"""Render a C header embedding the v1 Aliro trust anchors.

Consumed at build time by the reader firmware. Format intentionally matches
the byte-array conventions used by X-CUBE-ALIRO's provisioning.c: 32-byte
raw private scalar, 64-byte x||y public point (no 0x04 prefix).
"""

from dataclasses import dataclass

from cryptography.hazmat.primitives.asymmetric import ec

from aliro_harness.issuer.kid import compute_issuer_kid

_P256_COORD_LEN = 32


@dataclass
class TrustBundle:
    issuer_public_key: ec.EllipticCurvePublicKey
    reader_private_key: ec.EllipticCurvePrivateKey
    reader_group_id: bytes
    reader_group_sub_id: bytes


def _c_byte_array(data: bytes) -> str:
    return "{ " + ", ".join(f"0x{b:02x}" for b in data) + " }"


def _priv_scalar(key: ec.EllipticCurvePrivateKey) -> bytes:
    return key.private_numbers().private_value.to_bytes(_P256_COORD_LEN, "big")


def _pub_xy(key: ec.EllipticCurvePublicKey) -> tuple[bytes, bytes]:
    n = key.public_numbers()
    return (
        n.x.to_bytes(_P256_COORD_LEN, "big"),
        n.y.to_bytes(_P256_COORD_LEN, "big"),
    )


def render_trust_header(bundle: TrustBundle) -> str:
    reader_priv = _priv_scalar(bundle.reader_private_key)
    reader_x, reader_y = _pub_xy(bundle.reader_private_key.public_key())
    issuer_x, issuer_y = _pub_xy(bundle.issuer_public_key)
    kid = compute_issuer_kid(bundle.issuer_public_key)

    lines = [
        "/* aliro_trust.h - AUTO-GENERATED by aliro-trustgen.  DO NOT EDIT. */",
        "/* Regenerate from the canonical keys under harness/trustgen/out/.  */",
        "",
        "#ifndef ALIRO_TRUST_H_",
        "#define ALIRO_TRUST_H_",
        "",
        "/* Reader long-term ECC P-256 key pair. */",
        "/* Private: 32-byte raw scalar.                */",
        "/* Public:  64-byte x||y (no 0x04 prefix).     */",
        f"#define ALIRO_READER_PRIVATE_KEY {_c_byte_array(reader_priv)}",
        f"#define ALIRO_READER_PUBLIC_KEY  {_c_byte_array(reader_x + reader_y)}",
        "",
        "/* Reader group identifiers (spec \u00a76.2). */",
        f"#define ALIRO_READER_GROUP_ID     {_c_byte_array(bundle.reader_group_id)}",
        f"#define ALIRO_READER_GROUP_SUB_ID {_c_byte_array(bundle.reader_group_sub_id)}",
        "",
        "/* Credential Issuer trust anchor (raw ECC P-256 public key). */",
        f"#define ALIRO_ISSUER_PUB_X {_c_byte_array(issuer_x)}",
        f"#define ALIRO_ISSUER_PUB_Y {_c_byte_array(issuer_y)}",
        f"#define ALIRO_ISSUER_PUB   {_c_byte_array(issuer_x + issuer_y)}",
        "",
        "/* kid for IssuerAuth header (spec \u00a77.2.1, 8 bytes). */",
        f"#define ALIRO_ISSUER_KID {_c_byte_array(kid)}",
        "",
        "/* ----------------------------------------------------------------- */",
        "/* X-CUBE-ALIRO vendor-compat overrides for User_provisioning.h.     */",
        "/* Gated by ALIRO_TRUST_OVERRIDE so firmware projects that don't    */",
        "/* opt in keep the vendor defaults.                                  */",
        "#ifdef ALIRO_TRUST_OVERRIDE",
        "",
        "/* READER_ID_* = group_id || group_sub_id (32B concatenated).        */",
        "#undef READER_ID_2",
        "#undef READER_ID",
        f"#define READER_ID_2 {_c_byte_array(bundle.reader_group_id + bundle.reader_group_sub_id)}",
        f"#define READER_ID   {_c_byte_array(bundle.reader_group_id + bundle.reader_group_sub_id)}",
        "",
        "#undef READER_PUB_KEY_2",
        "#undef READER_PUB_KEY",
        f"#define READER_PUB_KEY_2 {_c_byte_array(reader_x + reader_y)}",
        f"#define READER_PUB_KEY   {_c_byte_array(reader_x + reader_y)}",
        "",
        "#undef READER_PRIVATE_KEY_2",
        "#undef READER_PRIVATE_KEY",
        f"#define READER_PRIVATE_KEY_2 {_c_byte_array(reader_priv)}",
        f"#define READER_PRIVATE_KEY   {_c_byte_array(reader_priv)}",
        "",
        "#undef CREDENTIAL_ISSUER_PUB_KEY_2",
        f"#define CREDENTIAL_ISSUER_PUB_KEY_2 {_c_byte_array(issuer_x + issuer_y)}",
        "",
        "#endif /* ALIRO_TRUST_OVERRIDE */",
        "",
        "#endif /* ALIRO_TRUST_H_ */",
        "",
    ]
    return "\n".join(lines)
