"""Shared fixtures: settings, a tiny CA, and a profile-signing PKCS#12."""

from __future__ import annotations

from pathlib import Path

import pytest
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.serialization import pkcs12
from tests.helpers import issue_test_ca

from cert_portal.config import Settings
from cert_portal.directory import DirectoryUser

FIXTURES = Path(__file__).parent / "fixtures"


@pytest.fixture
def test_ca():
    return issue_test_ca()


@pytest.fixture
def signing_p12(tmp_path: Path) -> Path:
    key, cert = issue_test_ca()
    blob = pkcs12.serialize_key_and_certificates(
        name=b"profile-signer",
        key=key,
        cert=cert,
        cas=None,
        encryption_algorithm=serialization.BestAvailableEncryption(b"signer-secret"),
    )
    path = tmp_path / "profile-signing.p12"
    path.write_bytes(blob)
    return path


@pytest.fixture
def settings(signing_p12: Path) -> Settings:
    return Settings(
        session_secret="test-session-secret-32bytes-min",
        session_https_only=False,
        environment="development",
        docs_enabled=True,
        public_base_url="http://testserver",
        oidc_issuer="https://idp.example.test/realms/test",
        oidc_client_id="cert-portal",
        oidc_client_secret="secret",
        oidc_redirect_uri="http://testserver/auth/callback",
        ldap_url="ldaps://dc.example.test",
        ldap_bind_dn="CN=portal,DC=example,DC=test",
        ldap_bind_password="ldap-secret",
        ldap_base_dn="DC=example,DC=test",
        certsrv_url="https://ca.example.test/certsrv",
        certsrv_username="portal",
        certsrv_password="ca-secret",
        certsrv_domain="EXAMPLE",
        certsrv_template="UserWifi",
        profile_signing_p12_path=signing_p12,
        profile_signing_p12_password="signer-secret",
        profile_organization="Test Org",
        profile_display_name="Test User Certificate",
        profile_identifier_prefix="com.example.cert-portal",
    )


@pytest.fixture
def directory_user() -> DirectoryUser:
    return DirectoryUser(
        dn="CN=Nick,OU=People,DC=example,DC=test",
        upn="nick@example.test",
        sid="S-1-5-21-3623811015-3361044348-30300820-1013",
        display_name="Nick Example",
        mail="nick@example.test",
    )