"""Generation de cles SSH : tous les types proposes doivent produire une cle
relisible par paramiko, donc utilisable pour se connecter."""
import pathlib
import sys

sys.path.insert(0, str(pathlib.Path(__file__).resolve().parent.parent))

import tempfile
from pathlib import Path

import paramiko

from app.key_manager import (
    ECDSA_CURVES,
    KEY_TYPE_ED25519,
    KEY_TYPE_LABELS,
    KEY_TYPE_RSA,
    KeyManager,
)

tmp = Path(tempfile.mkdtemp())
km = KeyManager(registry_path=tmp / "keys.json")

LOADERS = (paramiko.Ed25519Key, paramiko.ECDSAKey, paramiko.RSAKey)


def recharge(chemin: str, mot_de_passe=None):
    for loader in LOADERS:
        try:
            return loader.from_private_key_file(chemin, password=mot_de_passe)
        except paramiko.SSHException:
            continue
    return None


print(f"{'type':<12} {'libelle':<32} {'algorithme relu':<22} bits")
print("-" * 78)
for key_type, label in KEY_TYPE_LABELS.items():
    bits = 2048 if key_type == KEY_TYPE_RSA else 4096
    entry = km.generate_key(f"test_{key_type}", key_type, rsa_bits=bits, save_dir=tmp)
    pkey = recharge(entry.private_path)
    assert pkey is not None, f"{key_type} : cle illisible par paramiko"
    assert entry.public_key_text.startswith(pkey.get_name()), (entry.public_key_text[:30], pkey.get_name())
    assert entry.fingerprint.startswith("SHA256:"), entry.fingerprint
    print(f"{key_type:<12} {label:<32} {pkey.get_name():<22} {pkey.get_bits()}")

print()
print("=== les courbes NIST sont bien distinctes ===")
noms = {}
for key_type in ECDSA_CURVES:
    entry = next(k for k in km.keys if k.key_type == key_type)
    noms[key_type] = recharge(entry.private_path).get_name()
    print(f"  {key_type:<12} -> {noms[key_type]}")
assert len(set(noms.values())) == 3, noms

print()
print("=== cle protegee par une passphrase ===")
entry = km.generate_key("test_avec_passphrase", KEY_TYPE_ED25519, passphrase="secret", save_dir=tmp)
assert recharge(entry.private_path) is None, "sans la passphrase, la cle ne doit pas se charger"
assert recharge(entry.private_path, "secret") is not None, "avec la passphrase, elle doit se charger"
print("  chargement refuse sans passphrase, accepte avec : OK")

print()
print("GENERATION DE CLES : OK")