# -*- coding: utf-8 -*-
"""Comprehensive unittests for order.py"""

# pylint: disable=C0302, C0415, R0904, R0913, R0914, R0915, W0212
import unittest
from unittest.mock import patch, MagicMock, call, ANY

import logging
import types
import json
import os
import sys

# Inject a mock acme2certifier.acme_srv.db_handler.DBstore into sys.modules if missing
import types as _types

sys.path.insert(0, ".")
sys.path.insert(1, "..")


class FakeDBStore(object):
    """face DBStore class needed for mocking"""

    # pylint: disable=W0107, R0903
    pass


class TestOrderRepository(unittest.TestCase):
    def setUp(self):

        models_mock = MagicMock()
        modules = {"acme2certifier.acme_srv.db_handler": models_mock}
        patch.dict("sys.modules", modules).start()
        import logging

        logging.basicConfig(level=logging.CRITICAL)
        self.logger = logging.getLogger("test_a2c")
        self.dbstore = MagicMock()
        from acme2certifier.acme_srv.order import OrderRepository

        self.order_repository = OrderRepository(self.dbstore, self.logger)

    def test_001_add_order_success(self):
        self.order_repository.dbstore.order_add.return_value = "oid"
        self.assertEqual(self.order_repository.add_order({"foo": "bar"}), "oid")

    def test_002_add_order_failure(self):
        self.order_repository.dbstore.order_add.side_effect = Exception("fail")
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.add_order({"foo": "bar"})
        self.assertIn(
            "Failed to add order: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to add order: fail",
            log_cm.output,
        )

    def test_003_add_authorization_success(self):
        self.order_repository.dbstore.authorization_add.return_value = "aid"
        self.assertEqual(self.order_repository.add_authorization({"foo": "bar"}), "aid")

    def test_004_add_authorization_failure(self):
        self.order_repository.dbstore.authorization_add.side_effect = Exception("fail")
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.add_authorization({"foo": "bar"})
        self.assertIn(
            "Failed to add authorization: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to add authorization: fail",
            log_cm.output,
        )

    def test_005_update_authorization_success(self):
        self.order_repository.dbstore.authorization_update.return_value = "ok"
        self.assertEqual(
            self.order_repository.update_authorization({"foo": "bar"}), "ok"
        )

    def test_006_update_authorization_failure(self):
        self.order_repository.dbstore.authorization_update.side_effect = Exception(
            "fail"
        )
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.update_authorization({"foo": "bar"})
        self.assertIn(
            "Failed to update authorization: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to update authorization: fail",
            log_cm.output,
        )

    def test_007_order_lookup_success(self):
        self.order_repository.dbstore.order_lookup.return_value = {"name": "order1"}
        self.assertEqual(
            self.order_repository.order_lookup("name", "order1"), {"name": "order1"}
        )

    def test_008_order_lookup_with_vlist(self):
        self.order_repository.dbstore.order_lookup.return_value = {
            "account__name": "acc1"
        }
        self.assertEqual(
            self.order_repository.order_lookup(
                "name", "order1", vlist=["account__name"]
            ),
            {"account__name": "acc1"},
        )
        self.order_repository.dbstore.order_lookup.assert_called_with(
            "name", "order1", ["account__name"]
        )

    def test_009_order_lookup_failure(self):
        self.order_repository.dbstore.order_lookup.side_effect = Exception("fail")
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.order_lookup("name", "order1")
        self.assertIn(
            "Failed to look up order: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to look up order: fail",
            log_cm.output,
        )

    def test_010_order_update_success(self):
        self.order_repository.dbstore.order_update.return_value = "ok"
        self.assertEqual(self.order_repository.order_update({"foo": "bar"}), "ok")

    def test_011_order_update_failure(self):
        self.order_repository.dbstore.order_update.side_effect = Exception("fail")
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.order_update({"foo": "bar"})
        self.assertIn(
            "Failed to update order: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to update order: fail",
            log_cm.output,
        )

    def test_012_authorization_lookup_success(self):
        self.order_repository.dbstore.authorization_lookup.return_value = [
            {"name": "auth1"}
        ]
        self.assertEqual(
            self.order_repository.authorization_lookup("key", "val", ["name"]),
            [{"name": "auth1"}],
        )

    def test_013_authorization_lookup_failure(self):
        self.order_repository.dbstore.authorization_lookup.side_effect = Exception(
            "fail"
        )
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.authorization_lookup("key", "val", ["name"])
        self.assertIn(
            "Failed to look up authorization: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to look up authorization: fail",
            log_cm.output,
        )

    def test_014_certificate_lookup_success(self):
        self.order_repository.dbstore.certificate_lookup.return_value = {
            "name": "cert1"
        }
        self.assertEqual(
            self.order_repository.certificate_lookup("key", "val"), {"name": "cert1"}
        )

    def test_015_certificate_lookup_failure(self):
        self.order_repository.dbstore.certificate_lookup.side_effect = Exception("fail")
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.certificate_lookup("key", "val")
        self.assertIn(
            "Failed to look up certificate: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to look up certificate: fail",
            log_cm.output,
        )

    def test_016_hkparameter_get_success(self):
        self.order_repository.dbstore.hkparameter_get.return_value = "profiles"
        self.assertEqual(self.order_repository.hkparameter_get("profiles"), "profiles")

    def test_017_hkparameter_get_failure(self):
        self.order_repository.dbstore.hkparameter_get.side_effect = Exception("fail")
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.hkparameter_get("profiles")
        self.assertIn(
            "Failed to get hkparameter: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to get hkparameter: fail",
            log_cm.output,
        )

    def test_018_orders_invalid_search_success(self):
        self.order_repository.dbstore.orders_invalid_search.return_value = ["order1"]
        self.assertEqual(
            self.order_repository.orders_invalid_search("expires", 0, [], "<="),
            ["order1"],
        )

    def test_019_orders_invalid_search_failure(self):
        self.order_repository.dbstore.orders_invalid_search.side_effect = Exception(
            "fail"
        )
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.orders_invalid_search("expires", 0, [], "<=")
        self.assertIn(
            "Failed to search for invalid orders: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to search for invalid orders: fail",
            log_cm.output,
        )

    def test_020_account_lookup_success(self):
        self.order_repository.dbstore.account_lookup.return_value = {"name": "acct1"}
        self.assertEqual(
            self.order_repository.account_lookup("name", "acct1"), {"name": "acct1"}
        )

    def test_021_account_lookup_failure(self):
        self.order_repository.dbstore.account_lookup.side_effect = Exception("fail")
        with self.assertRaises(Exception) as context:
            with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
                self.order_repository.account_lookup("name", "acct1")
        self.assertIn(
            "Failed to look up account: fail",
            str(context.exception),
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to look up account: fail",
            log_cm.output,
        )


class TestOrderClass(unittest.TestCase):
    def test_022_process_csr_dryrun_skipped(self):
        # Covers: enroll_and_store returns dryrun skipped, triggers code=401, message=error, detail preserved
        from acme2certifier.acme_srv.helpers.global_variables import DRYRUN_ENROLLMENT_SKIPPED_DETAIL

        with patch("acme2certifier.acme_srv.helper.b64_url_recode", return_value="csrval"):
            self.order._get_order_info = MagicMock(return_value={"name": "order1"})
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = "cert1"
            cert_mock.enroll_and_store.return_value = (
                "some_error",
                DRYRUN_ENROLLMENT_SKIPPED_DETAIL,
            )
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_class.return_value.__enter__.return_value = cert_mock
                with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                    result = self.order._process_csr("order1", "csr", "header")
                    self.assertEqual(
                        result,
                        (401, "some_error", DRYRUN_ENROLLMENT_SKIPPED_DETAIL),
                    )
                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr(order1)", log_cm.output
                )
                self.assertIn(
                    f"DEBUG:test_a2c:Order._process_csr() ended with order:order1 401:{{some_error:{DRYRUN_ENROLLMENT_SKIPPED_DETAIL}",
                    log_cm.output,
                )

    def setUp(self):
        """setup unittest"""
        models_mock = MagicMock()
        modules = {"acme2certifier.acme_srv.db_handler": models_mock}
        patch.dict("sys.modules", modules).start()
        import logging

        logging.basicConfig(level=logging.CRITICAL)
        self.logger = logging.getLogger("test_a2c")
        from acme2certifier.acme_srv.order import Message
        from acme2certifier.acme_srv.order import Order
        from acme2certifier.acme_srv.signature import Signature

        self.message = Message(False, "http://tester.local", self.logger)
        self.signature = Signature(False, "http://tester.local", self.logger)
        self.order = Order(debug=True, server_name="test", logger=self.logger)
        self.order.repository = MagicMock()

    def test_023__enter_(self):
        """test enter"""
        self.order.__enter__()

    def test_024__enter_(self):
        """test enter"""
        self.order.__exit__()

    def test_025_are_identifiers_allowed_logging(self):

        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            self.order.are_identifiers_allowed([{"type": "foo", "value": "bar"}])
        self.assertIn("DEBUG:test_a2c:Order.are_identifiers_allowed()", log_cm.output)
        self.assertIn(
            "DEBUG:test_a2c:Order.are_identifiers_allowed() ended with: urn:ietf:params:acme:error:unsupportedIdentifier",
            log_cm.output,
        )

    def test_026_is_profile_valid_profile_check_disabled(self):
        self.order.config.profiles_check_disable = False
        self.order.config.profiles = {"foo": {}}
        result = self.order.is_profile_valid("foo")
        self.assertIsNone(result)

    def test_027_is_profile_valid_invalid(self):
        self.order.config.profiles_check_disable = False
        self.order.config.profiles = {"bar": True, "baz": True}
        with self.assertLogs("test_a2c", level="WARNING") as log_cm:
            self.assertEqual(
                self.order.is_profile_valid("foo"),
                "urn:ietf:params:acme:error:invalidProfile",
            )
        self.assertIn(
            "WARNING:test_a2c:Profile 'foo' is not valid. Ignoring submitted profile.",
            log_cm.output,
        )

    def test_028_is_profile_valid_invalid_override(self):
        self.order.config.profiles_check_disable = False
        self.order.config.profiles = {"bar": True}
        with self.assertLogs("test_a2c", level="INFO") as log_cm:
            self.assertFalse(self.order.is_profile_valid("foo"))
        self.assertIn(
            "INFO:test_a2c:Only one profile configured. Overwriting submitted profile 'foo' with 'bar'.",
            log_cm.output,
        )
        self.assertIn(
            "WARNING:test_a2c:Profile 'foo' is not valid. Ignoring submitted profile.",
            log_cm.output,
        )

    def test_029_is_profile_valid_valid_profile(self):

        self.order.config.profiles_check_disable = True
        self.order.config.profiles = {"foo": {}}
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            self.assertIsNone(self.order.is_profile_valid("foo"))

        self.assertIn("DEBUG:test_a2c:Order.is_profile_valid(foo)", log_cm.output)
        self.assertIn(
            "DEBUG:test_a2c:Order.is_profile_valid() ended with None", log_cm.output
        )
        self.assertIn(
            "DEBUG:test_a2c:Order.is_profile_valid(): profile check disabled",
            log_cm.output,
        )
        self.assertNotIn(
            "WARNING:Profile 'foo' is not valid. Ignoring submitted profile.",
            log_cm.output,
        )

    def test_030_add_profile_to_order_valid(self):
        self.order.config.profiles = {"foo": {}}
        self.order.config.profiles_check_disable = False
        data_dic = {}
        payload = {"profile": "foo"}
        error, updated_dic = self.order.add_profile_to_order(data_dic, payload)
        self.assertIsNone(error)
        self.assertEqual(updated_dic["profile"], "foo")

    def test_031_add_profile_to_order_invalid(self):
        self.order.config.profiles = {}
        self.order.config.profiles_check_disable = False
        data_dic = {}
        payload = {"profile": "foo"}
        error, updated_dic = self.order.add_profile_to_order(data_dic, payload)
        self.assertEqual(error, "urn:ietf:params:acme:error:invalidProfile")
        self.assertNotIn("profile", updated_dic)

    def test_032_add_profile_to_order_no_profiles_configured(self):
        self.order.config.profiles = {}
        self.order.config.profiles_check_disable = False
        data_dic = {}
        payload = {"profile": "foo"}
        # Patch is_profile_valid to return None (simulate valid profile)
        with patch.object(self.order, "is_profile_valid", return_value=None):
            with self.assertLogs("test_a2c", level="WARNING") as log_cm:
                error, updated_dic = self.order.add_profile_to_order(data_dic, payload)
                self.assertIsNone(error)
                self.assertNotIn("profile", updated_dic)
            self.assertIn(
                "WARNING:test_a2c:Ignore submitted profile 'foo' as no profiles are configured.",
                log_cm.output,
            )

