"""Standalone deterministic App Pack signing checks."""

from __future__ import annotations

import json
import sys
import tempfile
import unittest
from pathlib import Path

PROJECT_ROOT = Path(__file__).resolve().parents[2]
sys.path.insert(0, str(PROJECT_ROOT))
loaded_platform = sys.modules.get("platform")
if loaded_platform is not None and not hasattr(loaded_platform, "__path__"):
    del sys.modules["platform"]

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

from platform.packages.wordpress_pack import (
    PackageBuildError,
    build_signed_pack,
    verify_signed_pack,
)


class PackageChecks(unittest.TestCase):
    def setUp(self):
        self.temp = tempfile.TemporaryDirectory()
        root = Path(self.temp.name)
        self.source = root / "example-wp"
        self.output = root / "out"
        self.source.mkdir()
        (self.source / "example.php").write_text("<?php defined('ABSPATH') || exit;\n", encoding="utf-8")
        (self.source / "wordpress-app-pack.json").write_text(json.dumps({
            "package_id": "example_wp", "app_id": "example_app", "version": "1.0.0",
            "entrypoint": "example.php", "plugin_file": "example-wp/example.php",
            "minimum_bridge_version": "0.2.0",
            "minimum_wordpress_version": "6.0", "minimum_php_version": "8.0",
            "capabilities": ["example.lookup"],
        }), encoding="utf-8")
        key = Ed25519PrivateKey.generate()
        self.private = root / "private.pem"
        self.public = root / "public.pem"
        self.private.write_bytes(key.private_bytes(
            serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
            serialization.NoEncryption(),
        ))
        self.public.write_bytes(key.public_key().public_bytes(
            serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo,
        ))

    def tearDown(self):
        self.temp.cleanup()

    def test_build_is_reproducible_and_signature_verifies(self):
        first = build_signed_pack(
            source=self.source, output_dir=self.output, private_key_path=self.private,
        )
        self.assertEqual("example-wp/example.php", first["plugin_file"])
        first_bytes = Path(first["artifact_path"]).read_bytes()
        second = build_signed_pack(
            source=self.source, output_dir=self.output, private_key_path=self.private,
        )
        self.assertEqual(first_bytes, Path(second["artifact_path"]).read_bytes())
        verified = verify_signed_pack(
            artifact=Path(second["artifact_path"]),
            release_path=Path(second["release_path"]),
            public_key_path=self.public,
        )
        self.assertEqual("verified", verified["status"])

    def test_tampered_artifact_is_rejected(self):
        release = build_signed_pack(
            source=self.source, output_dir=self.output, private_key_path=self.private,
        )
        artifact = Path(release["artifact_path"])
        artifact.write_bytes(artifact.read_bytes() + b"tampered")
        with self.assertRaises(PackageBuildError):
            verify_signed_pack(
                artifact=artifact, release_path=Path(release["release_path"]),
                public_key_path=self.public,
            )


if __name__ == "__main__":
    unittest.main(verbosity=2)