"""Tests for meshbay_node.keystore."""

import sys

import pytest
from pathlib import Path
from meshbay_node.keystore import (
    NodeKeys,
    create_keystore,
    load_keystore,
    save_keystore,
    load_or_create_keystore,
)
from meshbay_common.crypto import generate_gek


def test_create_and_load(tmp_path):
    path = tmp_path / "keystore.enc"
    keys = create_keystore(path=path, password="testpass99")

    assert keys.sk_ed25519 is not None
    assert keys.sk_x25519 is not None
    assert keys.gek is None
    assert len(keys.pk_ed25519_b64) == 44   # 32 bytes → 44 base64 chars
    assert len(keys.pk_x25519_b64) == 44
    assert path.exists()
    if sys.platform != "win32":
        # NTFS ignores POSIX mode bits; chmod_private is a no-op there (W5).
        assert oct(path.stat().st_mode)[-3:] == "600"

    loaded = load_keystore(path=path, password="testpass99")
    assert loaded.pk_ed25519_b64 == keys.pk_ed25519_b64
    assert loaded.pk_x25519_b64  == keys.pk_x25519_b64
    assert loaded.gek is None


def test_wrong_password_rejected(tmp_path):
    path = tmp_path / "keystore.enc"
    create_keystore(path=path, password="correctpass")
    with pytest.raises(ValueError, match="Wrong password"):
        load_keystore(path=path, password="wrongpass")


def test_create_fails_if_exists(tmp_path):
    path = tmp_path / "keystore.enc"
    create_keystore(path=path, password="pass12345")
    with pytest.raises(FileExistsError):
        create_keystore(path=path, password="pass12345")


def test_load_fails_if_missing(tmp_path):
    with pytest.raises(FileNotFoundError):
        load_keystore(path=tmp_path / "nonexistent.enc", password="x")


def test_save_with_gek(tmp_path):
    path = tmp_path / "keystore.enc"
    keys = create_keystore(path=path, password="testpass99")
    gek = generate_gek()
    keys.gek = gek

    save_keystore(keys, path=path, password="testpass99")

    reloaded = load_keystore(path=path, password="testpass99")
    assert reloaded.gek == gek


def test_load_or_create_creates(tmp_path):
    path = tmp_path / "keystore.enc"
    keys = load_or_create_keystore(path=path, password="testpass99")
    assert keys.sk_ed25519 is not None
    assert path.exists()


def test_load_or_create_loads(tmp_path):
    path = tmp_path / "keystore.enc"
    k1 = load_or_create_keystore(path=path, password="testpass99")
    k2 = load_or_create_keystore(path=path, password="testpass99")
    assert k1.pk_ed25519_b64 == k2.pk_ed25519_b64


def test_keys_unique_per_creation(tmp_path):
    k1 = create_keystore(path=tmp_path / "k1.enc", password="p1234567")
    k2 = create_keystore(path=tmp_path / "k2.enc", password="p1234567")
    assert k1.pk_ed25519_b64 != k2.pk_ed25519_b64


def test_env_var_unlock(tmp_path, monkeypatch):
    path = tmp_path / "keystore.enc"
    create_keystore(path=path, password="envpass42")
    monkeypatch.setenv("MESHBAY_UNLOCK_KEY", "envpass42")
    keys = load_keystore(path=path)   # no password arg
    assert keys.sk_ed25519 is not None


def test_unlock_file(tmp_path):
    path    = tmp_path / "keystore.enc"
    kf_path = tmp_path / "unlock.key"
    kf_path.write_text("filepass42")
    kf_path.chmod(0o600)

    create_keystore(path=path, password="filepass42")
    keys = load_keystore(path=path, unlock_file=kf_path)   # no password arg
    assert keys.sk_ed25519 is not None