"""Throwaway store + identity fixtures for the P2 suite — TEST keys only.

Everything here mints its OWN age keypairs and encrypts fixture values; no real
credential, no ``my_stuff/`` file, and no real store is ever touched (AG-18, SPEC §6).
"""

from __future__ import annotations

from dataclasses import dataclass
from pathlib import Path

from pyrage import x25519

from mgf.secrets.registry import Registry, load

# A registry with two local-file entries (one active, one held) + a store surface.
STORE_REGISTRY = """\
[test_token]
family = "mgf"
kind = "api-token"
purpose = "test api token (fixture)"
consumers = ["fixture consumer"]
recovery = "re-mint (fixture)"
state = "active"
policy = { allowed_repos = "*", blast_radius = "low (fixture)" }
rotation = { class = "token", staged = true }
verify = { probe = "forge-auth" }
surfaces = [
  { type = "local-file", repo = "mgf", path = "tokens/test_token.txt", mode = "0600" },
  { type = "store" },
]

[test_docform]
family = "mgf"
kind = "api-token"
purpose = "doc-form fixture (metadata now lives HERE, not in the file)"
consumers = ["fixture"]
recovery = "re-mint bare-value"
state = "active"
policy = { allowed_repos = "*", blast_radius = "low (fixture)" }
rotation = { class = "token", staged = false }
verify = { probe = "forge-auth" }
surfaces = [
  { type = "local-file", repo = "mgf", path = "tokens/docform.txt", mode = "0600" },
  { type = "store" },
]

[held_secret]
family = "mgf"
kind = "password"
purpose = "held fixture — materialize/add must refuse it"
consumers = ["fixture"]
recovery = "n/a (fixture)"
state = "held"
policy = { allowed_repos = "*", blast_radius = "low (fixture)" }
rotation = { class = "password", staged = true }
verify = { probe = "repo-scope-match" }
surfaces = [
  { type = "local-file", repo = "mgf", path = "tokens/held.txt", mode = "0600" },
  { type = "store" },
]
"""


@dataclass
class StoreEnv:
    """A self-contained fed_root + store + two TEST identities."""

    fed_root: Path
    store_root: Path
    founder_key: Path
    operator_key: Path
    founder_pub: str
    operator_pub: str
    registry: Registry

    def common(self) -> list[str]:
        """Global-before-verb args pinning this env's root + store."""
        return ["--root", str(self.fed_root), "--store", str(self.store_root)]


def make_store_env(tmp_path: Path, *, extra: str = "") -> StoreEnv:
    fed = tmp_path / "fed"
    fed.mkdir()
    store = tmp_path / "store"
    (store / "secrets").mkdir(parents=True)

    founder = x25519.Identity.generate()
    operator = x25519.Identity.generate()
    fpub, opub = str(founder.to_public()), str(operator.to_public())
    fkey = tmp_path / "founder.key"
    okey = tmp_path / "operator.key"
    fkey.write_text(str(founder) + "\n", encoding="utf-8")
    okey.write_text(str(operator) + "\n", encoding="utf-8")
    fkey.chmod(0o600)
    okey.chmod(0o600)
    (store / "recipients.txt").write_text(f"founder  {fpub}\noperator {opub}\n", encoding="utf-8")

    std = fed / "mgf-standard"
    std.mkdir()
    (std / "SECRETS.toml").write_text(
        STORE_REGISTRY + ("\n" + extra if extra else ""), encoding="utf-8"
    )
    registry = load([std / "SECRETS.toml"])

    return StoreEnv(
        fed_root=fed,
        store_root=store,
        founder_key=fkey,
        operator_key=okey,
        founder_pub=fpub,
        operator_pub=opub,
        registry=registry,
    )
