"""Tests for password-based key derivation."""

import pytest
from meshbay_common.keyderive import (
    derive_keys_from_password,
    encrypt_keypair_bundle,
    decrypt_keypair_bundle,
)
from meshbay_common.crypto import pk_to_b64


def test_deterministic():
    """Same credentials → same keys."""
    sk_ed1, sk_x1 = derive_keys_from_password("alice", "correct-horse")
    sk_ed2, sk_x2 = derive_keys_from_password("alice", "correct-horse")
    assert pk_to_b64(sk_ed1.public_key()) == pk_to_b64(sk_ed2.public_key())
    assert pk_to_b64(sk_x1.public_key()) == pk_to_b64(sk_x2.public_key())


def test_different_users_different_keys():
    sk_ed_a, _ = derive_keys_from_password("alice", "samepassword")
    sk_ed_b, _ = derive_keys_from_password("bob",   "samepassword")
    assert pk_to_b64(sk_ed_a.public_key()) != pk_to_b64(sk_ed_b.public_key())


def test_different_passwords_different_keys():
    sk_ed1, _ = derive_keys_from_password("alice", "password1")
    sk_ed2, _ = derive_keys_from_password("alice", "password2")
    assert pk_to_b64(sk_ed1.public_key()) != pk_to_b64(sk_ed2.public_key())


def test_ed_and_x_keys_independent():
    sk_ed, sk_x = derive_keys_from_password("user", "pass12345")
    from meshbay_common.crypto import sk_to_raw
    assert sk_to_raw(sk_ed) != sk_to_raw(sk_x)


def test_bundle_encrypt_decrypt():
    sk_ed, sk_x = derive_keys_from_password("alice", "strongpass!")
    bundle = encrypt_keypair_bundle(sk_ed, sk_x, "password123", "alice")
    sk_ed2, sk_x2 = decrypt_keypair_bundle(bundle, "password123", "alice")
    assert pk_to_b64(sk_ed.public_key()) == pk_to_b64(sk_ed2.public_key())
    assert pk_to_b64(sk_x.public_key())  == pk_to_b64(sk_x2.public_key())


def test_bundle_wrong_password_rejected():
    sk_ed, sk_x = derive_keys_from_password("alice", "correctpass")
    bundle = encrypt_keypair_bundle(sk_ed, sk_x, "correctpass", "alice")
    with pytest.raises(Exception):
        decrypt_keypair_bundle(bundle, "wrongpass", "alice")


def test_bundle_wrong_username_rejected():
    sk_ed, sk_x = derive_keys_from_password("alice", "pass12345")
    bundle = encrypt_keypair_bundle(sk_ed, sk_x, "pass12345", "alice")
    with pytest.raises(Exception):
        decrypt_keypair_bundle(bundle, "pass12345", "bob")  # wrong username salt