    def test_033_add_profile_to_order_single_profile_overwrite(self):
        self.order.config.profiles = {"bar": True}
        self.order.config.profiles_check_disable = False
        self.order.config.dryrun_profilename = None
        data_dic = {}
        payload = {"profile": "foo"}

        with patch.object(self.order, "is_profile_valid", return_value=None):
            with self.assertLogs("test_a2c", level="INFO") as log_cm:
                error, updated_dic = self.order.add_profile_to_order(data_dic, payload)

        self.assertIsNone(error)
        self.assertEqual(updated_dic["profile"], "bar")
        self.assertIn(
            "INFO:test_a2c:Order.add_profile_to_order(): overwriting submitted profile 'foo' with 'bar'.",
            log_cm.output,
        )

    def test_034_process_order_request_db_error_logging(self):
        self.order.repository.certificate_lookup.side_effect = Exception("DB error")
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            result = self.order._process_order_request(
                "order1", {"url": "poll"}, {}, None
            )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: Certificate lookup failed: DB error",
            log_cm.output,
        )

    def test_035_edge_case_empty_identifiers(self):
        # _check_identifiers_validity with empty list
        result = self.order._check_identifiers_validity(
            []
        )  # Edge case with empty identifiers
        self.assertEqual(
            result,
            (self.order.error_msg_dic["malformed"], "malformed identifiers list"),
        )

    def test_036_edge_case_too_many_identifiers(self):
        # _check_identifiers_validity with too many identifiers
        self.order.config.identifier_limit = 1  # Set identifier limit to 1 for testing
        result = self.order._check_identifiers_validity(
            [{"type": "dns", "value": "a"}, {"type": "dns", "value": "b"}]
        )
        self.assertEqual(
            result,
            (
                self.order.error_msg_dic["rejectedidentifier"],
                "identifier limit exceeded",
            ),
        )

    def test_037_edge_case_invalid_identifier_type(self):
        # are_identifiers_allowed with unsupported type
        self.order.config.tnauthlist_support = False
        self.order.config.email_identifier_support = False
        result = self.order.are_identifiers_allowed([{"type": "foo", "value": "bar"}])
        self.assertEqual(
            result,
            (
                self.order.error_msg_dic["unsupportedidentifier"],
                "Identifier type foo not supported",
            ),
        )

    def test_038_edge_case_missing_type(self):
        # are_identifiers_allowed with missing type
        result = self.order.are_identifiers_allowed([{"value": "bar"}])
        self.assertEqual(
            result,
            (self.order.error_msg_dic["malformed"], "Identifier type is missing"),
        )

    def test_039_edge_case_invalid_profile_config(self):
        # _set_profiles_from_db with invalid JSON
        with patch.object(self.order.logger, "error") as mock_log:
            self.order._set_profiles_from_db("notjson")
            mock_log.assert_called()

    def test_040_order_dic_create_all_fields(self):
        # test _order_dic_create with all fields
        tmp_dic = {
            "status": "pending",
            "expires": 1234567890,
            "notbefore": 1234567891,
            "notafter": 1234567892,
            "identifiers": json.dumps([{"type": "dns", "value": "a"}]),
        }
        result = self.order._order_dic_create(tmp_dic)
        self.assertEqual(result["status"], "pending")
        self.assertEqual(result["expires"], "2009-02-13T23:31:30Z")
        self.assertEqual(result["notBefore"], "2009-02-13T23:31:31Z")
        self.assertEqual(result["notAfter"], "2009-02-13T23:31:32Z")
        self.assertIsInstance(result["identifiers"], list)

    def test_041_order_dic_create_invalid_identifiers(self):
        # test _order_dic_create with invalid JSON in identifiers
        tmp_dic = {"identifiers": "notjson"}
        with patch.object(self.order.logger, "error") as mock_log:
            result = self.order._order_dic_create(tmp_dic)
            self.assertIsNone(result.get("identifiers"))
            self.assertIn("identifiers", tmp_dic)
            mock_log.assert_called()

    def test_042_get_authorization_list_db_error(self):
        # test _get_authorization_list with DB error
        self.order.repository.authorization_lookup.side_effect = Exception("DB error")
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            self.order._get_authorization_list("order")
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to look up authorization list: DB error",
            log_cm.output,
        )

    def test_043_update_validity_list_ready(self):
        # test _update_validity_list sets order to ready
        authz_list = [{"name": "auth1", "status__name": "valid"}]
        order_dic = {"status": "pending", "authorizations": []}
        with patch.object(self.order.repository, "order_update") as mock_update:
            self.order._update_validity_list(authz_list, order_dic, "_")
            mock_update.assert_called_with({"name": "_", "status": "ready"})

    def test_044_update_validity_list_not_ready(self):
        # test _update_validity_list does not set order to ready
        authz_list = [{"name": "auth1", "status__name": "pending"}]
        order_dic = {"status": "pending", "authorizations": []}
        with patch.object(self.order.repository, "order_update") as mock_update:
            self.order._update_validity_list(authz_list, order_dic, "_")
            mock_update.assert_not_called()

    def test_045_get_order_details_with_authz(self):
        # test get_order_details with authorizations
        self.order.repository.order_lookup.return_value = {
            "status": "pending",
            "identifiers": json.dumps([{"type": "dns", "value": "a"}]),
        }
        self.order.repository.authorization_lookup.return_value = [
            {"name": "auth1", "status__name": "valid"}
        ]
        with patch.object(self.order, "_update_validity_list") as mock_update:
            result = self.order.get_order_details("order1")
            mock_update.assert_called()
            self.assertIn("status", result)

    def test_046_invalidate_expired_orders(self):
        # test invalidate_expired_orders with valid and invalid orders
        self.order.repository.orders_invalid_search.return_value = [
            {"name": "order1", "status__name": "pending"},
            {"name": "order2", "status__name": "invalid"},
        ]
        with patch.object(self.order.repository, "order_update") as mock_update:
            _, output = self.order.invalidate_expired_orders(1234567890)
            self.assertIn("order1", [o["name"] for o in output])
            self.assertNotIn("order2", [o["name"] for o in output])
            mock_update.assert_called_once_with({"name": "order1", "status": "invalid"})

    def test_047_create_from_content_success(self):
        # test create_from_content with successful order creation
        with patch.object(
            self.order.message,
            "check",
            return_value=(
                200,
                None,
                None,
                None,
                {"identifiers": [{"type": "dns", "value": "a"}]},
                "account",
            ),
        ):
            with patch.object(
                self.order,
                "create_order",
                return_value=(
                    None,
                    "detail",
                    "order",
                    {"auth1": {"type": "dns", "value": "a"}},
                    "2026-01-01T00:00:00Z",
                ),
            ):
                with patch.object(
                    self.order.message,
                    "prepare_response",
                    side_effect=lambda resp, stat: resp,
                ):
                    result = self.order.create_from_content("content")
                    self.assertIn("header", result)
                    self.assertIn("data", result)

    def test_048_create_from_content_rejected(self):
        # test create_from_content with rejected identifier
        with patch.object(
            self.order.message,
            "check",
            return_value=(
                200,
                None,
                None,
                None,
                {"identifiers": [{"type": "dns", "value": "a"}]},
                "account",
            ),
        ):
            with patch.object(
                self.order,
                "create_order",
                return_value=(
                    "rejectedidentifier",
                    "detail",
                    "order",
                    {},
                    "2026-01-01T00:00:00Z",
                ),
            ):
                with patch.object(
                    self.order.message,
                    "prepare_response",
                    side_effect=lambda resp, stat: resp,
                ):
                    result = self.order.create_from_content("content")
                    self.assertTrue(
                        "data" not in result or result.get("data", {}) == {}
                    )

    def test_049_create_from_content_error(self):
        # test create_from_content with generic error
        with patch.object(
            self.order.message,
            "check",
            return_value=(
                200,
                None,
                None,
                None,
                {"identifiers": [{"type": "dns", "value": "a"}]},
                "account",
            ),
        ):
            with patch.object(
                self.order,
                "create_order",
                return_value=(
                    "someerror",
                    "detail",
                    "order",
                    {},
                    "2026-01-01T00:00:00Z",
                ),
            ):
                with patch.object(
                    self.order.message,
                    "prepare_response",
                    side_effect=lambda resp, stat: resp,
                ):
                    result = self.order.create_from_content("content")
                    self.assertTrue(
                        "data" not in result or result.get("data", {}) == {}
                    )

    def test_050_create_from_content_check_fail(self):
        # test create_from_content with check returning error
        with patch.object(
            self.order.message,
            "check",
            return_value=(400, "err", "detail", None, None, None),
        ):
            with patch.object(
                self.order.message,
                "prepare_response",
                side_effect=lambda resp, stat: resp,
            ):
                result = self.order.create_from_content("content")
                self.assertIsInstance(result, dict)

    def test_051_parse_order_message_all_paths(self):
        # test _parse_order_message for all code paths
        # url in protected, order_name, order_dic, process_order_request
        with patch.object(self.order, "_name_get", return_value="order"):
            with patch.object(
                self.order, "get_order_details", return_value={"status": "ok"}
            ):
                with patch.object(
                    self.order,
                    "_process_order_request",
                    return_value=(
                        200,
                        "msg",
                        "detail",
                        "cert",
                    ),
                ):
                    (
                        code,
                        _msg,
                        _detail,
                        _cert,
                        _order,
                    ) = self.order._parse_order_message({"url": "url"}, {}, None)
                    self.assertEqual(code, 200)
            # url in protected, order_name, no order_dic
            with patch.object(self.order, "get_order_details", return_value={}):
                code, _msg, _detail, _cert, _order = self.order._parse_order_message(
                    {"url": "url"}, {}, None
                )
                self.assertEqual(code, 403)
            # url in protected, no order_name
            with patch.object(self.order, "_name_get", return_value=None):
                code, _msg, _detail, _cert, _order = self.order._parse_order_message(
                    {"url": "url"}, {}, None
                )
                self.assertEqual(code, 400)
        # no url in protected
        code, _msg, _detail, _cert, _order = self.order._parse_order_message(
            {}, {}, None
        )
        self.assertEqual(code, 400)

    def test_052_parse_order_content_success(self):
        # test parse_order_content with code 200 and status processing
        with patch.object(
            self.order.message,
            "check",
            return_value=(200, None, None, {"url": "url"}, {}, "account"),
        ):
            with patch.object(
                self.order,
                "_parse_order_message",
                return_value=(200, None, None, None, "order"),
            ):
                with patch.object(
                    self.order,
                    "get_order_details",
                    return_value={"status": "processing"},
                ):
                    with patch.object(
                        self.order.message,
                        "prepare_response",
                        side_effect=lambda resp, stat: resp,
                    ):
                        result = self.order.parse_order_content("content")
                        self.assertIn("header", result)
                        self.assertIn("data", result)

    def test_053_parse_order_content_expiry_disabled(self):
        # test parse_order_content with expiry_check_disable True
        self.order.config.expiry_check_disable = True
        with patch.object(
            self.order.message,
            "check",
            return_value=(200, None, None, {"url": "url"}, {}, "account"),
        ):
            with patch.object(
                self.order,
                "_parse_order_message",
                return_value=(200, None, None, None, "order"),
            ):
                with patch.object(
                    self.order,
                    "get_order_details",
                    return_value={"status": "processing"},
                ):
                    with patch.object(
                        self.order.message,
                        "prepare_response",
                        side_effect=lambda resp, stat: resp,
                    ):
                        result = self.order.parse_order_content("content")
                        self.assertIn("header", result)
                        self.assertIn("data", result)

    def test_054_legacy_api_compatibility(self):
        # test legacy API wrappers
        with patch.object(
            self.order, "invalidate_expired_orders", return_value=([], [])
        ):
            self.assertEqual(self.order.invalidate(), ([], []))
        with patch.object(
            self.order, "create_from_content", return_value={"foo": "bar"}
        ):
            self.assertEqual(self.order.new("content"), {"foo": "bar"})
        with patch.object(
            self.order, "parse_order_content", return_value={"foo": "bar"}
        ):
            self.assertEqual(self.order.parse("content"), {"foo": "bar"})

    def test_055_add_order_and_authorizations_success(self):
        # Order and authorizations added successfully
        self.order.repository.add_order.return_value = "oid"
        self.order.repository.add_authorization.return_value = None
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        data_dic = {"foo": "bar"}
        auth_dic = {}
        error = None
        with patch.object(
            self.order,
            "_add_authorizations_to_db",
            wraps=self.order._add_authorizations_to_db,
        ) as mock_add_authz:

