import pytest

from app.services.catalog.sources import decrypt_credentials, encrypt_credentials


def test_encrypt_round_trips():
    creds = {"access_token": "shpat_secret_value"}
    blob = encrypt_credentials(creds)
    assert decrypt_credentials(blob) == creds


def test_ciphertext_does_not_contain_plaintext():
    blob = encrypt_credentials({"access_token": "shpat_secret_value"})
    assert "shpat_secret_value" not in blob
    assert "access_token" not in blob


def test_encryption_is_non_deterministic():
    # Fernet embeds a random IV; identical input must not produce identical
    # ciphertext, or stored tokens become comparable across tenants.
    creds = {"access_token": "same"}
    assert encrypt_credentials(creds) != encrypt_credentials(creds)


def test_scheme_agnostic_envelope():
    creds = {"api_key": "k", "client_id": "c", "client_secret": "s"}
    assert decrypt_credentials(encrypt_credentials(creds)) == creds


def test_tampered_ciphertext_rejected():
    from cryptography.fernet import InvalidToken
    blob = encrypt_credentials({"access_token": "x"})
    tampered = blob[:-4] + ("AAAA" if not blob.endswith("AAAA") else "BBBB")
    with pytest.raises(InvalidToken):
        decrypt_credentials(tampered)