from dataclasses import dataclass


@dataclass(frozen=True, repr=False)
class CertificateMaterial:
    """
    Secret-bearing certificate material for transient use only.

    Instances must never be persisted, placed in generic reconciliation
    objects, or included in logs.
    """

    certificate: bytes
    certificate_key: bytes
    intermediate_certificate: bytes | None = None

    def __post_init__(self) -> None:
        if not isinstance(self.certificate, bytes) or not self.certificate:
            raise ValueError(
                "Certificate material requires certificate bytes"
            )

        if (
            not isinstance(self.certificate_key, bytes)
            or not self.certificate_key
        ):
            raise ValueError(
                "Certificate material requires certificate-key bytes"
            )

        if self.intermediate_certificate is not None and (
            not isinstance(self.intermediate_certificate, bytes)
            or not self.intermediate_certificate
        ):
            raise ValueError(
                "Intermediate certificate must be non-empty bytes"
            )

    def __repr__(self) -> str:
        intermediate = (
            "<redacted>"
            if self.intermediate_certificate is not None
            else "None"
        )
        return (
            "CertificateMaterial("
            "certificate=<redacted>, "
            "certificate_key=<redacted>, "
            f"intermediate_certificate={intermediate}"
            ")"
        )