from __future__ import annotations

import base64
import unittest

from fastapi import HTTPException
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

from app.services.login_crypto import decrypt_login_password, get_login_public_key


class AuthLoginEncryptionTest(unittest.TestCase):
    def test_decrypts_password_encrypted_with_public_key(self) -> None:
        key_info = get_login_public_key()
        public_key = serialization.load_pem_public_key(key_info.public_key_pem.encode("utf-8"))
        ciphertext = public_key.encrypt(
            "safe-password-123".encode("utf-8"),
            padding.OAEP(
                mgf=padding.MGF1(algorithm=hashes.SHA256()),
                algorithm=hashes.SHA256(),
                label=None,
            ),
        )

        decrypted = decrypt_login_password(base64.b64encode(ciphertext).decode("utf-8"), key_info.key_id)

        self.assertEqual(decrypted, "safe-password-123")

    def test_rejects_unknown_login_key_id(self) -> None:
        key_info = get_login_public_key()

        with self.assertRaises(HTTPException) as raised:
            decrypt_login_password("not-a-real-ciphertext", f"{key_info.key_id}-old")

        self.assertEqual(raised.exception.status_code, 400)
        self.assertEqual(raised.exception.detail, "登录密钥已过期，请刷新后重试")


if __name__ == "__main__":
    unittest.main()