import pytest
from fastapi.testclient import TestClient


@pytest.fixture
def client(monkeypatch: pytest.MonkeyPatch) -> TestClient:
    monkeypatch.setenv("APP_ENV", "local")
    monkeypatch.setenv("SECRET_PROVIDER", "fake")
    monkeypatch.setenv("CERT_SECRET_NAME", "pdf-signing-cert")
    monkeypatch.setenv("CERT_PASSWORD_SECRET_NAME", "pdf-signing-cert-password")
    monkeypatch.setenv("SERVICE_API_KEY", "test-service-key")
    monkeypatch.setenv("PDF_MAX_SIZE_BYTES", "1024")

    from signing_service.application.settings.container import get_settings

    get_settings.cache_clear()
    from signing_service.main import create_app

    return TestClient(create_app(), raise_server_exceptions=False)


def form(pdf: bytes = b"%PDF-1.4 test") -> dict[str, object]:
    return {
        "files": {"file": ("document.pdf", pdf, "application/pdf")},
        "data": {
            "certificate_secret_name": "legacy-cert",
            "certificate_password_secret_name": "legacy-password",
            "company_slug": "legacy-company",
        },
    }


def test_health_is_public(client: TestClient) -> None:
    response = client.get("/health")
    assert response.status_code == 200
    assert response.json() == {"status": "ok"}


def test_version_is_public(client: TestClient) -> None:
    assert client.get("/version").status_code == 200


def test_sign_rejects_missing_authentication(client: TestClient) -> None:
    response = client.post("/documents/sign", **form())
    assert response.status_code == 401
    assert response.json()["error"]["code"] == "AUTHENTICATION_REQUIRED"


def test_sign_rejects_invalid_authentication(client: TestClient) -> None:
    response = client.post(
        "/documents/sign", headers={"Authorization": "Bearer invalid"}, **form()
    )
    assert response.status_code == 401
    assert response.json()["error"]["code"] == "INVALID_CREDENTIALS"


def test_sign_with_valid_authentication_reaches_signing_flow(
    client: TestClient,
) -> None:
    response = client.post(
        "/documents/sign",
        headers={"Authorization": "Bearer test-service-key"},
        **form(),
    )
    assert response.status_code == 200
    assert response.headers["content-type"] == "application/pdf"
    assert response.content.endswith(b"-- Signed by fake signer")


def test_invalid_pdf_is_mapped_without_internal_detail(
    client: TestClient, monkeypatch: pytest.MonkeyPatch
) -> None:
    from signing_service.api.routes import sign_document
    from signing_service.infrastructure.pdf.pdf_validator_error import (
        PDFValidationError,
    )

    class InvalidPdfSigner:
        async def sign(self, **kwargs: object) -> bytes:
            raise PDFValidationError("PFX parsing detail")

    monkeypatch.setattr(sign_document, "create_pdf_signer", lambda: InvalidPdfSigner())
    response = client.post(
        "/documents/sign",
        headers={"Authorization": "Bearer test-service-key"},
        **form(b"not a PDF"),
    )
    assert response.status_code == 400
    assert response.json() == {
        "error": {"code": "INVALID_PDF", "message": "Invalid PDF document"}
    }


def test_pdf_size_limit_is_controlled(client: TestClient) -> None:
    response = client.post(
        "/documents/sign",
        headers={"Authorization": "Bearer test-service-key"},
        **form(b"x" * 1025),
    )
    assert response.status_code == 413
    assert response.json()["error"]["code"] == "INVALID_REQUEST"