            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                result = self.order._add_order_and_authorizations(
                    data_dic, auth_dic, payload, error
                )
                self.assertIsNone(result)
            self.assertIn(
                "DEBUG:test_a2c:Order._add_order_and_authorizations()", log_cm.output
            )
            self.assertIn(
                "DEBUG:test_a2c:Order._add_order_and_authorizations() ended with None",
                log_cm.output,
            )
            mock_add_authz.assert_called_once()

    def test_056_add_order_and_authorizations_order_db_error(self):
        # Adding order raises DB error
        self.order.repository.add_order.side_effect = Exception("fail")
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        data_dic = {"foo": "bar"}
        auth_dic = {}
        error = None
        with patch.object(
            self.order,
            "_add_authorizations_to_db",
            wraps=self.order._add_authorizations_to_db,
        ) as mock_add_authz:
            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                result = self.order._add_order_and_authorizations(
                    data_dic, auth_dic, payload, error
                )
                self.assertEqual(
                    result, "urn:ietf:params:acme:error:malformed"
                )  # error is set to 'malformed' if oid is None
            self.assertIn(
                "CRITICAL:test_a2c:Database error: failed to add order: fail",
                log_cm.output,
            )
            self.assertIn(
                "DEBUG:test_a2c:Order._add_order_and_authorizations() ended with urn:ietf:params:acme:error:malformed",
                log_cm.output,
            )
            mock_add_authz.assert_called_once_with(None, payload, auth_dic)

    def test_057_add_order_and_authorizations_authz_db_error(self):
        # Adding authorization raises DB error
        self.order.repository.add_order.return_value = "oid"
        self.order.repository.add_authorization.side_effect = Exception("fail")
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        data_dic = {"foo": "bar"}
        auth_dic = {}
        error = None
        # Patch _add_authorizations_to_db to call the real method
        with patch.object(
            self.order,
            "_add_authorizations_to_db",
            wraps=self.order._add_authorizations_to_db,
        ) as mock_add_authz:
            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                result = self.order._add_order_and_authorizations(
                    data_dic, auth_dic, payload, error
                )
                self.assertEqual(result, self.order.error_msg_dic["serverinternal"])
            self.assertIn(
                "CRITICAL:test_a2c:Database error: failed to add authorization: fail",
                log_cm.output,
            )
            self.assertIn(
                f"DEBUG:test_a2c:Order._add_order_and_authorizations() ended with {self.order.error_msg_dic['serverinternal']}",
                log_cm.output,
            )
            mock_add_authz.assert_called_once()

    def test_058_add_order_and_authorizations_with_error_input(self):
        # If error is already set, should skip adding order/authorizations
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        data_dic = {"foo": "bar"}
        auth_dic = {}
        error = "someerror"
        with patch.object(
            self.order,
            "_add_authorizations_to_db",
            wraps=self.order._add_authorizations_to_db,
        ) as mock_add_authz:
            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                result = self.order._add_order_and_authorizations(
                    data_dic, auth_dic, payload, error
                )
                self.assertEqual(
                    result, "someerror"
                )  # Should return the existing error
            self.assertIn(
                "DEBUG:test_a2c:Order._add_order_and_authorizations()", log_cm.output
            )
            self.assertIn(
                "DEBUG:test_a2c:Order._add_order_and_authorizations() ended with someerror",
                log_cm.output,
            )
            mock_add_authz.assert_not_called()

    def test_059_add_order_and_authorizations_logging(self):
        self.order.repository.add_order.return_value = "oid"
        self.order.repository.add_authorization.return_value = None
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        data_dic = {"foo": "bar"}
        auth_dic = {}
        error = None
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            self.order._add_order_and_authorizations(data_dic, auth_dic, payload, error)

        self.assertIn(
            "DEBUG:test_a2c:Order._add_order_and_authorizations()", log_cm.output
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._add_order_and_authorizations() ended with None",
            log_cm.output,
        )

    def test_060_load_header_info_config_valid(self):
        config_dic = {"Order": {"header_info_list": '["X-Header1", "X-Header2"]'}}
        self.order.config.header_info_list = []
        self.order._load_header_info_config(config_dic)
        self.assertEqual(self.order.config.header_info_list, ["X-Header1", "X-Header2"])

    def test_061_load_header_info_config_invalid_json(self):
        config_dic = {"Order": {"header_info_list": "notjson"}}
        with patch.object(self.order.logger, "warning") as mock_warn:
            self.order._load_header_info_config(config_dic)
            mock_warn.assert_called()

    def test_062_load_header_info_config_missing_key(self):
        config_dic = {"Order": {}}
        self.order.config.header_info_list = ["shouldnotchange"]
        self.order._load_header_info_config(config_dic)
        self.assertEqual(self.order.config.header_info_list, ["shouldnotchange"])

    def test_063_load_header_info_config_logging(self):
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            config_dic = {"Order": {"header_info_list": '["X-Header1"]'}}
            self.order._load_header_info_config(config_dic)
            config_dic = {"Order": {"header_info_list": "notjson"}}
            self.order._load_header_info_config(config_dic)

        self.assertIn("DEBUG:test_a2c:Order._load_header_info_config()", log_cm.output)
        self.assertIn(
            "DEBUG:test_a2c:Order._load_header_info_config() ended", log_cm.output
        )
        self.assertIn(
            "WARNING:test_a2c:Failed to parse header_info_list from configuration: Expecting value: line 1 column 1 (char 0)",
            log_cm.output,
        )

    def test_064_load_order_config_all_options(self):
        import configparser

        config_dic = configparser.ConfigParser()
        config_dic.add_section("Challenge")
        config_dic.set("Challenge", "sectigo_sim", "True")
        config_dic.add_section("Order")
        config_dic.set("Order", "tnauthlist_support", "True")
        config_dic.set("Order", "email_identifier_support", "True")
        config_dic.set("Order", "email_identifier_rewrite", "True")
        config_dic.set("Order", "expiry_check_disable", "True")
        config_dic.set("Order", "idempotent_finalize", "True")
        config_dic.set("Order", "retry_after_timeout", "123")
        config_dic.set("Order", "validity", "456")
        config_dic.set("Order", "identifier_limit", "7")
        self.order._load_order_config(config_dic)
        self.assertTrue(self.order.config.sectigo_sim)
        self.assertTrue(self.order.config.tnauthlist_support)
        self.assertTrue(self.order.config.email_identifier_support)
        self.assertTrue(self.order.config.email_identifier_rewrite)
        self.assertTrue(self.order.config.expiry_check_disable)
        self.assertTrue(self.order.config.idempotent_finalize)
        self.assertEqual(self.order.config.retry_after, 123)
        self.assertEqual(self.order.config.validity, 456)
        self.assertEqual(self.order.config.identifier_limit, 7)

    def test_065_load_order_config_invalid_ints(self):
        import configparser

        config_dic = configparser.ConfigParser()
        config_dic.add_section("Challenge")
        config_dic.set("Challenge", "sectigo_sim", "True")
        config_dic.add_section("Order")
        config_dic.set("Order", "retry_after_timeout", "notint")
        config_dic.set("Order", "validity", "notint")
        config_dic.set("Order", "identifier_limit", "notint")
        with self.assertLogs("test_a2c", level="WARNING") as log_cm:
            self.order._load_order_config(config_dic)
        self.assertIn(
            "WARNING:test_a2c:Failed to parse retry_after from configuration: notint",
            log_cm.output,
        )
        self.assertIn(
            "WARNING:test_a2c:Failed to parse validity from configuration: notint",
            log_cm.output,
        )
        self.assertIn(
            "WARNING:test_a2c:Failed to parse identifier_limit from configuration: notint",
            log_cm.output,
        )

    def test_066_load_order_config_missing_sections(self):
        import configparser

        config_dic = configparser.ConfigParser()
        # Should not raise, should use fallbacks
        self.order._load_order_config(config_dic)
        # All config values should remain at their defaults
        self.assertEqual(self.order.config.retry_after, 600)
        self.assertEqual(self.order.config.validity, 86400)
        self.assertEqual(self.order.config.identifier_limit, 20)

    def test_067_create_order_invalid_identifiers(self):
        # Identifiers are invalid, triggers error path
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        account_name = "acct"
        with (
            patch.object(
                self.order,
                "_check_identifiers_validity",
                return_value=("rejectedidentifier", None),
            ) as mock_check,
            patch.object(
                self.order, "_add_order_and_authorizations", return_value=None
            ) as mock_add_order_authz,
        ):
            error, _detail, _order_name, _auth_dic, _expires = self.order.create_order(
                payload, account_name
            )
            self.assertIsNone(error)  # _add_order_and_authorizations returns None
            mock_check.assert_called_once()
            mock_add_order_authz.assert_called_once()

    def test_068_create_order_profile_invalid(self):
        # Profile is present but invalid, triggers error path
        payload = {
            "identifiers": [{"type": "dns", "value": "example.com"}],
            "profile": "foo",
        }
        account_name = "acct"
        with (
            patch.object(
                self.order, "_check_identifiers_validity", return_value=(None, None)
            ) as mock_check,
            patch.object(
                self.order,
                "add_profile_to_order",
                return_value=(
                    "invalidprofile",
                    {
                        "status": 2,
                        "expires": 1234567890,
                        "account": account_name,
                        "name": "randomstring",
                        "identifiers": '[{"type": "dns", "value": "example.com"}]',
                    },
                ),
            ) as mock_add_profile,
            patch.object(
                self.order, "_add_order_and_authorizations", return_value=None
            ) as mock_add_order_authz,
        ):
            error, _detail, _order_name, _auth_dic, _expires = self.order.create_order(
                payload, account_name
            )
            self.assertIsNone(error)
            mock_check.assert_called_once()
            mock_add_profile.assert_called_once()
            mock_add_order_authz.assert_called_once()

    def test_069_create_order_add_order_and_authz_error(self):
        # Error occurs in _add_order_and_authorizations
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        account_name = "acct"
        with (
            patch.object(
                self.order, "_check_identifiers_validity", return_value=(None, None)
            ) as mock_check,
            patch.object(
                self.order, "_add_order_and_authorizations", return_value="someerror"
            ) as mock_add_order_authz,
        ):
            error, _detail, _order_name, _auth_dic, _expires = self.order.create_order(
                payload, account_name
            )
            self.assertEqual(error, "someerror")
            mock_check.assert_called_once()
            mock_add_order_authz.assert_called_once()

    def test_070_create_order_no_identifiers(self):
        # Payload missing 'identifiers', triggers unsupportedidentifier error
        payload = {"profile": "foo"}
        account_name = "acct"
        with (
            patch("acme2certifier.acme_srv.order.generate_random_string", return_value="randomstring"),
            patch("acme2certifier.acme_srv.order.uts_now", return_value=1234567890),
        ):
            error, detail, order_name, auth_dic, expires = self.order.create_order(
                payload, account_name
            )
            self.assertEqual(error, "urn:ietf:params:acme:error:unsupportedIdentifier")
            self.assertEqual(order_name, "randomstring")
            self.assertIsInstance(auth_dic, dict)
            self.assertEqual(expires, "2009-02-14T23:31:30Z")
            self.assertFalse(detail)

    def test_071_create_order_logging(self):
        # Check all log messages with severity INFO and higher
        # Use unified logger and log_stream
        with (
            patch(
                "acme2certifier.acme_srv.helper.generate_random_string", return_value="randomstring"
            ),
            patch("acme2certifier.acme_srv.helper.uts_now", return_value=1234567890),
            patch(
                "acme2certifier.acme_srv.helper.uts_to_date_utc", return_value="2026-01-01T00:00:00Z"
            ),
        ):
            with (
                patch.object(
                    self.order, "_check_identifiers_validity", return_value=(None, None)
                ),
                patch.object(
                    self.order,
                    "add_profile_to_order",
                    return_value=(
                        None,
                        {
                            "status": 2,
                            "expires": 1234567890,
                            "account": "acct",
                            "name": "randomstring",
                            "identifiers": '[{"type": "dns", "value": "example.com"}]',
                            "profile": "foo",
                        },
                    ),
                ),
                patch.object(
                    self.order, "_add_order_and_authorizations", return_value=None
                ),
            ):
                payload = {
                    "identifiers": [{"type": "dns", "value": "example.com"}],
                    "profile": "foo",
                }
                with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                    account_name = "acct"
                    self.order.create_order(payload, account_name)
                self.assertIn("DEBUG:test_a2c:Order.create_order(acct)", log_cm.output)
                self.assertIn(
                    "DEBUG:test_a2c:Order.create_order() ended", log_cm.output
                )

    def test_072_load_profile_config_all_paths(self):
        with patch.object(self.order, "_load_profiles_from_config") as m1:
            with patch.object(self.order, "_load_profiles_from_db_if_sync") as m2:
                with patch.object(self.order, "_maybe_disable_profile_check") as m3:
                    with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                        self.order._load_profile_config({"Order": {}, "CAhandler": {}})
                        m1.assert_called_once()
                        m2.assert_called_once()
                        m3.assert_called_once()
        self.assertIn("DEBUG:test_a2c:Order._load_profile_config()", log_cm.output)
        self.assertIn(
            "DEBUG:test_a2c:Order._load_profile_config() ended", log_cm.output
        )

