"""test_crypto.py —— Fernet 加解密 / 落盘 / secure_delete。"""
from __future__ import annotations

import pytest

from vstore.crypto import (
    CryptoError,
    decrypt_bytes,
    dump_encrypted,
    encrypt_bytes,
    load_encrypted,
    secure_delete,
)


def test_roundtrip_bytes():
    plain = "小麦育种试验报告——2026".encode("utf-8")
    token = encrypt_bytes(plain)
    assert token != plain
    assert decrypt_bytes(token) == plain


def test_decrypt_wrong_key():
    from cryptography.fernet import Fernet

    other_key = Fernet.generate_key()
    token = encrypt_bytes(b"hello")
    with pytest.raises(CryptoError):
        decrypt_bytes(token, key=other_key)


def test_empty_inputs():
    with pytest.raises(CryptoError):
        encrypt_bytes(b"")
    with pytest.raises(CryptoError):
        decrypt_bytes(b"")


def test_dump_load_encrypted(tmp_path):
    target = tmp_path / "doc.enc"
    plain = b"secret plaintext 123"
    dump_encrypted(target, plain)
    raw = target.read_bytes()
    assert b"secret plaintext 123" not in raw  # 密文不包含明文
    assert load_encrypted(target) == plain


def test_dump_atomic_no_tmp_left(tmp_path):
    target = tmp_path / "a.enc"
    dump_encrypted(target, b"data")
    assert not (tmp_path / "a.enc.tmp").exists()
    assert target.exists()


def test_secure_delete(tmp_path):
    target = tmp_path / "x.bin"
    target.write_bytes(b"0123456789")
    secure_delete(target)
    assert not target.exists()


def test_secure_delete_missing_ok(tmp_path):
    secure_delete(tmp_path / "nope.bin")  # 不抛异常