from cryptography import x509
from cryptography.x509 import load_pem_x509_csr

from cert_portal.enrollment import (
    SID_SAN_URI_PREFIX,
    UPN_OID,
    build_csr,
    generate_rsa_key,
    sid_san_uri,
)


def test_csr_contains_upn_othername_and_sid_uri():
    key = generate_rsa_key(2048).key
    upn = "nick@example.test"
    sid = "S-1-5-21-1-2-3-4"
    pem = build_csr(key=key, upn=upn, sid=sid)
    csr = load_pem_x509_csr(pem)
    assert csr.subject.rfc4514_string() == f"CN={upn}"
    san = csr.extensions.get_extension_for_class(x509.SubjectAlternativeName).value
    names = list(san)
    uris = [n.value for n in names if isinstance(n, x509.UniformResourceIdentifier)]
    others = [n for n in names if isinstance(n, x509.OtherName)]
    assert uris == [f"{SID_SAN_URI_PREFIX}{sid}"]
    assert sid_san_uri(sid) in uris
    assert any(o.type_id == UPN_OID for o in others)
    upn_other = next(o for o in others if o.type_id == UPN_OID)
    # DER UTF8String: tag 0x0c, short length, payload
    assert upn_other.value[0] == 0x0C
    length = upn_other.value[1]
    assert upn_other.value[2 : 2 + length].decode("utf-8") == upn
    assert b"-----BEGIN CERTIFICATE REQUEST-----" in pem
    assert pem.startswith(b"-----BEGIN")