    def test_073_load_profile_config_all_paths(self):
        with patch.object(self.order, "_load_profiles_from_config") as m1:
            with patch.object(self.order, "_load_profiles_from_db_if_sync") as m2:
                with patch.object(self.order, "_maybe_disable_profile_check") as m3:
                    with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                        self.order._load_profile_config({"Order": {}, "CAhandler": {}})
                        m1.assert_called_once()
                        m2.assert_called_once()
                        m3.assert_called_once()

        self.assertIn("DEBUG:test_a2c:Order._load_profile_config()", log_cm.output)
        self.assertIn(
            "DEBUG:test_a2c:Order._load_profile_config() ended", log_cm.output
        )

    def test_074_load_profiles_from_config_with_profiles(self):
        # Should load profiles and set profiles_check_disable to False
        config_dic = {
            "Order": {
                "profiles": '{"acme": "http://foo.bar/profile1", "profile2": "http://foo.bar/profile2", "profile3": "http://foo.bar/profile3"}'
            }
        }
        self.order._load_profiles_from_config(config_dic)
        self.assertFalse(self.order.config.profiles_check_disable)
        self.assertEqual(
            self.order.config.profiles,
            {
                "acme": "http://foo.bar/profile1",
                "profile2": "http://foo.bar/profile2",
                "profile3": "http://foo.bar/profile3",
            },
        )

    def test_075_load_profiles_from_config_no_profiles(self):
        # Should not set profiles or change profiles_check_disable
        config_dic = {"Order": {}}
        self.order.config.profiles = {"bar": {}}
        self.order.config.profiles_check_disable = True
        self.order._load_profiles_from_config(config_dic)
        self.assertEqual(self.order.config.profiles, {"bar": {}})
        self.assertTrue(self.order.config.profiles_check_disable)

    def test_076_load_profiles_from_db_if_sync_profiles_sync_true(self):
        # Should load profiles from DB if profiles_sync is set and True
        import configparser

        config_dic = configparser.ConfigParser()
        config_dic.add_section("CAhandler")
        config_dic.set("CAhandler", "profiles_sync", "True")
        self.order.repository.hkparameter_get = MagicMock(
            return_value='{"profiles": {"foo": {}}}'
        )
        self.order._set_profiles_from_db = MagicMock()
        self.order._load_profiles_from_db_if_sync(config_dic)
        self.assertTrue(self.order.config.profiles_sync)
        self.order._set_profiles_from_db.assert_called_once_with(
            '{"profiles": {"foo": {}}}'
        )

    def test_077_load_profiles_from_db_if_sync_profiles_sync_false(self):
        # Should not load profiles from DB if profiles_sync is False
        import configparser

        config_dic = configparser.ConfigParser()
        config_dic.add_section("CAhandler")
        config_dic.set("CAhandler", "profiles_sync", "False")
        self.order.repository.hkparameter_get = MagicMock()
        self.order._set_profiles_from_db = MagicMock()
        self.order._load_profiles_from_db_if_sync(config_dic)
        self.assertFalse(self.order.config.profiles_sync)
        self.order._set_profiles_from_db.assert_not_called()

    def test_078_load_profiles_from_db_if_sync_no_profiles_sync(self):
        # Should not load profiles from DB if profiles_sync key is missing

        config_dic = {"CAhandler": {}}
        self.order.repository.hkparameter_get = MagicMock()
        self.order._set_profiles_from_db = MagicMock()
        self.order._load_profiles_from_db_if_sync(config_dic)
        self.assertFalse(
            hasattr(self.order.config, "profiles_sync")
            and self.order.config.profiles_sync
        )
        self.order._set_profiles_from_db.assert_not_called()

    def test_079_load_profiles_from_db_if_sync_db_error(self):
        # Should log and handle DB error
        import configparser

        self.order.repository.hkparameter_get = MagicMock(side_effect=Exception("fail"))
        self.order._set_profiles_from_db = MagicMock()
        config_dic = configparser.ConfigParser()
        config_dic.add_section("CAhandler")
        config_dic.set("CAhandler", "profiles_sync", "True")
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            self.order._load_profiles_from_db_if_sync(config_dic)
            self.order._set_profiles_from_db.assert_not_called()

        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to get profile list: fail",
            log_cm.output,
        )

    def test_080_set_profiles_from_db_valid_json(self):
        # Should set profiles from valid JSON string
        self.order._set_profiles_from_db('{"profiles": {"foo": {}}}')
        self.assertEqual(self.order.config.profiles, {"foo": {}})

    def test_081_set_profiles_from_db_invalid_json(self):
        # Should log error on invalid JSON
        with patch.object(self.order.logger, "error") as mock_log:
            self.order._set_profiles_from_db("notjson")
            mock_log.assert_called()

    def test_082_maybe_disable_profile_check_true(self):
        # Should set profiles_check_disable to True if config says so
        import configparser

        self.order.config.profiles = {"foo": {}}
        config_dic = configparser.ConfigParser()
        config_dic.add_section("Order")
        config_dic.set("Order", "profiles_check_disable", "True")
        self.order._maybe_disable_profile_check(config_dic)
        self.assertTrue(self.order.config.profiles_check_disable)

    def test_083_maybe_disable_profile_check_false(self):
        # Should set profiles_check_disable to False if config says so
        import configparser

        self.order.config.profiles = {"foo": {}}
        config_dic = configparser.ConfigParser()
        config_dic.add_section("Order")
        config_dic.set("Order", "profiles_check_disable", "False")
        self.order._maybe_disable_profile_check(config_dic)
        self.assertFalse(self.order.config.profiles_check_disable)

    def test_084_maybe_disable_profile_check_no_profiles(self):
        # Should not change profiles_check_disable if no profiles
        import configparser

        self.order.config.profiles = {}
        config_dic = configparser.ConfigParser()
        config_dic.add_section("Order")
        config_dic.set("Order", "profiles_check_disable", "True")
        self.order.config.profiles_check_disable = False
        self.order._maybe_disable_profile_check(config_dic)
        self.assertFalse(self.order.config.profiles_check_disable)

    def test_085_load_configuration_authz_validity_error(self):
        # Test _load_configuration with invalid Authorization validity (should log warning)
        # Use unified logger and log_stream
        import configparser

        with patch("acme2certifier.acme_srv.order.load_config") as mock_load_config:
            config_dic = configparser.ConfigParser()
            config_dic.add_section("Authorization")
            config_dic.set("Authorization", "validity", "notint")
            mock_load_config.return_value = config_dic
            with (
                patch.object(self.order, "_load_order_config"),
                patch.object(self.order, "_load_header_info_config"),
                patch.object(self.order, "_load_profile_config"),
            ):
                with self.assertLogs("test_a2c", level="WARNING") as log_cm:
                    self.order._load_configuration()
            self.assertIn(
                "WARNING:test_a2c:Failed to parse authz validity from configuration: notint",
                log_cm.output,
            )

    def test_086_load_configuration_without_ordersection(self):
        # Test _load_configuration without oder section in config (should use defaults and log warnings for missing options)
        import configparser

        with patch("acme2certifier.acme_srv.order.load_config") as mock_load_config:
            config_dic = configparser.ConfigParser()
            config_dic.add_section("CAhandler")
            config_dic.set("CAhandler", "foo", "bar")
            mock_load_config.return_value = config_dic
            self.order._load_configuration()
            # All Order config values should be at their defaults
            self.assertEqual(self.order.config.retry_after, 600)
            self.assertEqual(self.order.config.validity, 86400)
            self.assertEqual(self.order.config.identifier_limit, 20)

    def test_087_name_get_logging(self):
        with patch(
            "acme2certifier.acme_srv.order.parse_url", return_value={"path": "/acme/order/ord123"}
        ):
            result = self.order._name_get("/acme/order/ord123")
            self.assertEqual(result, "ord123")

    def test_088_name_get_with_slash(self):
        # Should split and return first part if slash in order name
        with patch(
            "acme2certifier.acme_srv.order.parse_url",
            return_value={"path": "/acme/order/ord456/extra"},
        ):
            result = self.order._name_get("/acme/order/ord456/extra")
            self.assertEqual(result, "ord456")

    def test_089_name_get_logging(self):
        # Should log debug messages using central logger and log_stream
        with patch(
            "acme2certifier.acme_srv.order.parse_url", return_value={"path": "/acme/order/ord789"}
        ):
            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                self.order._name_get("/acme/order/ord789")
            self.assertIn(
                "DEBUG:test_a2c:Order._name_get(/acme/order/ord789)", log_cm.output
            )
            self.assertIn("DEBUG:test_a2c:Order._name_get() ended", log_cm.output)

    def test_090_are_identifiers_allowed_valid(self):
        # Should return None for valid identifiers
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            result = self.order.are_identifiers_allowed(
                [{"type": "dns", "value": "foo.com"}]
            )
            self.assertEqual(result, (None, None))

    def test_091_are_identifiers_allowed_invalid_type(self):
        # Should return unsupportedidentifier for unknown type
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            result = self.order.are_identifiers_allowed(
                [{"type": "foo", "value": "bar"}]
            )
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["unsupportedidentifier"],
                    "Identifier type foo not supported",
                ),
            )

    def test_092_are_identifiers_allowed_invalid_value(self):
        # Should return rejectedidentifier if validate_identifier returns False
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=False):
            result = self.order.are_identifiers_allowed(
                [{"type": "dns", "value": "foo.com"}]
            )
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["rejectedidentifier"],
                    "identifier value foo.com not allowed",
                ),
            )

    def test_093_are_identifiers_allowed_missing_type(self):
        # Should return malformed if type is missing
        result = self.order.are_identifiers_allowed([{"value": "foo.com"}])
        result = self.order.are_identifiers_allowed([{"value": "foo.com"}])
        self.assertEqual(
            result,
            (self.order.error_msg_dic["malformed"], "Identifier type is missing"),
        )

    def test_094_are_identifiers_allowed_tnauthlist_and_email(self):
        # Should allow tnauthlist and email if config enabled
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            self.order.config.tnauthlist_support = True
            self.order.config.email_identifier_support = True
            result = self.order.are_identifiers_allowed(
                [
                    {"type": "tnauthlist", "value": "foo"},
                    {"type": "email", "value": "bar"},
                ]
            )
            self.assertEqual(result, (None, None))

    def test_095_are_identifiers_allowed_wildcard_rejected_when_disabled(self):
        # Should reject wildcard DNS identifiers when wildcard support is disabled
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            self.order.config.wildcard_certificate_disable = True
            result = self.order.are_identifiers_allowed(
                [{"type": "dns", "value": "*.foo.com"}]
            )
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["rejectedidentifier"],
                    "Wildcard identifier *.foo.com not allowed",
                ),
            )

    def test_096_are_identifiers_allowed_wildcard_allowed_when_not_disabled(self):
        # Should allow wildcard DNS identifiers when wildcard support is enabled
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            self.order.config.wildcard_certificate_disable = False
            result = self.order.are_identifiers_allowed(
                [{"type": "dns", "value": "*.foo.com"}]
            )
            self.assertEqual(result, (None, None))

    def test_097_rewrite_email_identifiers_basic(self):
        # Should rewrite DNS with @ to email
        self.order.config.email_identifier_support = True
        self.order.config.email_identifier_rewrite = True
        input_list = [{"type": "dns", "value": "foo@bar.com"}]
        result = self.order._rewrite_email_identifiers(input_list)
        self.assertEqual(result[0]["type"], "email")
        self.assertEqual(
            result[0]["value"], "foo@bar.com"
        )  # Additional assertion to differentiate

    def test_098_rewrite_email_identifiers_no_rewrite(self):
        # Should not rewrite if no @ in value
        input_list = [{"type": "dns", "value": "foobar.com"}]
        result = self.order._rewrite_email_identifiers(input_list)
        self.assertEqual(result[0]["type"], "dns")
        self.assertEqual(
            result[0]["value"], "foobar.com"
        )  # Additional assertion to differentiate

    def test_099_rewrite_email_identifiers_other_types(self):
        # Should not rewrite if type is not dns
        input_list = [{"type": "email", "value": "foo@bar.com"}]
        result = self.order._rewrite_email_identifiers(input_list)
        self.assertEqual(result[0]["type"], "email")
        self.assertEqual(
            result[0]["value"], "foo@bar.com"
        )  # Additional assertion to differentiate

    def test_100_rewrite_email_identifiers_logging(self):
        # Should log info and debug messages using the unified logger
        self.order.config.email_identifier_support = True
        self.order.config.email_identifier_rewrite = True
        input_list = [{"type": "dns", "value": "foo@bar.com"}]
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            self.order._rewrite_email_identifiers(input_list)
        self.assertIn(
            "INFO:test_a2c:Rewrite DNS identifier 'foo@bar.com' to email identifier",
            log_cm.output,
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._rewrite_email_identifiers()", log_cm.output
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._rewrite_email_identifiers() ended", log_cm.output
        )

    def test_101_name_get_basic(self):
        # Should log debug messages using central logger and log_stream
        with patch(
            "acme2certifier.acme_srv.order.parse_url", return_value={"path": "/acme/order/ord123"}
        ):
            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                self.order._name_get("/acme/order/ord123")

            self.assertIn(
                "DEBUG:test_a2c:Order._name_get(/acme/order/ord123)", log_cm.output
            )
            self.assertIn("DEBUG:test_a2c:Order._name_get() ended", log_cm.output)

    def test_102_process_csr_all_paths(self):
        # Covers: found, not found, error, logging
        with patch("acme2certifier.acme_srv.helper.b64_url_recode", return_value="csrval"):
            # Found path
            self.order._get_order_info = MagicMock(return_value={"name": "order1"})
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = "cert1"
            cert_mock.enroll_and_store.return_value = (None, None)
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_class.return_value.__enter__.return_value = cert_mock
                with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                    result = self.order._process_csr("order1", "csr", "header")
                    self.assertEqual(result[0], 200)
                    # Not found path
                    self.order._get_order_info = MagicMock(return_value=None)
                    result = self.order._process_csr("order1", "csr", "header")
                    self.assertEqual(result[0], 400)

