"""Test cortex_search utils module."""

from unittest.mock import ANY, MagicMock, mock_open, patch

import pytest

from payment.connectors.cortex_search.utils import load_private_key


@patch('payment.connectors.cortex_search.utils.serialization.load_pem_private_key')
@patch(
    'builtins.open', new_callable=mock_open, read_data=b'-----BEGIN PRIVATE KEY-----'
)
def test_load_private_key_from_file_no_passphrase(mock_file, mock_load_pem):
    mock_key = MagicMock()
    mock_key.private_bytes.return_value = b'der_bytes'
    mock_load_pem.return_value = mock_key

    result = load_private_key(None, '/path/to/key.p8', None)

    assert result == b'der_bytes'
    mock_file.assert_called_once_with('/path/to/key.p8', 'rb')
    mock_load_pem.assert_called_once_with(b'-----BEGIN PRIVATE KEY-----', password=None)


@patch('payment.connectors.cortex_search.utils.serialization.load_pem_private_key')
@patch(
    'builtins.open',
    new_callable=mock_open,
    read_data=b'-----BEGIN ENCRYPTED PRIVATE KEY-----',
)
def test_load_private_key_from_file_with_passphrase(mock_file, mock_load_pem):
    mock_key = MagicMock()
    mock_key.private_bytes.return_value = b'der_bytes'
    mock_load_pem.return_value = mock_key

    result = load_private_key(None, '/path/to/key.p8', 'secret')

    assert result == b'der_bytes'
    mock_load_pem.assert_called_once_with(
        b'-----BEGIN ENCRYPTED PRIVATE KEY-----', password=b'secret'
    )


@patch('payment.connectors.cortex_search.utils.serialization.load_pem_private_key')
def test_load_private_key_from_string_key(mock_load_pem):
    mock_key = MagicMock()
    mock_key.private_bytes.return_value = b'der_bytes'
    mock_load_pem.return_value = mock_key

    result = load_private_key('pem-key-string', None, None)

    assert result == b'der_bytes'
    mock_load_pem.assert_called_once_with(b'pem-key-string', password=None)


@patch('payment.connectors.cortex_search.utils.serialization.load_pem_private_key')
def test_load_private_key_from_string_key_with_passphrase(mock_load_pem):
    mock_key = MagicMock()
    mock_key.private_bytes.return_value = b'der_bytes'
    mock_load_pem.return_value = mock_key

    load_private_key('pem-key-string', None, 'secret')

    mock_load_pem.assert_called_once_with(b'pem-key-string', password=b'secret')


@patch('builtins.open', side_effect=FileNotFoundError('no such file'))
def test_load_private_key_file_not_found(mock_file):
    with pytest.raises(FileNotFoundError):
        load_private_key(None, '/nonexistent/key.p8', None)


@patch('payment.connectors.cortex_search.utils.serialization.load_pem_private_key')
@patch('builtins.open', new_callable=mock_open, read_data=b'invalid pem data')
def test_load_private_key_calls_private_bytes_with_der_format(mock_file, mock_load_pem):
    from cryptography.hazmat.primitives import serialization

    mock_key = MagicMock()
    mock_key.private_bytes.return_value = b'der_output'
    mock_load_pem.return_value = mock_key

    load_private_key(None, '/path/to/key.p8', None)

    mock_key.private_bytes.assert_called_once_with(
        encoding=serialization.Encoding.DER,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=ANY,
    )
    call_kwargs = mock_key.private_bytes.call_args.kwargs
    assert isinstance(call_kwargs['encryption_algorithm'], serialization.NoEncryption)