# Author:  cirakg & claude ai
# Summary: Tests that the fixture PIN wrap generator matches the constants in source/app/Fixtures.mc and RFC 5869.
from __future__ import annotations

import re
import shutil
from pathlib import Path

import gen_fixture_wrap
import pytest

ROOT = Path(__file__).resolve().parents[2]


def fixture_constant(name: str) -> str:
    text = (ROOT / "source" / "app" / "Fixtures.mc").read_text(encoding="utf-8")
    match = re.search(rf'const {name} = "([0-9a-f]+)"', text)
    assert match, f"{name} not found in Fixtures.mc"
    return match.group(1)


def test_hkdf_matches_rfc5869_case_3() -> None:
    # RFC 5869 A.3: empty salt and info.
    okm = gen_fixture_wrap.hkdf(bytes([0x0B] * 22), b"", 42)
    assert okm.hex() == (
        "8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8"  # RFC 5869 A.3
    )


@pytest.mark.skipif(shutil.which("openssl") is None, reason="needs openssl for AES")
def test_generated_wrap_matches_the_fixture() -> None:
    assert gen_fixture_wrap.fixture_wrap().hex() == fixture_constant("FIXTURE_WRAP")
    assert gen_fixture_wrap.MASTER_KEY.hex() == fixture_constant("FIXTURE_MASTER_KEY")