                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr(order1)", log_cm.output
                )
                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr() ended with order:order1 200:{cert1:None",
                    log_cm.output,
                )

    def test_103_process_csr_rejected_identifier(self):
        # Covers: enroll_and_store returns rejectedIdentifier leading to 401
        with patch("acme2certifier.acme_srv.helper.b64_url_recode", return_value="csrval"):
            self.order._get_order_info = MagicMock(return_value={"name": "order1"})
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = "cert1"
            rej = "urn:ietf:params:acme:error:rejectedIdentifier"
            cert_mock.enroll_and_store.return_value = (rej, "detailx")
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_class.return_value.__enter__.return_value = cert_mock
                with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                    result = self.order._process_csr("order1", "csr", "header")
                    self.assertEqual(result, (401, rej, "detailx"))

                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr(order1)", log_cm.output
                )
                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr() ended with order:order1 401:{urn:ietf:params:acme:error:rejectedIdentifier:detailx",
                    log_cm.output,
                )

    def test_104_process_csr_serverinternal_error(self):
        # Covers: enroll_and_store returns serverinternal leading to 500
        with patch("acme2certifier.acme_srv.helper.b64_url_recode", return_value="csrval"):

            self.order._get_order_info = MagicMock(return_value={"name": "order1"})
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = "cert1"
            cert_mock.enroll_and_store.return_value = (
                self.order.error_msg_dic["serverinternal"],
                "d",
            )
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_class.return_value.__enter__.return_value = cert_mock
                with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                    result = self.order._process_csr("order1", "csr", "header")
                    self.assertEqual(result[0], 500)
                    self.assertEqual(
                        result[1], self.order.error_msg_dic["serverinternal"]
                    )

                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr(order1)", log_cm.output
                )
                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr() ended with order:order1 500:{urn:ietf:params:acme:error:serverInternal:d",
                    log_cm.output,
                )

    def test_105_process_csr_certificate_store_failure(self):
        # Covers: store_csr returns falsy leading to 500 and CSR processing failed detail
        with patch("acme2certifier.acme_srv.helper.b64_url_recode", return_value="csrval"):
            self.order._get_order_info = MagicMock(return_value={"name": "order1"})
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = None
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_class.return_value.__enter__.return_value = cert_mock
                with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                    result = self.order._process_csr("order1", "csr", "header")
                    self.assertEqual(result[0], 500)
                    self.assertEqual(
                        result[1], self.order.error_msg_dic["serverinternal"]
                    )
                    self.assertEqual(result[2], "CSR processing failed")

                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr(order1)", log_cm.output
                )
                self.assertIn(
                    "DEBUG:test_a2c:Order._process_csr() ended with order:order1 500:{urn:ietf:params:acme:error:serverInternal:CSR processing failed",
                    log_cm.output,
                )

    def test_106_finalize_order_all_paths(self):
        # Covers: ready, valid/idempotent, not ready, logging

        # Ready path
        self.order._get_order_info = MagicMock(return_value={"status": "ready"})
        self.order.repository.order_update = MagicMock()
        self.order._finalize_csr = MagicMock(return_value=(200, "msg", None, "cert"))
        result = self.order._finalize_order("order1", {"csr": "csrval"})
        self.assertEqual(result[0], 200)
        # Valid/idempotent path
        self.order._get_order_info = MagicMock(return_value={"status": "valid"})
        self.order.config.idempotent_finalize = True
        self.order.repository.certificate_lookup = MagicMock(
            return_value={"name": "cert1"}
        )
        result = self.order._finalize_order("order1", {"csr": "csrval"})
        self.assertEqual(result[0], 200)
        # Not ready path
        self.order._get_order_info = MagicMock(return_value={"status": "pending"})
        result = self.order._finalize_order("order1", {"csr": "csrval"})
        self.assertEqual(result[0], 403)

    def test_107_finalize_csr_updates_status_when_no_detail(self):
        # When code==200 and no detail, order_status should update to valid
        self.order.repository.order_update = MagicMock()
        self.order._header_info_lookup = MagicMock(return_value={})
        self.order._process_csr = MagicMock(return_value=(200, "cert1", None))
        result = self.order._finalize_csr("order1", {"csr": "csrval"})
        self.assertEqual(result, (200, None, None, "cert1"))
        self.order.repository.order_update.assert_called_once_with(
            {"name": "order1", "status": "valid"}
        )

    def test_108_finalize_csr_handles_timeout(self):
        # When certificate_name=='timeout', code is set to 200 and message=timeout
        self.order.repository.order_update = MagicMock()
        self.order._header_info_lookup = MagicMock(return_value={})
        self.order._process_csr = MagicMock(return_value=(400, "timeout", "pollid"))
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            result = self.order._finalize_csr("order1", {"csr": "csrval"})
            self.assertEqual(result, (200, "timeout", "pollid", "timeout"))
            self.order.repository.order_update.assert_not_called()
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr(order1)", log_cm.output)
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr() ended", log_cm.output)

    def test_109_finalize_csr_handles_rejected_identifier(self):
        # When certificate_name=='urn:ietf:params:acme:error:rejectedIdentifier', code=401 and message set
        self.order._header_info_lookup = MagicMock(return_value={})
        rej = "urn:ietf:params:acme:error:rejectedIdentifier"
        self.order._process_csr = MagicMock(return_value=(400, rej, "detailx"))
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            result = self.order._finalize_csr("order1", {"csr": "csrval"})
            self.assertEqual(result, (401, rej, "detailx", rej))
            self.order.repository.order_update.assert_not_called()
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr(order1)", log_cm.output)
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr() ended", log_cm.output)

    def test_110_finalize_csr_else_branch_passes_through_detail(self):
        # Enrollment detail is resolved upstream; finalize passes it through.
        self.order.repository.order_update = MagicMock()
        self.order._header_info_lookup = MagicMock(return_value={})
        self.order._process_csr = MagicMock(
            return_value=(500, "urn:ietf:params:acme:error:serverInternal", "ca_detail")
        )
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            result = self.order._finalize_csr("order1", {"csr": "csrval"})
            self.assertEqual(
                result,
                (
                    500,
                    "urn:ietf:params:acme:error:serverInternal",
                    "ca_detail",
                    "urn:ietf:params:acme:error:serverInternal",
                ),
            )
            self.order.repository.order_update.assert_not_called()
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr(order1)", log_cm.output)
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr() ended", log_cm.output)

    def test_111_finalize_csr_else_branch_generic_fallback(self):
        # Safety net when upstream detail is missing.
        from acme2certifier.acme_srv.helpers.global_variables import ENROLLMENT_FAILED_DETAIL

        self.order.repository.order_update = MagicMock()
        self.order._header_info_lookup = MagicMock(return_value={})
        self.order._process_csr = MagicMock(
            return_value=(500, "urn:ietf:params:acme:error:serverInternal", None)
        )
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            result = self.order._finalize_csr("order1", {"csr": "csrval"})
            self.assertEqual(
                result,
                (
                    500,
                    "urn:ietf:params:acme:error:serverInternal",
                    ENROLLMENT_FAILED_DETAIL,
                    "urn:ietf:params:acme:error:serverInternal",
                ),
            )
            self.order.repository.order_update.assert_not_called()
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr(order1)", log_cm.output)
        self.assertIn("DEBUG:test_a2c:Order._finalize_csr() ended", log_cm.output)

    def test_112_process_csr_applies_eab_profile_and_forwards_flag(self):
        with patch("acme2certifier.acme_srv.helper.b64_url_recode", return_value="csrval"):
            self.order.config.eab_profiling = True
            self.order.config.eab_handler = MagicMock()
            self.order.config.ca_error_details_forward = False
            self.order._get_order_info = MagicMock(return_value={"name": "order1"})
            self.order._get_order_account_name = MagicMock(return_value="acc1")
            self.order._apply_eab_profile = MagicMock(
                side_effect=lambda _account: setattr(
                    self.order.config, "ca_error_details_forward", True
                )
            )
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = "cert1"
            cert_mock.enroll_and_store.return_value = (
                self.order.error_msg_dic["serverinternal"],
                "upstream failure",
            )
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_instance = cert_class.return_value.__enter__.return_value
                cert_instance.config = MagicMock()
                cert_instance.store_csr = cert_mock.store_csr
                cert_instance.enroll_and_store = cert_mock.enroll_and_store
                result = self.order._process_csr("order1", "csr", "header")
                self.order._apply_eab_profile.assert_called_once_with("acc1")
                self.assertTrue(cert_instance.config.ca_error_details_forward)
                self.assertEqual(result[0], 500)
                self.assertEqual(result[2], "upstream failure")

    def test_113_order_dic_create_all_paths(self):
        # Covers: all fields, parse error, logging
        tmp_dic = {
            "status": "pending",
            "expires": 1234567890,
            "notbefore": 1234567890,
            "notafter": 1234567890,
            "identifiers": '[{"type": "dns", "value": "foo.com"}]',
        }
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            result = self.order._order_dic_create(tmp_dic)
            self.assertEqual(result["status"], "pending")
            self.assertEqual(result["expires"], "2009-02-13T23:31:30Z")
            self.assertEqual(result["notBefore"], "2009-02-13T23:31:30Z")
            self.assertEqual(result["notAfter"], "2009-02-13T23:31:30Z")
            self.assertIsInstance(result["identifiers"], list)
            # Parse error path
            tmp_dic["identifiers"] = "notjson"
            result = self.order._order_dic_create(tmp_dic)
            self.assertNotIn("identifiers", result)

        self.assertIn("DEBUG:test_a2c:Order._order_dic_create()", log_cm.output)
        self.assertIn("DEBUG:test_a2c:Order._order_dic_create() ended", log_cm.output)
        self.assertIn(
            "ERROR:test_a2c:Error while parsing the identifier notjson", log_cm.output
        )

    def test_114_get_authorization_list_all_paths(self):
        self.order.repository.authorization_lookup.return_value = [
            {"name": "auth1", "status__name": "valid"}
        ]
        self.assertEqual(
            self.order._get_authorization_list("order1"),
            [{"name": "auth1", "status__name": "valid"}],
        )

    def test_115_get_authorization_list_all_paths(self):
        # DB error path
        self.order.repository.authorization_lookup.side_effect = Exception("fail")
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            result = self.order._get_authorization_list("order1")
            self.assertEqual(result, [])

        self.assertIn(
            "DEBUG:test_a2c:Order._get_authorization_list(order1)", log_cm.output
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._get_authorization_list() ended", log_cm.output
        )
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to look up authorization list: fail",
            log_cm.output,
        )

    def test_116_update_validity_list_all_paths(self):
        # Covers: all code paths, logging
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            # All valid
            authz_list = [{"name": "a", "status__name": "valid"}]
            order_dic = {"status": "pending", "authorizations": []}
            self.order._update_validity_list(authz_list, order_dic, "order1")
            # Some invalid
            authz_list = [{"name": "a", "status__name": "invalid"}]
            order_dic = {"status": "pending", "authorizations": []}
            self.order._update_validity_list(authz_list, order_dic, "order1")
            # No validities
            authz_list = []
            order_dic = {"status": "pending", "authorizations": []}
            self.order._update_validity_list(authz_list, order_dic, "order1")
        self.assertIn("DEBUG:test_a2c:Order._update_validity_list()", log_cm.output)
        self.assertIn("DEBUG:test_a2c:Order.get_order_details() ended", log_cm.output)

    def test_117_get_order_details_all_paths(self):
        # Covers: found, not found, logging

