using System.Security.Cryptography;
using ZB.MOM.WW.Secrets.Abstractions;

namespace ZB.MOM.WW.Secrets.Tests.Fakes;

/// <summary>
/// A hand-written <see cref="IMasterKeyProvider"/> test double (the family does not use Moq).
/// Generates a random 32-byte master key once at construction and returns it stably, alongside
/// a caller-supplied <see cref="KekId"/>. Two instances with the same <see cref="KekId"/> string
/// still hold different key bytes, which lets a test prove that a matching KEK id but wrong key
/// material fails closed.
/// </summary>
public sealed class FakeMasterKeyProvider : IMasterKeyProvider
{
    private readonly byte[] _key;

    /// <summary>
    /// Creates a provider with a freshly generated random 32-byte master key and the given
    /// <paramref name="kekId"/>.
    /// </summary>
    /// <param name="kekId">The stable, non-secret key identifier this provider reports.</param>
    public FakeMasterKeyProvider(string kekId = "k1")
    {
        KekId = kekId;
        _key = RandomNumberGenerator.GetBytes(32);
    }

    /// <summary>
    /// Creates a provider that reuses an explicit 32-byte key. Use this to build a second
    /// provider with the same key bytes as another (or, by omitting it, a different random key).
    /// </summary>
    /// <param name="kekId">The stable, non-secret key identifier this provider reports.</param>
    /// <param name="key">The exact 32-byte master key material to use.</param>
    public FakeMasterKeyProvider(string kekId, byte[] key)
    {
        KekId = kekId;
        _key = (byte[])key.Clone();
    }

    /// <inheritdoc />
    public string KekId { get; }

    /// <inheritdoc />
    public ReadOnlyMemory<byte> GetMasterKey() => _key;
}