"""
Tests for omnisec.mft.MFTClient (local operations only — no real SFTP server required)
"""

import pytest
import os
import tempfile
import sys
sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))

from omnisec.mft import MFTClient


@pytest.fixture
def tmp_files(tmp_path):
    src = tmp_path / "test_file.txt"
    src.write_bytes(b"Hello OmniSec MFT Test Content 12345")
    return tmp_path, str(src)


class TestSHA256:
    def test_hash_consistency(self, tmp_files):
        tmp_path, src = tmp_files
        h1 = MFTClient.sha256(src)
        h2 = MFTClient.sha256(src)
        assert h1 == h2
        assert len(h1) == 64

    def test_different_files_differ(self, tmp_files):
        tmp_path, src = tmp_files
        src2 = str(tmp_path / "other.txt")
        with open(src2, "wb") as f:
            f.write(b"Different content entirely")
        h1 = MFTClient.sha256(src)
        h2 = MFTClient.sha256(src2)
        assert h1 != h2


class TestLocalCopy:
    def test_copy_creates_file(self, tmp_files):
        tmp_path, src = tmp_files
        dst = str(tmp_path / "copy.txt")
        client = MFTClient(protocol="sftp", encrypt_transfers=False)
        record = client.local_copy(src, dst)
        assert os.path.exists(dst)
        assert record.status == "success"
        assert record.protocol == "local"

    def test_copy_integrity(self, tmp_files):
        tmp_path, src = tmp_files
        dst = str(tmp_path / "integrity_copy.txt")
        client = MFTClient(protocol="sftp", encrypt_transfers=False)
        record = client.local_copy(src, dst)
        src_hash = MFTClient.sha256(src)
        assert record.sha256 == src_hash

    def test_audit_log_populated(self, tmp_files):
        tmp_path, src = tmp_files
        dst = str(tmp_path / "audit_copy.txt")
        client = MFTClient(protocol="sftp", encrypt_transfers=False)
        client.local_copy(src, dst)
        log = client.get_audit_log()
        assert len(log) == 1
        assert log[0].filename == "test_file.txt"


class TestAESEncryption:
    def test_encrypt_decrypt_roundtrip(self, tmp_files):
        try:
            from cryptography.hazmat.primitives.ciphers.aead import AESGCM
        except ImportError:
            pytest.skip("cryptography not installed")

        tmp_path, src = tmp_files
        import os
        key = os.urandom(32)
        client = MFTClient(encrypt_transfers=True, encryption_key=key)
        enc_path = client.encrypt_file(src)
        assert os.path.exists(enc_path)
        assert enc_path.endswith(".enc")

        dst = str(tmp_path / "decrypted.txt")
        client.decrypt_file(enc_path, dst)
        with open(src, "rb") as f1, open(dst, "rb") as f2:
            assert f1.read() == f2.read()
        os.unlink(enc_path)

    def test_encrypt_without_key(self, tmp_files):
        try:
            from cryptography.hazmat.primitives.ciphers.aead import AESGCM
        except ImportError:
            pytest.skip("cryptography not installed")
        tmp_path, src = tmp_files
        client = MFTClient(encrypt_transfers=True)  # key auto-generated
        enc_path = client.encrypt_file(src)
        assert os.path.exists(enc_path)
        os.unlink(enc_path)


class TestAuditExport:
    def test_export_csv(self, tmp_files, tmp_path):
        tmp_path_obj, src = tmp_files
        dst = str(tmp_path_obj / "copied.txt")
        csv_path = str(tmp_path / "audit.csv")
        client = MFTClient(encrypt_transfers=False)
        client.local_copy(src, dst)
        client.export_audit_csv(csv_path)
        assert os.path.exists(csv_path)
        with open(csv_path) as f:
            content = f.read()
        assert "filename" in content
        assert "sha256" in content


class TestMFTClientRepr:
    def test_repr(self):
        c = MFTClient(host="example.com", port=22, protocol="sftp")
        r = repr(c)
        assert "MFTClient" in r
        assert "sftp" in r
        assert "example.com" in r


if __name__ == "__main__":
    pytest.main([__file__, "-v"])
