from click.testing import CliRunner
from cryptography.hazmat.primitives.asymmetric import ec

from aliro_harness.issuer.cose import verify_cose_sign1
from aliro_harness.issuer.keys import load_private_key_pem
from aliro_harness.trustgen.cli import main


def test_init_creates_all_artifacts(tmp_path):
    runner = CliRunner()
    result = runner.invoke(main, ["init", "--out-dir", str(tmp_path)])

    assert result.exit_code == 0, result.output
    assert (tmp_path / "issuer.pem").is_file()
    assert (tmp_path / "reader.pem").is_file()
    assert (tmp_path / "access_credential.pem").is_file()
    assert (tmp_path / "reader_group_id.bin").is_file()
    assert (tmp_path / "reader_group_sub_id.bin").is_file()
    assert (tmp_path / "access_document.bin").is_file()
    assert (tmp_path / "device_response.bin").is_file()
    assert (tmp_path / "aliro_trust.h").is_file()


def test_init_writes_consistent_issuer_and_access_document(tmp_path):
    """The Access Document must verify against the issuer public key on disk."""
    runner = CliRunner()
    result = runner.invoke(main, ["init", "--out-dir", str(tmp_path)])
    assert result.exit_code == 0, result.output

    issuer = load_private_key_pem(tmp_path / "issuer.pem")
    access_doc = (tmp_path / "access_document.bin").read_bytes()

    payload = verify_cose_sign1(access_doc, issuer.public_key())
    assert len(payload) > 0


def test_init_refuses_to_overwrite_without_force(tmp_path):
    (tmp_path / "issuer.pem").write_bytes(b"dummy")

    runner = CliRunner()
    result = runner.invoke(main, ["init", "--out-dir", str(tmp_path)])

    assert result.exit_code != 0
    assert "force" in result.output.lower()


def test_init_force_overwrites(tmp_path):
    (tmp_path / "issuer.pem").write_bytes(b"dummy")

    runner = CliRunner()
    result = runner.invoke(main, ["init", "--out-dir", str(tmp_path), "--force"])

    assert result.exit_code == 0, result.output
    loaded = load_private_key_pem(tmp_path / "issuer.pem")
    assert isinstance(loaded, ec.EllipticCurvePrivateKey)


def test_reader_group_id_is_16_bytes(tmp_path):
    runner = CliRunner()
    result = runner.invoke(main, ["init", "--out-dir", str(tmp_path)])
    assert result.exit_code == 0, result.output
    assert (tmp_path / "reader_group_id.bin").stat().st_size == 16
    assert (tmp_path / "reader_group_sub_id.bin").stat().st_size == 16


def test_trust_header_references_issuer_on_disk(tmp_path):
    """Header should embed the same issuer key that signed the access_document."""
    runner = CliRunner()
    result = runner.invoke(main, ["init", "--out-dir", str(tmp_path)])
    assert result.exit_code == 0, result.output

    issuer = load_private_key_pem(tmp_path / "issuer.pem")
    header = (tmp_path / "aliro_trust.h").read_text()

    n = issuer.public_key().public_numbers()
    first_byte_of_x = f"0x{n.x.to_bytes(32, 'big')[0]:02x}"
    pub_x_idx = header.index("ALIRO_ISSUER_PUB_X")
    pub_x_end = header.index("\n", pub_x_idx)
    assert first_byte_of_x in header[pub_x_idx:pub_x_end]