using System.Security.Cryptography;
using System.Text;
using MoShiro.Backend.Application;

namespace MoShiro.Backend.Tests;

/// <summary>
/// 测试用的发布密钥：真正的 CI 私钥不在仓库里，测试后端用这把公钥验签（<see cref="BackendFixture"/> 替换了内嵌的那把），
/// 登记清单的用例用它签名——和 CI 一样是 DER 编码的 ECDSA P-256 / SHA-256，签名对象是清单的原始字节。
/// </summary>
public sealed class TestReleaseKey : IReleaseKey
{
    private static readonly ECDsa s_key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
    private static readonly object s_gate = new();

    public static TestReleaseKey Instance { get; } = new();

    public string Pem
    {
        get
        {
            lock (s_gate)
            {
                return s_key.ExportSubjectPublicKeyInfoPem();
            }
        }
    }

    public static string Sign(string manifest)
    {
        lock (s_gate)
        {
            return Convert.ToBase64String(s_key.SignData(Encoding.UTF8.GetBytes(manifest), HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence));
        }
    }
}