import datetime

from cryptography import x509
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.x509.oid import NameOID

key_usage = x509.KeyUsage(
    True,  # digital_signature
    False,  # content_commitment
    False,  # key_encipherment
    False,  # data_encipherment
    False,  # key_agreement
    True,  # key_cert_sign
    True,  # crl_sign
    False,  # encipher_only
    False  # decipher_only
)


def generate():
    """ Generate root and intermediate certificates for the apple attestation. """
    root_private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048, )

    with open('pyattest/testutils/fixtures/root_key.pem', 'wb') as f:
        f.write(root_private_key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.TraditionalOpenSSL,
            encryption_algorithm=serialization.BestAvailableEncryption(b'123'),
        ))

    subject = issuer = x509.Name([x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'pyattest-testing-ca')])
    cert = x509.CertificateBuilder() \
        .subject_name(subject) \
        .issuer_name(issuer) \
        .public_key(root_private_key.public_key()) \
        .serial_number(x509.random_serial_number()) \
        .not_valid_before(datetime.datetime.utcnow()) \
        .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=10)) \
        .add_extension(key_usage, critical=False) \
        .sign(root_private_key, hashes.SHA256())

    with open('pyatest/testutils/fixtures/root_cert.pem', 'wb') as f:
        f.write(cert.public_bytes(serialization.Encoding.PEM))
