.assert_not_called()
        self.assertEqual(result['status'],'BROKER_ROTATION_CHECK_UNVERIFIED')
    def test_checker_rejects_client_credential_ingestion(self):
        result=json.loads(ForesixaLiveFeedVerifier().execute_exchange_stream_validation(credentials_path='/not/read/private.env'))
        self.assertEqual(result['status'],'CONFIGURATION_BLOCKED')
        base,headers=account_credentials({},'paper');self.assertEqual(base,'https://sotality.com');self.assertEqual(headers,{})

if __name__=='__main__':unittest.main()