"""Unit tests for settings encryption-at-rest (Fernet)."""
from steward.core.crypto import (
    ENC_PREFIX,
    decrypt_secret,
    encrypt_secret,
    generate_ssh_keypair,
    init_crypto,
    is_encrypted,
)


def setup_function():
    init_crypto("unit-test-secret-key")


def test_roundtrip():
    tok = encrypt_secret("hunter2")
    assert tok.startswith(ENC_PREFIX)
    assert tok != "hunter2"
    assert is_encrypted(tok)
    assert decrypt_secret(tok) == "hunter2"


def test_empty_passes_through():
    assert encrypt_secret("") == ""
    assert is_encrypted("") is False


def test_plaintext_decrypt_passthrough():
    assert decrypt_secret("not-encrypted") == "not-encrypted"


def test_is_encrypted_type_guard():
    assert is_encrypted(encrypt_secret("x")) is True
    assert is_encrypted("plain") is False
    assert is_encrypted(None) is False
    assert is_encrypted(123) is False


def test_wrong_key_does_not_reveal_plaintext():
    init_crypto("key-A")
    tok = encrypt_secret("secret")
    init_crypto("key-B")
    # Wrong key -> InvalidToken -> token returned unchanged, never the plaintext.
    assert decrypt_secret(tok) != "secret"
    init_crypto("key-A")
    assert decrypt_secret(tok) == "secret"


# ── Managed SSH keypair generation ────────────────────────────────────────────

def test_generate_ssh_keypair_formats():
    priv, pub = generate_ssh_keypair()
    assert priv.startswith("-----BEGIN OPENSSH PRIVATE KEY-----")
    assert priv.rstrip().endswith("-----END OPENSSH PRIVATE KEY-----")
    assert pub.startswith("ssh-ed25519 ")
    assert pub.endswith(" steward-managed")


def test_generate_ssh_keypair_is_unique():
    p1, _ = generate_ssh_keypair()
    p2, _ = generate_ssh_keypair()
    assert p1 != p2


def test_generate_ssh_keypair_custom_comment():
    _, pub = generate_ssh_keypair(comment="host-x")
    assert pub.endswith(" host-x")
    assert len(pub.split()) == 3  # type, key, comment