"""Web Bot Auth signing/verification round-trips. Not wired to any production
route yet — see the module docstring for the activation prerequisite."""
import time

import pytest
from src.core.web_bot_auth import (
    build_key_directory,
    generate_signing_key,
    load_signing_key,
    sign_request_headers,
    verify_signed_headers,
)


def test_signed_request_verifies_against_the_public_key():
    key = generate_signing_key()
    headers = sign_request_headers(
        authority="example.com", signing_key=key, signature_agent_url="https://p2hs.com"
    )
    assert headers["Signature-Agent"] == '"https://p2hs.com"'
    assert 'tag="web-bot-auth"' in headers["Signature-Input"]
    assert '"signature-agent"' in headers["Signature-Input"]
    assert 'alg="ed25519"' in headers["Signature-Input"]
    assert verify_signed_headers(authority="example.com", headers=headers, public_key=key.public_key)


def test_signature_agent_must_be_https():
    key = generate_signing_key()
    with pytest.raises(ValueError):
        sign_request_headers(authority="example.com", signing_key=key, signature_agent_url="http://p2hs.com")


def test_tampering_with_the_authority_invalidates_the_signature():
    key = generate_signing_key()
    headers = sign_request_headers(authority="example.com", signing_key=key, signature_agent_url="https://p2hs.com")
    assert not verify_signed_headers(authority="attacker.example", headers=headers, public_key=key.public_key)


def test_wrong_key_fails_verification():
    key = generate_signing_key()
    other = generate_signing_key()
    headers = sign_request_headers(authority="example.com", signing_key=key, signature_agent_url="https://p2hs.com")
    assert not verify_signed_headers(authority="example.com", headers=headers, public_key=other.public_key)


def test_expired_signature_is_rejected():
    key = generate_signing_key()
    headers = sign_request_headers(
        authority="example.com", signing_key=key, signature_agent_url="https://p2hs.com",
        ttl_seconds=60, now=int(time.time()) - 3600,
    )
    assert not verify_signed_headers(authority="example.com", headers=headers, public_key=key.public_key)


def test_keyid_defaults_to_a_stable_jwk_thumbprint():
    key = generate_signing_key()
    assert key.keyid == key.public_jwk_thumbprint_keyid
    assert key.to_jwk()["kid"] == key.keyid


def test_private_key_round_trips_through_pkcs8_storage_bytes():
    """Simulates loading the private key back out of a secret manager."""
    key = generate_signing_key()
    reloaded = load_signing_key(key.keyid, key.private_bytes_pkcs8())
    headers = sign_request_headers(authority="example.com", signing_key=reloaded, signature_agent_url="https://p2hs.com")
    assert verify_signed_headers(authority="example.com", headers=headers, public_key=key.public_key)


def test_key_directory_is_self_signed_and_covers_all_current_keys():
    old_key = generate_signing_key()
    new_key = generate_signing_key()
    body, headers = build_key_directory(keys=[old_key, new_key], signing_key=new_key, signature_agent_url="https://p2hs.com")
    assert headers["Content-Type"] == "application/http-message-signatures-directory+json"
    assert f'keyid="{new_key.keyid}"' in headers["Signature-Input"]
    assert 'tag="http-message-signatures-directory"' in headers["Signature-Input"]
    import json
    parsed = json.loads(body)
    assert {k["kid"] for k in parsed["keys"]} == {old_key.keyid, new_key.keyid}