# ==============================================================================
# Author: Simon-Pierre Boucher <contact@spboucher.ai>
# File:   tests/test_auth.py
# Desc:   Tests de la connexion KA ID — session signée HMAC, vérification du
#         jeton HS256 du hub (issuer, audience, expiration, signature).
# ==============================================================================
from __future__ import annotations

import base64
import hashlib
import hmac
import json
import time

import pytest

from sortika import auth


@pytest.fixture(autouse=True)
def _secrets(monkeypatch):
    monkeypatch.setenv("SESSION_SECRET", "test-session-secret")
    monkeypatch.setenv("KA_SSO_SECRET", "test-ka-secret")


def _hub_jwt(claims: dict, secret: str = "test-ka-secret") -> str:
    def b64(d: dict) -> str:
        return base64.urlsafe_b64encode(
            json.dumps(d).encode()).decode().rstrip("=")
    h, p = b64({"alg": "HS256", "typ": "JWT"}), b64(claims)
    sig = base64.urlsafe_b64encode(
        hmac.new(secret.encode(), f"{h}.{p}".encode(),
                 hashlib.sha256).digest()).decode().rstrip("=")
    return f"{h}.{p}.{sig}"


def _claims(**over) -> dict:
    base = {"iss": auth.KA_HUB_URL, "aud": "sorti-ka",
            "sub": "42", "ka_id": "ka-0123456789",
            "email": "membre@exemple.com", "name": "Membre Test",
            "exp": time.time() + 300}
    base.update(over)
    return base


def test_session_sign_verify():
    tok = auth._sign({"uid": 1, "exp": time.time() + 60})
    assert auth._verify(tok)["uid"] == 1
    assert auth._verify(tok + "x") is None
    assert auth._verify(auth._sign({"uid": 1, "exp": time.time() - 1})) is None


def test_hub_token_valid():
    claims = auth._verify_ka_token(_hub_jwt(_claims()))
    assert claims and claims["ka_id"] == "ka-0123456789"


def test_hub_token_rejections():
    # mauvaise signature
    assert auth._verify_ka_token(_hub_jwt(_claims(), secret="autre")) is None
    # mauvais émetteur
    assert auth._verify_ka_token(_hub_jwt(_claims(iss="https://evil.com"))) is None
    # mauvaise audience (jeton émis pour lou-ka)
    assert auth._verify_ka_token(_hub_jwt(_claims(aud="lou-ka"))) is None
    # expiré
    assert auth._verify_ka_token(_hub_jwt(_claims(exp=time.time() - 10))) is None