from __future__ import annotations

import pytest
from cryptography.fernet import Fernet

from backend.db import Database
from backend.security import SecretBox, parse_user_agent, token_hash, token_matches


def test_device_binding_and_secret_storage(tmp_path) -> None:
    box = SecretBox(Fernet.generate_key().decode())
    database = Database(str(tmp_path / "vpn.db"), box)
    user = database.create_user(
        {
            "name": "Alice",
            "monthly_price_rub": 500,
            "payment_day": 31,
            "vless_subscription_url": "https://secret/vless",
            "amnezia_account_name": "hidden",
            "freeturn_key": "private-key",
        }
    )
    device = database.create_device(user["id"], "https://sub.example.com")
    assert token_matches(device["device_token"], token_hash(device["device_token"]))
    ua = f"vpnapp/v1.2/{device['device_id']}"
    payload = database.bind_and_get_subscription(
        device["device_id"], device["device_token"], ua, device["device_id"]
    )
    assert payload["vless_subscription_url"] == "https://secret/vless"
    with pytest.raises(PermissionError):
        database.bind_and_get_subscription(
            device["device_id"], device["device_token"], "vpnapp/v1.2/other", device["device_id"]
        )
    listed = database.list_users()[0]
    assert "vless_subscription_url" not in listed
    assert box.seal("secret") != "secret"


def test_user_agent_parser() -> None:
    assert parse_user_agent("vpnapp/v1.2/123e4567-e89b-12d3-a456-426614174000")
    assert parse_user_agent("bad-agent") is None