"""Tests for M9.5 supply chain attestation."""

from cmdforge.attestation import (
    Attestation,
    sign_tool,
    verify_attestation,
    verify_content_hash,
)
from cmdforge.tool import Tool


class TestSignTool:
    def test_creates_attestation(self):
        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
        assert att.tool_name == "mytool"
        assert att.version == "1.0.0"
        assert att.content_hash == "abc123"
        assert att.signer == "alice"
        assert len(att.signature) == 64  # SHA256 hex
        assert att.algorithm == "hmac-sha256"

    def test_different_keys_different_signatures(self):
        att1 = sign_tool("tool", "1.0.0", "hash", "alice", "key1")
        att2 = sign_tool("tool", "1.0.0", "hash", "alice", "key2")
        assert att1.signature != att2.signature


class TestVerifyAttestation:
    def test_valid_signature(self):
        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
        assert verify_attestation(att, "secret-key")

    def test_wrong_key_fails(self):
        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
        assert not verify_attestation(att, "wrong-key")

    def test_tampered_content_fails(self):
        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
        att.content_hash = "tampered"
        assert not verify_attestation(att, "secret-key")

    def test_tampered_signer_fails(self):
        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
        att.signer = "eve"
        assert not verify_attestation(att, "secret-key")