        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            self.order._get_order_info = MagicMock(return_value={"status": "pending"})
            result = self.order.get_order_details("order1")

            self.assertEqual(result, {"status": "pending", "authorizations": []})
            self.order._get_order_info = MagicMock(return_value=None)
            result = self.order.get_order_details("order1")
            self.assertIsInstance(result, dict)

        self.assertIn("DEBUG:test_a2c:Order.get_order_details(order1)", log_cm.output)
        self.assertIn("DEBUG:test_a2c:Order.get_order_details() ended", log_cm.output)

    def test_118_invalidate_expired_orders_all_paths(self):
        # Covers: success, db error, logging
        self.order.repository.orders_invalid_search.return_value = [
            {"name": "order1", "status__name": "pending"}
        ]
        result = self.order.invalidate_expired_orders()
        self.assertEqual(
            result,
            (
                [
                    "id",
                    "name",
                    "expires",
                    "identifiers",
                    "created_at",
                    "status__id",
                    "status__name",
                    "account__id",
                    "account__name",
                    "account__contact",
                ],
                [{"name": "order1", "status__name": "pending"}],
            ),
        )

    def test_119_invalidate_expired_orders_all_paths(self):
        # DB error path
        self.order.repository.orders_invalid_search.side_effect = Exception("fail")
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            result = self.order.invalidate_expired_orders()
            self.assertIsInstance(result, tuple)
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to search for expired orders: fail",
            log_cm.output,
        )

    def test_120_process_order_request_all_paths(self):
        # Covers: finalize, polling, cert found, cert not found, url missing, logging

        self.order._finalize_order = MagicMock(return_value=(200, "msg", None, "cert"))
        self.order.repository.certificate_lookup = MagicMock(
            return_value={"name": "cert1"}
        )
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            # Finalize path
            result = self.order._process_order_request(
                "order1", {"url": "finalize"}, {}, None
            )
            self.assertEqual(result[0], 200)
            # Polling path with cert found
            result = self.order._process_order_request(
                "order1", {"url": "poll"}, {}, None
            )
            self.assertEqual(result[0], 200)
            # Polling path with cert not found
            self.order.repository.certificate_lookup = MagicMock(return_value={})
            result = self.order._process_order_request(
                "order1", {"url": "poll"}, {}, None
            )
            self.assertEqual(result[0], 200)
            # url missing
            result = self.order._process_order_request("order1", {}, {}, None)
            self.assertEqual(result[0], 400)

        self.assertIn(
            "DEBUG:test_a2c:Order._process_order_request({order1)", log_cm.output
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._process_order_request() ended with order:order1 200:msg:None",
            log_cm.output,
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._process_order_request() ended with order:order1 400:urn:ietf:params:acme:error:malformed:url is missing in protected",
            log_cm.output,
        )

    def test_121_check_identifiers_validity_all_paths(self):
        # Covers: valid, too many, malformed, email rewrite, allowed, rejected, and logging
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            self.order.config.identifier_limit = 2
            self.order.config.email_identifier_support = True
            self.order.config.email_identifier_rewrite = True
            # Valid identifiers, triggers rewrite
            idents = [{"type": "dns", "value": "foo@bar.com"}]
            result = self.order._check_identifiers_validity(idents)
            self.assertEqual(result, (None, None))
            # Too many identifiers
            too_many = [{"type": "dns", "value": "a"}] * 3
            result = self.order._check_identifiers_validity(too_many)
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["rejectedidentifier"],
                    "identifier limit exceeded",
                ),
            )
            # Malformed (not a list)
            result = self.order._check_identifiers_validity(None)
            self.assertEqual(
                result,
                (self.order.error_msg_dic["malformed"], "malformed identifiers list"),
            )

    def test_122_check_identifiers_validity_all_paths(self):
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=False):
            self.order.config.identifier_limit = 2
            self.order.config.email_identifier_support = True
            self.order.config.email_identifier_rewrite = True
            idents = [{"type": "dns", "value": "foo@bar.com"}]
            result = self.order._check_identifiers_validity(idents)
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["rejectedidentifier"],
                    "identifier value foo@bar.com not allowed",
                ),
            )

    def test_123_get_order_info_all_paths(self):
        # Covers: successful lookup, DB error, logging
        self.order.repository.order_lookup.return_value = {"name": "order1"}
        result = self.order._get_order_info("order1")
        self.assertEqual(result, {"name": "order1"})

    def test_124_get_order_info_all_paths(self):
        # Clear log buffer before error path
        self.order.repository.order_lookup.side_effect = Exception("fail")
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            result = self.order._get_order_info("order1")
            self.assertIsNone(result)
            self.assertIn(
                "CRITICAL:test_a2c:Database error: failed to look up order: fail",
                log_cm.output,
            )

    def test_125_header_info_lookup_all_paths(self):
        # Covers: header present, header missing, header_info_list missing, logging
        # Use central logger and log_stream from setUp

        self.order.config.header_info_list = ["X-Test", "X-Other"]
        # Header with matching keys
        header = {"X-Test": "foo", "X-Other": "bar", "X-Irrelevant": "baz"}
        result = self.order._header_info_lookup(header)
        self.assertEqual(json.loads(result), {"X-Test": "foo", "X-Other": "bar"})
        # Header with no matching keys
        header = {"X-Irrelevant": "baz"}
        result = self.order._header_info_lookup(header)
        self.assertIsNone(result)
        # No header_info_list
        self.order.config.header_info_list = None
        result = self.order._header_info_lookup({"X-Test": "foo"})
        self.assertIsNone(result)

    def test_126_enter_loads_configuration_and_returns_self(self):
        # Covers __enter__: should call _load_configuration and return self
        with patch.object(self.order, "_load_configuration") as mock_load_config:
            result = self.order.__enter__()
            mock_load_config.assert_called_once()
            self.assertIs(result, self.order)

    def test_127_parse_order_content_adds_certificate(self):
        # Covers lines 976-978: certificate_name and status valid adds certificate path
        with patch.object(
            self.order.message,
            "check",
            return_value=(200, None, None, {"url": "url"}, {}, "account"),
        ):
            with patch.object(
                self.order,
                "_parse_order_message",
                return_value=(200, None, None, "cert123", "order1"),
            ):
                with patch.object(
                    self.order, "get_order_details", return_value={"status": "valid"}
                ):
                    with patch.object(
                        self.order.message,
                        "prepare_response",
                        side_effect=lambda resp, stat: resp,
                    ):
                        self.order.path_dic["cert_path"] = "/acme/cert/"
                        self.order.server_name = "https://example.com"
                        result = self.order.parse_order_content("content")
                        self.assertIn("certificate", result["data"])
                        self.assertEqual(
                            result["data"]["certificate"],
                            "https://example.com/acme/cert/cert123",
                        )

    def test_128_invalidate_expired_orders_update_error_logging(self):
        # Covers lines 831-840: order_update raises OrderDatabaseError and logs CRITICAL
        self.order.repository.orders_invalid_search = MagicMock(
            return_value=[{"name": "order1", "status__name": "pending"}]
        )
        self.order.repository.order_update = MagicMock(side_effect=Exception("fail"))
        # Run
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            self.order.invalidate_expired_orders(1234567890)
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to update order status to invalid: fail",
            log_cm.output,
        )

    def test_129_process_csr_generic_error(self):
        # Covers lines 681-684: error is not rejectedIdentifier or serverinternal
        with patch.object(
            self.order, "_get_order_info", return_value={"name": "order1"}
        ):
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = "cert1"
            cert_mock.enroll_and_store.return_value = ("someerror", "detail")
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_class.return_value.__enter__.return_value = cert_mock
                result = self.order._process_csr("order1", "csr", "header")
                self.assertEqual(result[0], 400)
                self.assertEqual(result[1], "someerror")

    def test_130_process_csr_serverinternal_error(self):
        # Covers lines 684-689: error == serverinternal triggers code=500
        with patch.object(
            self.order, "_get_order_info", return_value={"name": "order1"}
        ):
            cert_mock = MagicMock()
            cert_mock.store_csr.return_value = "cert1"
            cert_mock.enroll_and_store.return_value = (
                "urn:ietf:params:acme:error:serverInternal",
                "detail",
            )
            with patch("acme2certifier.acme_srv.order.Certificate") as cert_class:
                cert_class.return_value.__enter__.return_value = cert_mock
                result = self.order._process_csr("order1", "csr", "header")
                self.assertEqual(result[0], 500)
                self.assertEqual(result[1], "urn:ietf:params:acme:error:serverInternal")

    def test_131_process_order_request_db_error_logging(self):
        # Covers: OrderDatabaseError in certificate_lookup and CRITICAL log
        self.order.repository.certificate_lookup.side_effect = Exception("fail")
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            # Should hit the exception path and log CRITICAL
            result = self.order._process_order_request(
                "order1", {"url": "poll"}, {}, None
            )
            self.assertEqual(result[0], 200)
            self.assertIsNone(result[3])  # certificate_name should be None
        self.assertIn(
            "CRITICAL:test_a2c:Database error: Certificate lookup failed: fail",
            log_cm.output,
        )

    def test_132_process_order_request_no_url(self):
        # Covers lines 634-638: protected dict missing 'url' and checks log
        with patch.object(self.order.logger, "debug") as mock_debug:
            result = self.order._process_order_request("ordername", {}, {}, None)
            self.assertEqual(result[0], 400)
            self.assertEqual(result[1], "urn:ietf:params:acme:error:malformed")
            self.assertEqual(result[2], "url is missing in protected")
            self.assertIsNone(result[3])
            mock_debug.assert_any_call(
                "Order._process_order_request() ended with order:%s %s:%s:%s",
                "ordername",
                400,
                "urn:ietf:params:acme:error:malformed",
                "url is missing in protected",
            )

    def test_133_finalize_order_valid_OrderDatabaseError(self):
        # Covers lines 593-597: status not ready
        self.order.repository.order_lookup.return_value = {"status": "valid"}
        self.order.config.idempotent_finalize = True
        self.order.repository.certificate_lookup.side_effect = Exception("db error")
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            result = self.order._finalize_order("ordername", {}, None)
            self.assertEqual(result[0], 200)
            self.assertIsNone(result[1])
            self.assertIsNone(result[2])
            self.assertIsNone(result[3])
        # Extract critical log messages from the log stream and check for the expected message
        self.assertIn(
            "CRITICAL:test_a2c:Database error: Certificate lookup failed: db error",
            log_cm.output,
        )

    def test_134_finalize_order_ready_nocsr(self):
        # Covers lines 593-597: status not ready
        self.order.repository.order_lookup.return_value = {"status": "ready"}
        result = self.order._finalize_order("ordername", {}, None)
        self.assertEqual(result[0], 400)
        self.assertEqual(result[1], "urn:ietf:params:acme:error:badCSR")
        self.assertEqual(result[2], "csr is missing in payload")
        self.assertIsNone(result[3])

    def test_135_finalize_csr_timeout(self):
        # Patch _process_csr to return (200, 'timeout', 'not_none') so the elif branch is taken
        with patch.object(
            self.order, "_process_csr", return_value=(400, "timeout", "not_none")
        ):
            result = self.order._finalize_csr(
                "ordername", {"csr": "csrdata"}, header=None
            )
            self.assertEqual(result[0], 200)
            self.assertEqual(result[1], "timeout")
            self.assertEqual(result[2], "not_none")
            self.assertEqual(result[3], "timeout")

    def test_136_from_content_rejectedidentifier_with_detail(self):
        # Ensure the 'rejectedidentifier' error branch is covered
        rejected = self.order.error_msg_dic["rejectedidentifier"]
        with patch.object(
            self.order.message,
            "check",
            return_value=(
                200,
                None,
                None,
                None,
                {"identifiers": [{"type": "dns", "value": "a"}]},
                "account",
            ),
        ):
            with patch.object(
                self.order,
                "create_order",
                return_value=(rejected, "detail", "order", {}, "2026-01-01T00:00:00Z"),
            ):
                with patch.object(
                    self.order.message,
                    "prepare_response",
                    side_effect=lambda resp, stat: {**resp, **stat},
                ):
                    result = self.order.create_from_content("content")
                    self.assertEqual(result["code"], 403)
                    self.assertEqual(result["type"], rejected)
                    self.assertEqual(result["detail"], "detail")

