factuges-document-signing-service/tests/application/use_cases/test_sign_document.py

import asyncio

import pytest

from signing_service.application.errors import (
    InvalidPdfError,
    SecretProviderError,
    ServiceError,
)
from signing_service.application.use_cases.sign_document import SignDocumentUseCase
from signing_service.application.use_cases.sign_document_dto import SignDocumentCommand
from signing_service.infrastructure.pdf.fake_pdf_signer import FakePDFSigner
from signing_service.infrastructure.pdf.pdf_validator_error import PDFValidationError
from signing_service.infrastructure.secrets.fake_secret_manager import FakeSecretManager

CERT_NAME = "configured-cert"
PASSWORD_NAME = "configured-password"


def command() -> SignDocumentCommand:
    return SignDocumentCommand(
        pdf_bytes=b"%PDF-1.4 fake pdf content",
        certificate_secret_name="legacy-cert-name",
        certificate_password_secret_name="legacy-password-name",
        company_slug="legacy-company",
    )


def test_sign_document_success() -> None:
    use_case = SignDocumentUseCase(
        secret_manager=FakeSecretManager(
            {CERT_NAME: "certificate", PASSWORD_NAME: "password"}
        ),
        pdf_signer=FakePDFSigner(),
        cert_secret_name=CERT_NAME,
        cert_password_secret_name=PASSWORD_NAME,
    )

    result = asyncio.run(use_case.execute(command()))

    assert result.signed_pdf_bytes.startswith(command().pdf_bytes)
    assert result.signed_pdf_bytes.endswith(b"-- Signed by fake signer")
    assert b"certificate" not in result.signed_pdf_bytes
    assert b"password" not in result.signed_pdf_bytes


def test_sign_document_maps_secret_manager_errors() -> None:
    use_case = SignDocumentUseCase(
        secret_manager=FakeSecretManager({}),
        pdf_signer=FakePDFSigner(),
        cert_secret_name=CERT_NAME,
        cert_password_secret_name=PASSWORD_NAME,
    )

    with pytest.raises(SecretProviderError):
        asyncio.run(use_case.execute(command()))


class FailingSigner:
    async def sign(self, **kwargs: object) -> bytes:
        raise RuntimeError("PFX password was rejected")


class InvalidPdfSigner:
    async def sign(self, **kwargs: object) -> bytes:
        raise PDFValidationError("internal parsing detail")


def test_sign_document_maps_signer_errors() -> None:
    use_case = SignDocumentUseCase(
        secret_manager=FakeSecretManager(
            {CERT_NAME: "certificate", PASSWORD_NAME: "password"}
        ),
        pdf_signer=FailingSigner(),  # type: ignore[arg-type]
        cert_secret_name=CERT_NAME,
        cert_password_secret_name=PASSWORD_NAME,
    )

    with pytest.raises(ServiceError) as caught:
        asyncio.run(use_case.execute(command()))

    assert caught.value.code == "SIGNING_FAILED"


def test_sign_document_maps_invalid_pdf_errors() -> None:
    use_case = SignDocumentUseCase(
        secret_manager=FakeSecretManager(
            {CERT_NAME: "certificate", PASSWORD_NAME: "password"}
        ),
        pdf_signer=InvalidPdfSigner(),  # type: ignore[arg-type]
        cert_secret_name=CERT_NAME,
        cert_password_secret_name=PASSWORD_NAME,
    )

    with pytest.raises(InvalidPdfError):
        asyncio.run(use_case.execute(command()))