"""Test: Git Push Auth-Strategien."""
import urllib.request, ssl, base64

secrets = {}
with open("project-audit/.secrets", "r", encoding="utf-8-sig") as f:
    for line in f:
        if "=" in line and not line.startswith("#"):
            k, v = line.strip().split("=", 1)
            secrets[k.strip()] = v.strip()

token = secrets.get("GITLAB_TOKEN_AUDIT", "")
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

base_url = "https://git.tech.rz.db.de/AndreKnie/project-audit.git"

# Test 1: Basic Auth mit oauth2:token (GitLab-Standard fuer PAT ueber HTTP)
print("=== Test 1: Basic Auth (oauth2:token) ===")
url1 = base_url + "/info/refs?service=git-receive-pack"
creds = base64.b64encode(f"oauth2:{token}".encode()).decode()
req1 = urllib.request.Request(url1)
req1.add_header("Authorization", "Basic " + creds)
try:
    resp1 = urllib.request.urlopen(req1, context=ctx, timeout=15)
    print("Status:", resp1.status)
    body = resp1.read(300)
    print("OK! Endpunkt erreichbar.")
    print("Body:", body[:200])
except Exception as e:
    print("FEHLER:", e)

print()

# Test 2: Basic Auth mit username:token
print("=== Test 2: Basic Auth (AndreKnie:token) ===")
creds2 = base64.b64encode(f"AndreKnie:{token}".encode()).decode()
req2 = urllib.request.Request(url1)
req2.add_header("Authorization", "Basic " + creds2)
try:
    resp2 = urllib.request.urlopen(req2, context=ctx, timeout=15)
    print("Status:", resp2.status)
    print("OK! Endpunkt erreichbar.")
except Exception as e:
    print("FEHLER:", e)

print()

# Test 3: Token in URL (https://oauth2:token@host/...)
print("=== Test 3: Token in URL ===")
url3 = f"https://oauth2:{token}@git.tech.rz.db.de/AndreKnie/project-audit.git/info/refs?service=git-receive-pack"
req3 = urllib.request.Request(url3)
try:
    resp3 = urllib.request.urlopen(req3, context=ctx, timeout=15)
    print("Status:", resp3.status)
    print("OK! Endpunkt erreichbar.")
except Exception as e:
    print("FEHLER:", e)

print()

# Test 4: upload-pack mit Basic Auth (Lese-Endpunkt zum Vergleich)
print("=== Test 4: upload-pack mit Basic Auth (Vergleich) ===")
url4 = base_url + "/info/refs?service=git-upload-pack"
req4 = urllib.request.Request(url4)
req4.add_header("Authorization", "Basic " + creds)
try:
    resp4 = urllib.request.urlopen(req4, context=ctx, timeout=15)
    print("Status:", resp4.status)
    print("OK! Lese-Endpunkt erreichbar.")
except Exception as e:
    print("FEHLER:", e)