from __future__ import annotations

from backup_tool.notifications.webhook import (
    SigningMaterial,
    canonical_signing_input,
    signatures,
    webhook_headers,
)


def test_signature_is_stable_and_dual_key_versioned() -> None:
    body = b'{"id":"018f"}'
    timestamp = "2026-07-30T00:00:00+00:00"
    keys = [
        SigningMaterial("key-a", 1, "old-secret"),
        SigningMaterial("key-b", 2, "new-secret"),
    ]
    values = signatures(timestamp, body, keys)
    assert len(values) == 2
    assert "key_id=key-a" in values[0] and "key_version=1" in values[0]
    assert "key_id=key-b" in values[1] and "key_version=2" in values[1]
    assert values == signatures(timestamp, body, keys)
    assert canonical_signing_input(timestamp, body).endswith(body)
    headers = webhook_headers("event-id", "execution.queued", timestamp, body, keys)
    receiver_headers = {key: value for key, value in headers if key != "X-Backup-Signature"}
    receiver_signatures = [value for key, value in headers if key == "X-Backup-Signature"]
    assert receiver_headers["X-Backup-Event-ID"] == "event-id"
    assert receiver_headers["X-Backup-Event-Type"] == "execution.queued"
    assert receiver_headers["X-Backup-Timestamp"] == timestamp
    assert receiver_signatures == values