from cryptography import x509
from cryptography.hazmat.primitives.serialization import Encoding
from cryptography.x509 import load_pem_x509_csr
from tests.helpers import sign_csr

from cert_portal.certsrv import CertsrvClient
from cert_portal.enrollment import SID_SAN_URI_PREFIX
from cert_portal.issue import ProfileIssuer


class _FakeCertsrv:
    def __init__(self, ca_key, ca_cert):
        self.ca_key = ca_key
        self.ca_cert = ca_cert
        self.last_csr = None

    def submit_csr(self, csr_pem, template=None):
        pem = csr_pem if isinstance(csr_pem, bytes) else csr_pem.encode("ascii")
        self.last_csr = pem
        csr = load_pem_x509_csr(pem)
        cert = sign_csr(csr, self.ca_key, self.ca_cert)
        return cert.public_bytes(Encoding.PEM)


def test_issue_signs_profile_for_user(settings, directory_user, test_ca):
    ca_key, ca_cert = test_ca
    fake = _FakeCertsrv(ca_key, ca_cert)
    issuer = ProfileIssuer(settings, certsrv=fake)
    issued = issuer.issue(directory_user)
    assert issued.upn == directory_user.upn
    assert issued.sid == directory_user.sid
    assert issued.filename.endswith(".mobileconfig")
    assert issued.signed_mobileconfig.startswith(b"\x30")
    assert b"com.apple.security.pkcs12" in issued.signed_mobileconfig
    csr = load_pem_x509_csr(fake.last_csr)
    san = csr.extensions.get_extension_for_class(x509.SubjectAlternativeName).value
    uris = [n.value for n in san if isinstance(n, x509.UniformResourceIdentifier)]
    assert f"{SID_SAN_URI_PREFIX}{directory_user.sid}" in uris


def test_ntlm_username_includes_domain(settings):
    client = CertsrvClient(settings)
    assert client._ntlm_user() == "EXAMPLE\\portal"