import pytest

from lyra_worker.crypto import decrypt_secret, encrypt_secret

TEST_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="  # 32 bytes, base64
# Produced by web/src/lib/crypto.ts encryptSecret("cross-lang-secret") with TEST_KEY (see Step 2).
NODE_FIXTURE = '{"iv":"j9RH6WtmcmkD716H","ct":"5nWNQDDhIHJJVgvEzrO+b8M=","tag":"MBtkQ+ygwAeXwLQLpTsvWw=="}'


@pytest.fixture(autouse=True)
def _key(monkeypatch):
    monkeypatch.setenv("LYRA_SECRET_KEY", TEST_KEY)


def test_round_trip():
    env = encrypt_secret("hunter2")
    assert "hunter2" not in env
    assert decrypt_secret(env) == "hunter2"


def test_decrypts_node_produced_envelope():
    # Cross-language contract: the worker must decrypt what the web app encrypted.
    assert decrypt_secret(NODE_FIXTURE) == "cross-lang-secret"


def test_rejects_tampered_envelope():
    import json
    env = json.loads(encrypt_secret("secret"))
    env["ct"] = "Z2FyYmFnZQ=="  # "garbage"
    with pytest.raises(Exception):
        decrypt_secret(json.dumps(env))