using System.Security.Cryptography;
using DodoSSH.Domain;

namespace DodoSSH.Api.Tests;

/// <summary>Directly-inserted rows, for tests whose subject is not enrollment itself.</summary>
/// <remarks>
/// Sync tests seed a current key rather than driving the enrollment endpoint. Going through the
/// endpoint would make every sync failure ambiguous between the two features, and would make the
/// sync suite fail whenever enrollment changed.
/// </remarks>
internal static class Seed
{
    /// <summary>
    /// A minimal current identity key, enough to satisfy the enrolled policy.
    /// </summary>
    /// <remarks>
    /// The keys and fingerprint are random because <c>user_key</c> has a global unique index on the
    /// fingerprint: fixed bytes would make the second seeded user in the shared database collide.
    /// </remarks>
    internal static UserKey CurrentKey(Guid userId, DateTimeOffset now) =>
        new()
        {
            Id = Guid.CreateVersion7(),
            UserId = userId,
            Generation = 1,
            EncryptionPublicKey = RandomNumberGenerator.GetBytes(32),
            SigningPublicKey = RandomNumberGenerator.GetBytes(32),
            FingerprintSha256 = RandomNumberGenerator.GetBytes(32),
            Statement = "{}",
            StatementSignature = RandomNumberGenerator.GetBytes(64),
            IsCurrent = true,
            CreatedAtUtc = now,
        };
}