"""Offline regression for the signer public receipt projection (synthetic values only)."""
import base64
import hashlib
import importlib.util
import json
from pathlib import Path
import unittest

ROOT = Path(__file__).resolve().parents[1]
spec = importlib.util.spec_from_file_location('public_receipt', ROOT / 'tools/prepare_signer_public_receipt.py')
MODULE = importlib.util.module_from_spec(spec)
spec.loader.exec_module(MODULE)
PIN = (ROOT / 'docs/native-signer-public-pin.json').read_bytes()
KEY = base64.urlsafe_b64encode(bytes(range(32))).decode().rstrip('=')  # synthetic, not a real key


def custody(**changes):
    value = {'schema': MODULE.CUSTODY_SCHEMA, 'path': MODULE.CUSTODY_PATH, 'kv_version': 1,
             'status': 'custody-verified-pending-independent-public-admission',
             'kid': 'flex-auth-lifecycle-20261016-r1', 'public_key': KEY,
             'public_fingerprint': 'sha256:' + hashlib.sha256(KEY.encode()).hexdigest()}
    value.update(changes)
    return json.dumps(value).encode()


class PublicReceiptTests(unittest.TestCase):
    def test_trust_matches_secrets_schema(self):
        trust_bytes, receipt = MODULE.build(custody(), PIN, b'ccr', b'plan')
        trust = json.loads(trust_bytes)
        self.assertEqual(set(trust), {'schema', 'evaluator', 'mode', 'policy_package', 'policy_version',
                                      'policy_package_digest', 'keys'})
        self.assertEqual(trust['keys'], {'flex-auth-lifecycle-20261016-r1': KEY})
        self.assertEqual(receipt['trust_file_sha256'], 'sha256:' + hashlib.sha256(trust_bytes).hexdigest())
        self.assertNotIn(b'PRIVATE', json.dumps(receipt).encode())

    def test_refusals(self):
        for bad in (custody(kv_version=None), custody(status='write-intent-unknown'),
                    custody(kid='other'), custody(public_fingerprint='sha256:00'),
                    custody(public_key=KEY + '='), custody(ED25519_PRIVATE_KEY='x'),
                    custody(source_ccr_sha256='sha256:other')):
            with self.assertRaises(ValueError):
                MODULE.build(bad, PIN, b'ccr', b'plan')


if __name__ == '__main__':
    unittest.main()