    def test_137_from_content_rejectedidentifier_without_detail(self):
        # Ensure the 'rejectedidentifier' error branch is covered
        rejected = self.order.error_msg_dic["rejectedidentifier"]
        with patch.object(
            self.order.message,
            "check",
            return_value=(
                200,
                None,
                None,
                None,
                {"identifiers": [{"type": "dns", "value": "a"}]},
                "account",
            ),
        ):
            with patch.object(
                self.order,
                "create_order",
                return_value=(rejected, None, "order", {}, "2026-01-01T00:00:00Z"),
            ):
                with patch.object(
                    self.order.message,
                    "prepare_response",
                    side_effect=lambda resp, stat: {**resp, **stat},
                ):
                    result = self.order.create_from_content("content")
                    self.assertEqual(result["code"], 403)
                    self.assertEqual(result["type"], rejected)
                    self.assertEqual(
                        result["detail"],
                        "Some of the requested identifiers got rejected",
                    )

    def test_138_apply_eab_profile_eab_profiling_disabled(self):
        self.order.config.eab_profiling = False
        with patch.object(self.order, "_apply_eab_profile") as mock_apply_eab:
            payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
            account_name = "acct"
            with (
                patch.object(
                    self.order, "_check_identifiers_validity", return_value=(None, None)
                ),
                patch.object(
                    self.order, "_add_order_and_authorizations", return_value=None
                ),
            ):
                self.order.create_order(payload, account_name)
                mock_apply_eab.assert_not_called()

    def test_139_apply_eab_profile_account_lookup_db_error(self):
        self.order.config.eab_profiling = True
        self.order.repository.account_lookup.side_effect = Exception("fail")
        with patch.object(self.order.logger, "critical") as mock_critical:
            self.order._apply_eab_profile("acct")
            mock_critical.assert_called()

    def test_140_apply_eab_profile_no_eab_kid(self):
        self.order.config.eab_profiling = True
        self.order.repository.account_lookup.return_value = {}
        with patch.object(self.order.logger, "debug") as mock_debug:
            self.order._apply_eab_profile("acct")
            mock_debug.assert_any_call(
                "Order._apply_eab_profile() - apply eab profile setting for account %s",
                "acct",
            )

    def test_141_apply_eab_profile_allowed_domainlist_order_section(self):
        self.order.config.eab_profiling = True
        self.order.repository.account_lookup.return_value = {"eab_kid": "kid1"}
        mock_eab_handler = MagicMock()
        profile_dic = {"kid1": {"order": {"allowed_domainlist": ["example.com"]}}}
        mock_eab_handler.__enter__.return_value.key_file_load.return_value = profile_dic
        self.order.config.eab_handler = MagicMock(return_value=mock_eab_handler)
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            self.order._apply_eab_profile("acct")
            self.assertIn(
                "DEBUG:test_a2c:Order._apply_eab_profile() - apply eab profile setting for account acct",
                log_cm.output,
            )
        self.assertEqual(self.order.config.allowed_domainlist, ["example.com"])

    def test_142_apply_eab_profile_allowed_domainlist_cahandler_section(self):
        self.order.config.eab_profiling = True
        self.order.repository.account_lookup.return_value = {"eab_kid": "kid2"}
        mock_eab_handler = MagicMock()
        profile_dic = {"kid2": {"cahandler": {"allowed_domainlist": ["test.com"]}}}
        mock_eab_handler.__enter__.return_value.key_file_load.return_value = profile_dic
        self.order.config.eab_handler = MagicMock(return_value=mock_eab_handler)
        with self.assertLogs("test_a2c", level="WARNING") as log_cm:
            self.order._apply_eab_profile("acct")
            self.assertIn(
                "WARNING:test_a2c:allowed_domainlist parameter found in cahandler section of the eab-profile - this is deprecated, please use the order section",
                log_cm.output,
            )
        self.assertEqual(self.order.config.allowed_domainlist, ["test.com"])

    def test_143_apply_eab_profile_wildcard_disable_false_order_section(self):
        self.order.config.eab_profiling = True
        self.order.config.wildcard_certificate_disable = True
        self.order.repository.account_lookup.return_value = {"eab_kid": "kid_false"}
        mock_eab_handler = MagicMock()
        profile_dic = {"kid_false": {"order": {"wildcard_certificate_disable": False}}}
        mock_eab_handler.__enter__.return_value.key_file_load.return_value = profile_dic
        self.order.config.eab_handler = MagicMock(return_value=mock_eab_handler)

        self.order._apply_eab_profile("acct")

        self.assertFalse(self.order.config.wildcard_certificate_disable)

    def test_144_load_eab_profile_param_false_cahandler_section(self):
        profile_dic = {
            "kid_false": {"cahandler": {"wildcard_certificate_disable": False}}
        }
        with self.assertLogs("test_a2c", level="WARNING") as log_cm:
            value = self.order._load_eab_profile_param(
                profile_dic, "kid_false", "wildcard_certificate_disable", True
            )

        self.assertFalse(value)
        self.assertIn(
            "WARNING:test_a2c:wildcard_certificate_disable parameter found in cahandler section of the eab-profile - this is deprecated, please use the order section",
            log_cm.output,
        )

    def test_145_load_eab_profile_param_empty_list_in_order_section(self):
        profile_dic = {"kid_list": {"order": {"allowed_domainlist": []}}}
        value = self.order._load_eab_profile_param(
            profile_dic, "kid_list", "allowed_domainlist", ["default.com"]
        )
        self.assertEqual(value, [])

    def test_146_load_eab_profile_param_empty_string_in_order_section(self):
        profile_dic = {"kid_str": {"order": {"custom_key": ""}}}
        value = self.order._load_eab_profile_param(
            profile_dic, "kid_str", "custom_key", "fallback"
        )
        self.assertEqual(value, "")

    def test_147_load_eab_profile_param_order_section_has_precedence(self):
        profile_dic = {
            "kid_precedence": {
                "order": {"wildcard_certificate_disable": False},
                "cahandler": {"wildcard_certificate_disable": True},
            }
        }
        value = self.order._load_eab_profile_param(
            profile_dic, "kid_precedence", "wildcard_certificate_disable", True
        )
        self.assertFalse(value)

    def test_148_load_eab_profile_param_returns_default_if_param_missing(self):
        profile_dic = {"kid_missing": {"order": {}, "cahandler": {}}}
        value = self.order._load_eab_profile_param(
            profile_dic, "kid_missing", "wildcard_certificate_disable", True
        )
        self.assertTrue(value)

    def test_149_apply_eab_profile_generic_exception(self):
        self.order.config.eab_profiling = True
        self.order.repository.account_lookup.return_value = {"eab_kid": "kid3"}
        mock_eab_handler = MagicMock()
        mock_eab_handler.__enter__.return_value.key_file_load.side_effect = Exception(
            "fail"
        )
        self.order.config.eab_handler = MagicMock(return_value=mock_eab_handler)
        with self.assertLogs("test_a2c", level="WARNING") as log_cm:
            self.order._apply_eab_profile("acct")
        self.assertIn(
            "ERROR:test_a2c:Failed to process EAB profile for Account acct (kid: kid3): fail",
            log_cm.output,
        )

    def test_150_create_order_eab_profiling_branch(self):
        # Covers: if self.config.eab_profiling and self.config.eab_handler
        self.order.config.eab_profiling = True
        self.order.config.eab_handler = MagicMock()
        with patch.object(self.order, "_apply_eab_profile") as mock_apply_eab:
            payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
            account_name = "acct"
            with (
                patch.object(
                    self.order, "_check_identifiers_validity", return_value=(None, None)
                ),
                patch.object(
                    self.order, "_add_order_and_authorizations", return_value=None
                ),
            ):
                self.order.create_order(payload, account_name)
                mock_apply_eab.assert_called_once_with(account_name)

    def test_151_create_order_invalid_profile_detail(self):
        # Covers: if error == self.error_msg_dic["invalidprofile"]: detail = "Invalid profile specified"
        self.order.config.eab_profiling = False
        self.order.config.eab_handler = None
        self.order.config.profiles = {"bar": {}}
        payload = {
            "identifiers": [{"type": "dns", "value": "example.com"}],
            "profile": "foo",
        }
        account_name = "acct"
        with (
            patch.object(
                self.order, "_check_identifiers_validity", return_value=(None, None)
            ),
            patch.object(
                self.order,
                "add_profile_to_order",
                return_value=(self.order.error_msg_dic["invalidprofile"], {}),
            ),
            patch.object(
                self.order, "_add_order_and_authorizations", return_value=None
            ),
        ):
            error, detail, order_name, auth_dic, expires = self.order.create_order(
                payload, account_name
            )
            self.assertIsNone(error)
            self.assertEqual(detail, "Invalid profile specified")

    def test_152_are_identifiers_allowed_fqdn_not_whitelisted(self):
        # Covers: FQDN/SAN not allowed by configuration (lines 551-566)
        with (
            patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True),
            patch("acme2certifier.acme_srv.order.is_domain_whitelisted", return_value=False),
        ):
            self.order.config.allowed_domainlist = ["allowed.com"]
            result = self.order.are_identifiers_allowed(
                [{"type": "dns", "value": "notallowed.com"}]
            )
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["rejectedidentifier"],
                    "FQDN/SAN notallowed.com not allowed by configuration",
                ),
            )

    def test_153_check_single_identifier_wildcard_flag_reconstructs_for_domainlist(
        self,
    ):
        # Covers wildcard-intent fallback for normalized identifiers against wildcard-only policy
        self.order.config.allowed_domainlist = ["*.bar.local"]
        identifier = {"type": "dns", "value": "bar.local", "wildcard": True}

        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                error, detail = self.order._check_single_identifier(
                    identifier, ["dns", "ip"]
                )

        self.assertIsNone(error)
        self.assertIsNone(detail)
        self.assertIn(
            "DEBUG:test_a2c:Order._check_single_identifier() - Evaluating allowed_domainlist for value='bar.local' (wildcard flag: True)",
            log_cm.output,
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._check_single_identifier() - Reconstructed wildcard value for allowed_domainlist check: 'bar.local' -> '*.bar.local'",
            log_cm.output,
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._check_single_identifier() - allowed_domainlist check result for reconstructed wildcard value='*.bar.local': True",
            log_cm.output,
        )

    def test_154_check_single_identifier_non_wildcard_skips_reconstruct_and_rejects(
        self,
    ):
        # Covers non-wildcard guard: wildcard reconstruction must not broaden policy
        self.order.config.allowed_domainlist = ["*.bar.local"]
        identifier = {"type": "dns", "value": "bar.local"}

        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True):
            with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
                error, detail = self.order._check_single_identifier(
                    identifier, ["dns", "ip"]
                )

        self.assertEqual(error, self.order.error_msg_dic["rejectedidentifier"])
        self.assertEqual(detail, "FQDN/SAN bar.local not allowed by configuration")
        self.assertIn(
            "DEBUG:test_a2c:Order._check_single_identifier() - Evaluating allowed_domainlist for value='bar.local' (wildcard flag: False)",
            log_cm.output,
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._check_single_identifier() - Skipping reconstructed wildcard allowed_domainlist check (domain_allowed=False, wildcard=False, value_present=True, value_has_wildcard_prefix=False)",
            log_cm.output,
        )

    def test_155_apply_eab_profile_disabled(self):
        # Covers: logger.critical branch in _apply_eab_profile (line 270)
        self.order.config.eab_profiling = False
        self.order.config.eab_handler = MagicMock()
        with (
            patch.object(
                self.order.repository, "account_lookup"
            ) as mock_account_lookup,
            patch.object(self.order.logger, "critical") as mock_critical,
        ):
            self.assertFalse(self.order._apply_eab_profile("acct"))
            self.assertFalse(mock_account_lookup.called)
            self.assertFalse(mock_critical.called)

    def test_156_check_single_identifier_missing_type(self):
        # Covers error message for missing 'type' (line 556)
        identifier = {"value": "bar"}
        allowed_identifiers = ["dns", "ip"]
        with self.assertLogs("test_a2c", level="ERROR") as log_cm:
            error, detail = self.order._check_single_identifier(
                identifier, allowed_identifiers
            )
        self.assertEqual(error, self.order.error_msg_dic["malformed"])
        self.assertEqual(detail, "Identifier type is missing")
        self.assertIn("ERROR:test_a2c:Identifier type is missing", log_cm.output)

    def test_157_check_single_identifier_wrong_type(self):
        # Covers error message for missing 'type' (line 556)
        identifier = {"type": "unknown", "value": "bar"}
        allowed_identifiers = ["dns", "ip"]
        with self.assertLogs("test_a2c", level="ERROR") as log_cm:
            error, detail = self.order._check_single_identifier(
                identifier, allowed_identifiers
            )
            self.assertEqual(error, self.order.error_msg_dic["unsupportedidentifier"])
            self.assertEqual(detail, "Identifier type unknown not supported")
        self.assertIn(
            "ERROR:test_a2c:Identifier type unknown not supported", log_cm.output
        )

