from __future__ import annotations

import hashlib
import tempfile
import unittest
from pathlib import Path

from uvm.errors import UvmError
from uvm.integrity import load_manifest, verify_file, write_manifest


class IntegrityTests(unittest.TestCase):
    def test_verifies_a_matching_sha256(self) -> None:
        with tempfile.TemporaryDirectory() as temporary_directory:
            artifact = Path(temporary_directory) / "artifact"
            artifact.write_bytes(b"trusted artifact")
            digest = hashlib.sha256(b"trusted artifact").hexdigest()

            verify_file(
                artifact,
                digest,
                "artifact",
                "UVM_ARTIFACT_SHA256",
                allow_unverified=False,
            )

    def test_rejects_missing_or_mismatched_checksums_by_default(self) -> None:
        with tempfile.TemporaryDirectory() as temporary_directory:
            artifact = Path(temporary_directory) / "artifact"
            artifact.write_bytes(b"artifact")

            with self.assertRaises(UvmError):
                verify_file(
                    artifact,
                    None,
                    "artifact",
                    "UVM_ARTIFACT_SHA256",
                    allow_unverified=False,
                )
            with self.assertRaises(UvmError):
                verify_file(
                    artifact,
                    "0" * 64,
                    "artifact",
                    "UVM_ARTIFACT_SHA256",
                    allow_unverified=False,
                )

    def test_allows_an_explicit_local_development_opt_out(self) -> None:
        with tempfile.TemporaryDirectory() as temporary_directory:
            artifact = Path(temporary_directory) / "artifact"
            artifact.write_bytes(b"artifact")

            verify_file(
                artifact,
                None,
                "artifact",
                "UVM_ARTIFACT_SHA256",
                allow_unverified=True,
            )

    def test_unverified_manifest_is_not_promoted_to_a_verified_install(self) -> None:
        with tempfile.TemporaryDirectory() as temporary_directory:
            manifest_path = Path(temporary_directory) / "integrity.json"
            write_manifest(manifest_path, {"kernel": "0" * 64}, verified=False)

            manifest = load_manifest(manifest_path)

        self.assertFalse(manifest.verified)
        self.assertEqual(manifest.checksums["kernel"], "0" * 64)