"""Offline round-trip: reader transaction orchestrator vs. in-process fake card."""

from cryptography.hazmat.primitives.asymmetric import ec

from aliro_harness.reader.transaction import (
    TransactionResult,
    TrustBundle,
    run_aliro_transaction,
)
from tests.fake_card import FakeAliroCard


def _make_keys():
    reader = ec.generate_private_key(ec.SECP256R1())
    cred = ec.generate_private_key(ec.SECP256R1())
    return reader, cred


def test_transaction_against_in_process_fake_card_succeeds():
    reader, cred = _make_keys()
    bundle = TrustBundle.synthesize(
        reader_priv=reader, credential_pub=cred.public_key()
    )

    fake = FakeAliroCard.provisioned(
        reader_pub=reader.public_key(),
        credential_priv=cred,
        credential_pub=cred.public_key(),
    )

    result = run_aliro_transaction(transmit=fake.transmit, bundle=bundle)
    assert result.ok, f"expected success, got error={result.error!r}"
    assert result.signaling_bitmap == bytes([0x00, 0x00])  # no AD in fake
    # cmd_params=0x01 path returns 0x5A credential_PubK
    assert result.credential_pub is not None
    assert len(result.credential_pub) == 65
    assert result.credential_pub[0] == 0x04
    assert result.ud_sig is not None
    assert len(result.ud_sig) == 64


def test_transaction_signals_ad_present_when_fake_card_has_access_document():
    """Cross-check: bitmap tracks the has_access_document provisioning bit."""
    reader, cred = _make_keys()
    bundle = TrustBundle.synthesize(
        reader_priv=reader, credential_pub=cred.public_key()
    )
    fake = FakeAliroCard.provisioned(
        reader_pub=reader.public_key(),
        credential_priv=cred,
        credential_pub=cred.public_key(),
        has_access_document=True,
    )
    result = run_aliro_transaction(transmit=fake.transmit, bundle=bundle)
    assert result.ok
    # Bit 0 (AD retrievable) + bit 2 (step-up-AID-required) set.
    assert result.signaling_bitmap == bytes([0x00, 0x05])


def test_transaction_fails_when_reader_priv_mismatches_card_reader_pub():
    """Reader's long-term priv does not match what the card has provisioned
    -> card's reader-sig verification fails -> AUTH1 returns 6A80."""
    _, cred = _make_keys()
    reader_in_bundle = ec.generate_private_key(ec.SECP256R1())
    reader_provisioned = ec.generate_private_key(ec.SECP256R1())

    bundle = TrustBundle.synthesize(
        reader_priv=reader_in_bundle, credential_pub=cred.public_key()
    )
    fake = FakeAliroCard.provisioned(
        reader_pub=reader_provisioned.public_key(),  # different key
        credential_priv=cred,
        credential_pub=cred.public_key(),
    )

    result = run_aliro_transaction(transmit=fake.transmit, bundle=bundle)
    assert not result.ok
    assert result.error is not None
    assert "AUTH1 failed" in result.error
    assert "6A80" in result.error


def test_trust_bundle_synthesize_field_types():
    """Round-trip: TrustBundle.synthesize produces the expected field shapes."""
    reader = ec.generate_private_key(ec.SECP256R1())
    cred = ec.generate_private_key(ec.SECP256R1())
    bundle = TrustBundle.synthesize(
        reader_priv=reader, credential_pub=cred.public_key()
    )
    assert isinstance(bundle.reader_priv, ec.EllipticCurvePrivateKey)
    assert len(bundle.reader_long_term_pub_x) == 32
    assert len(bundle.reader_group_id) == 16
    assert len(bundle.reader_group_sub_id) == 16
    assert len(bundle.credential_long_term_pub_uncompressed) == 65
    assert bundle.credential_long_term_pub_uncompressed[0] == 0x04
    assert len(bundle.credential_long_term_pub_x) == 32
    # The x-coord inside the uncompressed encoding matches the separate x-coord field.
    assert (
        bundle.credential_long_term_pub_uncompressed[1:33]
        == bundle.credential_long_term_pub_x
    )