import plistlib

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.serialization import pkcs7
from tests.helpers import issue_test_ca

from cert_portal.enrollment import export_pkcs12
from cert_portal.profile import (
    PKCS12_PAYLOAD_TYPE,
    build_unsigned_mobileconfig,
    load_signing_identity,
    sign_mobileconfig,
)


def test_unsigned_profile_embeds_pkcs12_and_password():
    key, cert = issue_test_ca()
    p12, password = export_pkcs12(key=key, certificate=cert, friendly_name="nick@example.test")
    unsigned = build_unsigned_mobileconfig(
        identity_p12=p12,
        identity_password=password,
        display_name="User Certificate",
        organization="Example",
        identifier_prefix="com.example.cert-portal",
        username="nick@example.test",
    )
    profile = plistlib.loads(unsigned)
    payloads = profile["PayloadContent"]
    types = [p["PayloadType"] for p in payloads]
    assert PKCS12_PAYLOAD_TYPE in types
    assert "com.apple.security.scep" not in types
    identity = next(p for p in payloads if p["PayloadType"] == PKCS12_PAYLOAD_TYPE)
    assert identity["Password"] == password
    assert identity["PayloadContent"] == p12


def test_signed_profile_is_cms_and_contains_plist(signing_p12):
    key, cert = issue_test_ca()
    p12, password = export_pkcs12(key=key, certificate=cert)
    unsigned = build_unsigned_mobileconfig(
        identity_p12=p12,
        identity_password=password,
        display_name="User Certificate",
        organization="Example",
        identifier_prefix="com.example.cert-portal",
        username="nick@example.test",
    )
    identity = load_signing_identity(signing_p12, "signer-secret")
    signed = sign_mobileconfig(unsigned, identity)
    assert signed != unsigned
    assert signed[:1] == b"\x30"  # DER SEQUENCE
    assert b"com.apple.security.pkcs12" in signed
    certs = pkcs7.load_der_pkcs7_certificates(signed)
    fps = {c.fingerprint(hashes.SHA256()) for c in certs}
    assert identity.certificate.fingerprint(hashes.SHA256()) in fps