"""Shared pytest fixtures for xceadmin's test suite."""

from __future__ import annotations

import shutil
import subprocess
from dataclasses import dataclass
from pathlib import Path

import pytest


@dataclass(frozen=True)
class TlsCertPair:
    cert_file: Path
    key_file: Path


@pytest.fixture(scope="session")
def tls_certs(tmp_path_factory) -> TlsCertPair:
    """A fresh self-signed TLS cert/key pair, generated once per test
    session via openssl -- not read from any checked-in fixture (this
    repo carries none; ``ha/data/`` was removed). Matches deploy-ha.sh's
    own cert generation: TLS verification is ``SSL_VERIFY_NONE``
    everywhere in this codebase (no hostname/identity check anywhere),
    so a fresh self-signed pair is exactly as valid a test double as a
    long-lived shared one.
    """
    if shutil.which("openssl") is None:
        pytest.skip("openssl not found on PATH -- required to generate a test TLS cert")
    cert_dir = tmp_path_factory.mktemp("xceadmin-tls")
    cert_file = cert_dir / "xce.crt"
    key_file = cert_dir / "xce.key"
    subprocess.run(
        [
            "openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes",
            "-days", "3650",
            "-keyout", str(key_file), "-out", str(cert_file),
            "-subj", "/CN=xceadmin-test",
        ],
        check=True,
        capture_output=True,
    )
    return TlsCertPair(cert_file=cert_file, key_file=key_file)