"""Unit tests for settings encryption-at-rest (Fernet)."""
from steward.core.crypto import (
    ENC_PREFIX,
    decrypt_secret,
    encrypt_secret,
    init_crypto,
    is_encrypted,
)


def setup_function():
    init_crypto("unit-test-secret-key")


def test_roundtrip():
    tok = encrypt_secret("hunter2")
    assert tok.startswith(ENC_PREFIX)
    assert tok != "hunter2"
    assert is_encrypted(tok)
    assert decrypt_secret(tok) == "hunter2"


def test_empty_passes_through():
    assert encrypt_secret("") == ""
    assert is_encrypted("") is False


def test_plaintext_decrypt_passthrough():
    assert decrypt_secret("not-encrypted") == "not-encrypted"


def test_is_encrypted_type_guard():
    assert is_encrypted(encrypt_secret("x")) is True
    assert is_encrypted("plain") is False
    assert is_encrypted(None) is False
    assert is_encrypted(123) is False


def test_wrong_key_does_not_reveal_plaintext():
    init_crypto("key-A")
    tok = encrypt_secret("secret")
    init_crypto("key-B")
    # Wrong key -> InvalidToken -> token returned unchanged, never the plaintext.
    assert decrypt_secret(tok) != "secret"
    init_crypto("key-A")
    assert decrypt_secret(tok) == "secret"