"""Integrity & signature extractor tests (no external deps)."""

from __future__ import annotations

from extractors.features import integrity


def test_identifies_jpeg_and_hashes(jpeg_bytes):
    res = integrity.analyze_bytes(jpeg_bytes)
    assert res.ok is True
    assert res.results["container"] == "JPEG"
    assert len(res.results["sha256"]) == 64
    assert res.results["size_bytes"] == len(jpeg_bytes)
    assert not res.anomalies


def test_identifies_png(png_bytes):
    res = integrity.analyze_bytes(png_bytes)
    assert res.results["container"] == "PNG"


def test_detects_trailing_data_after_jpeg_eoi(jpeg_bytes):
    tampered = jpeg_bytes + b"\x00" * 64  # appended payload after FFD9
    res = integrity.analyze_bytes(tampered)
    assert res.results.get("trailing_bytes_after_eoi") == 64
    assert any("appended after JPEG" in a for a in res.anomalies)


def test_detects_mp4_brand():
    data = b"\x00\x00\x00\x18ftypmp42" + b"\x00" * 32
    res = integrity.analyze_bytes(data)
    assert "ISO-BMFF/MP4" in res.results["container"]