"""Tests for the hand-rolled COSE_Sign1 sign/verify primitive."""

import cbor2
import pytest
from cryptography.hazmat.primitives.asymmetric import ec

from aliro_harness.issuer.cose import (
    CoseVerificationError,
    sign_cose_sign1,
    verify_cose_sign1,
)


def test_sign_then_verify_returns_original_payload():
    key = ec.generate_private_key(ec.SECP256R1())
    payload = b"hello, aliro"

    signed = sign_cose_sign1(
        private_key=key,
        payload=payload,
        kid=b"\x01\x02\x03\x04\x05\x06\x07\x08",
    )

    recovered = verify_cose_sign1(signed, key.public_key())
    assert recovered == payload


def test_verify_fails_with_wrong_key():
    signing_key = ec.generate_private_key(ec.SECP256R1())
    wrong_key = ec.generate_private_key(ec.SECP256R1())
    signed = sign_cose_sign1(
        private_key=signing_key,
        payload=b"aliro-a",
        kid=b"\x00" * 8,
    )

    with pytest.raises(CoseVerificationError):
        verify_cose_sign1(signed, wrong_key.public_key())


def test_signed_structure_is_well_formed_cose_sign1():
    """COSE_Sign1 wire format: 4-element CBOR array, alg in protected, ES256 = -7."""
    key = ec.generate_private_key(ec.SECP256R1())
    kid = b"\xaa\xbb\xcc\xdd\xee\xff\x11\x22"
    signed = sign_cose_sign1(private_key=key, payload=b"x", kid=kid)

    decoded = cbor2.loads(signed)
    assert isinstance(decoded, list)
    assert len(decoded) == 4

    protected_bstr, unprotected, payload_bstr, signature = decoded
    assert isinstance(protected_bstr, bytes)
    assert isinstance(unprotected, dict)
    assert isinstance(payload_bstr, bytes)
    assert isinstance(signature, bytes)

    protected = cbor2.loads(protected_bstr)
    assert protected == {1: -7}

    assert unprotected.get(4) == kid

    assert payload_bstr == b"x"

    assert len(signature) == 64


def test_signature_uses_raw_r_s_not_der():
    """COSE ECDSA signatures are raw r||s (64 bytes for P-256), not DER-encoded."""
    key = ec.generate_private_key(ec.SECP256R1())
    signed = sign_cose_sign1(private_key=key, payload=b"x", kid=b"\x00" * 8)
    signature = cbor2.loads(signed)[3]

    assert len(signature) == 64
    assert signature[0] != 0x30