from __future__ import annotations

import os

import pytest
from backup_tool.security.repository_crypto import (
    RepositoryKeyError,
    decrypt_object,
    encrypt_object,
    object_aad,
)


def test_encrypted_object_hides_plaintext_and_rejects_tampering() -> None:
    key = os.urandom(32)
    aad = object_aad("repository", "epoch", "blob", "identity")
    stored = encrypt_object(key, aad, b"secret-content")
    assert b"secret-content" not in stored
    assert decrypt_object(key, aad, stored) == b"secret-content"
    with pytest.raises(RepositoryKeyError):
        decrypt_object(key, aad, stored[:-1] + bytes([stored[-1] ^ 1]))