    def test_158_check_single_identifier_invalid_value(self):
        # Covers error message for invalid value (line 571)
        identifier = {"type": "dns", "value": "foo"}
        allowed_identifiers = ["dns", "ip"]
        with patch("acme2certifier.acme_srv.order.validate_identifier", return_value=False):
            with self.assertLogs("test_a2c", level="ERROR") as log_cm:
                error, detail = self.order._check_single_identifier(
                    identifier, allowed_identifiers
                )
            self.assertEqual(error, self.order.error_msg_dic["rejectedidentifier"])
            self.assertEqual(detail, "identifier value foo not allowed")
            self.assertIn(
                "ERROR:test_a2c:Identifier value foo not allowed for type dns",
                log_cm.output,
            )

    def test_159_add_authorizations_to_db_success(self):
        # Test normal case: authorizations added successfully
        self.order.repository.add_authorization.return_value = None
        self.order.config.authz_validity = 1000
        oid = "order123"
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        auth_dic = {}
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            error = self.order._add_authorizations_to_db(oid, payload, auth_dic)
            self.assertIsNone(error)
        self.assertIn(
            "DEBUG:test_a2c:Order._add_authorizations_to_db(order123)", log_cm.output
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._add_authorizations_to_db() ended with None",
            log_cm.output,
        )
        self.assertIn("order", payload["identifiers"][0])
        self.assertEqual(payload["identifiers"][0]["status"], "pending")
        self.assertIn(list(auth_dic.keys())[0], auth_dic)

    def test_160_add_authorizations_to_db_malformed(self):
        # Test malformed case: oid is None
        oid = None
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        auth_dic = {}
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            error = self.order._add_authorizations_to_db(oid, payload, auth_dic)
            self.assertEqual(error, self.order.error_msg_dic["malformed"])
        self.assertIn(
            "DEBUG:test_a2c:Order._add_authorizations_to_db(None)", log_cm.output
        )
        self.assertIn(
            f"DEBUG:test_a2c:Order._add_authorizations_to_db() ended with {self.order.error_msg_dic['malformed']}",
            log_cm.output,
        )

    def test_161_add_authorizations_to_db_db_error(self):
        # Test DB error: add_authorization raises exception
        self.order.repository.add_authorization.side_effect = Exception("fail")
        oid = "order123"
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        auth_dic = {}
        with self.assertLogs("test_a2c", level="CRITICAL") as log_cm:
            error = self.order._add_authorizations_to_db(oid, payload, auth_dic)
            self.assertEqual(error, self.order.error_msg_dic["serverinternal"])
        self.assertIn(
            "CRITICAL:test_a2c:Database error: failed to add authorization: fail",
            log_cm.output,
        )

    def test_162_add_authorizations_to_db_sectigo_sim(self):
        # Covers sectigo_sim branch: status set to valid and update_authorization called
        self.order.config.sectigo_sim = True
        self.order.repository.add_authorization.return_value = None
        self.order.repository.update_authorization.return_value = None
        oid = "order123"
        payload = {"identifiers": [{"type": "dns", "value": "example.com"}]}
        auth_dic = {}
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            error = self.order._add_authorizations_to_db(oid, payload, auth_dic)
            self.assertIsNone(error)
        self.assertEqual(payload["identifiers"][0]["status"], "valid")
        self.order.repository.update_authorization.assert_called_once_with(
            payload["identifiers"][0]
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._add_authorizations_to_db(order123)", log_cm.output
        )
        self.assertIn(
            "DEBUG:test_a2c:Order._add_authorizations_to_db() ended with None",
            log_cm.output,
        )

    def test_163_create_from_content_malformed_identifier(self):
        # Covers the branch where error == self.order.error_msg_dic["malformed"] and detail is None
        malformed_error = self.order.error_msg_dic["malformed"]
        with (
            patch.object(
                self.order,
                "create_order",
                return_value=(
                    malformed_error,
                    None,
                    "ordername",
                    {},
                    "2026-01-01T00:00:00Z",
                ),
            ),
            patch.object(
                self.order.message,
                "check",
                return_value=(200, None, None, None, {}, "acct"),
            ),
            patch.object(
                self.order.message,
                "prepare_response",
                side_effect=lambda resp, status: {**resp, **status},
            ),
        ):
            response = self.order.create_from_content("dummycontent")
            self.assertEqual(response["code"], 400)
            self.assertEqual(response["type"], malformed_error)
            self.assertEqual(
                response["detail"], "One of the requested identifiers is not supported"
            )

    def test_164_load_configuration_directory_url_prefix(self):
        # Covers the Directory/url_prefix branch in _load_configuration (line 513)
        import configparser

        config_dic = configparser.ConfigParser()
        config_dic.add_section("Directory")
        config_dic.set("Directory", "url_prefix", "/prefix/")
        config_dic.add_section("Order")
        config_dic.add_section("Authorization")
        with patch("acme2certifier.acme_srv.order.load_config", return_value=config_dic):
            self.order.path_dic = {
                "authz_path": "/acme/authz/",
                "order_path": "/acme/order/",
                "cert_path": "/acme/cert/",
            }
            self.order._load_configuration()
            self.assertTrue(
                all(v.startswith("/prefix/") for v in self.order.path_dic.values())
            )

    def test_165_check_single_identifier_missing_value(self):
        # Covers lines 578-579: missing 'value' in identifier
        identifier = {"type": "dns"}
        allowed_identifiers = ["dns", "ip"]
        with self.assertLogs("test_a2c", level="ERROR") as log_cm:
            error, detail = self.order._check_single_identifier(
                identifier, allowed_identifiers
            )
        self.assertEqual(error, self.order.error_msg_dic["malformed"])
        self.assertEqual(detail, "Identifier value is missing")
        self.assertIn("ERROR:test_a2c:Identifier value is missing", log_cm.output)

    def test_166_is_profile_valid_dryrun_profile_logging(self):
        # Set up dryrun profile
        self.order.config.dryrun_profilename = "dryrun-profile"
        self.order.config.profiles_check_disable = False
        self.order.config.profiles = []
        self.order.error_msg_dic = {"invalidprofile": "invalidprofile"}
        with self.assertLogs(self.logger, level="INFO") as log_cm:
            result = self.order.is_profile_valid("dryrun-profile")
        self.assertIn(
            "Order.is_profile_valid(): dryrun profile 'dryrun-profile' submitted",
            " ".join(log_cm.output),
        )
        self.assertIsNone(result)

    def test_167_add_profile_to_order_dryrun_profile_logging(self):
        # Set up dryrun profile and no profiles configured
        self.order.config.profiles = {}
        self.order.config.dryrun_profilename = "dryrun-profile"
        self.order.config.profiles_check_disable = False
        data_dic = {}
        payload = {"profile": "dryrun-profile"}
        # Patch is_profile_valid to return None (simulate valid profile)
        with patch.object(self.order, "is_profile_valid", return_value=None):
            with self.assertLogs(self.logger, level="DEBUG") as log_cm:
                error, updated_dic = self.order.add_profile_to_order(data_dic, payload)
        self.assertIn(
            "Order.add_profile_to_order(): adding dryrun profile to order",
            " ".join(log_cm.output),
        )
        self.assertIsNone(error)
        self.assertEqual(updated_dic["profile"], "dryrun-profile")

    def test_168_finalize_csr_handles_dryrun_skipped(self):
        # When detail is DRYRUN_ENROLLMENT_SKIPPED_DETAIL, message should be unauthorized error
        from acme2certifier.acme_srv.helpers.global_variables import DRYRUN_ENROLLMENT_SKIPPED_DETAIL

        self.order._header_info_lookup = MagicMock(return_value={})
        self.order._process_csr = MagicMock(
            return_value=(400, "certX", DRYRUN_ENROLLMENT_SKIPPED_DETAIL)
        )
        result = self.order._finalize_csr("order1", {"csr": "csrval"})
        self.assertEqual(
            result,
            (
                400,
                "urn:ietf:params:acme:error:unauthorized",
                DRYRUN_ENROLLMENT_SKIPPED_DETAIL,
                "certX",
            ),
        )

    def test_169_are_identifiers_allowed_ip_not_whitelisted(self):
        # Setup: allowed_iplist is set, is_ip_whitelisted returns False
        self.order.config.allowed_iplist = ["192.168.1.0/24"]
        identifier = {"type": "ip", "value": "10.0.0.1"}
        # Patch is_ip_whitelisted to return False
        with patch("acme2certifier.acme_srv.order.is_ip_whitelisted", return_value=False):
            error, msg = self.order.are_identifiers_allowed([identifier])
            self.assertEqual(error, self.order.error_msg_dic["rejectedidentifier"])
            self.assertEqual(
                msg,
                f'IP address {identifier["value"]} not allowed by configuration',
            )
        # Patch is_ip_whitelisted to return True (should not error)
        with patch("acme2certifier.acme_srv.order.is_ip_whitelisted", return_value=True):
            error, msg = self.order.are_identifiers_allowed([identifier])
            self.assertIsNone(error)
            self.assertIsNone(msg)

    def test_170_are_identifiers_allowed_ip_whitelisted(self):
        # Should allow IP if in allowed_iplist
        with (
            patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True),
            patch("acme2certifier.acme_srv.order.is_ip_whitelisted", return_value=True),
        ):
            self.order.config.allowed_iplist = ["192.168.1.1", "10.0.0.0/8"]
            result = self.order.are_identifiers_allowed(
                [{"type": "ip", "value": "192.168.1.1"}]
            )
            self.assertEqual(result, (None, None))

    def test_171_are_identifiers_allowed_ip_not_whitelisted(self):
        # Should reject IP if not in allowed_iplist
        with (
            patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True),
            patch("acme2certifier.acme_srv.order.is_ip_whitelisted", return_value=False),
        ):
            self.order.config.allowed_iplist = ["192.168.1.1", "10.0.0.0/8"]
            result = self.order.are_identifiers_allowed(
                [{"type": "ip", "value": "8.8.8.8"}]
            )
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["rejectedidentifier"],
                    "IP address 8.8.8.8 not allowed by configuration",
                ),
            )

    def test_172_are_identifiers_allowed_iplist_empty(self):
        # Should allow any IP if allowed_iplist is empty
        with (
            patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True),
            patch("acme2certifier.acme_srv.order.is_ip_whitelisted", return_value=False),
        ):
            self.order.config.allowed_iplist = []
            result = self.order.are_identifiers_allowed(
                [{"type": "ip", "value": "8.8.8.8"}]
            )
            self.assertEqual(result, (None, None))

    def test_173_are_identifiers_allowed_multiple_ips(self):
        # Should reject on first non-whitelisted IP, allow if all whitelisted
        with (
            patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True),
            patch("acme2certifier.acme_srv.order.is_ip_whitelisted", side_effect=[True, False]),
        ):
            self.order.config.allowed_iplist = ["10.0.0.0/8"]
            result = self.order.are_identifiers_allowed(
                [
                    {"type": "ip", "value": "10.1.2.3"},
                    {"type": "ip", "value": "8.8.8.8"},
                ]
            )
            self.assertEqual(
                result,
                (
                    self.order.error_msg_dic["rejectedidentifier"],
                    "IP address 8.8.8.8 not allowed by configuration",
                ),
            )
        with (
            patch("acme2certifier.acme_srv.order.validate_identifier", return_value=True),
            patch("acme2certifier.acme_srv.order.is_ip_whitelisted", side_effect=[True, True]),
        ):
            self.order.config.allowed_iplist = ["10.0.0.0/8"]
            result = self.order.are_identifiers_allowed(
                [
                    {"type": "ip", "value": "10.1.2.3"},
                    {"type": "ip", "value": "10.2.3.4"},
                ]
            )
            self.assertEqual(result, (None, None))

    def test_174_load_profile_mapping_field_returns_none_without_module(self):
        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=None):
            self.assertIsNone(self.order._load_profile_mapping_field({}))

    def test_175_load_profile_mapping_field_from_module_attribute(self):
        ca_module = types.SimpleNamespace(profile_mapping_field="module_profile")

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            result = self.order._load_profile_mapping_field({})

        self.assertEqual(result, "module_profile")

    def test_176_load_profile_mapping_field_from_instance_attribute(self):
        class DummyCAhandler:
            def __init__(self, logger=None):
                self.logger = logger
                self.profile_mapping_field = "instance_profile"

        ca_module = types.SimpleNamespace(CAhandler=DummyCAhandler)

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            result = self.order._load_profile_mapping_field({})

        self.assertEqual(result, "instance_profile")

    def test_177_load_profile_mapping_field_from_noarg_instance_fallback(self):
        class DummyCAhandler:
            def __init__(self):
                self.profile_mapping_field = "noarg_instance_profile"

        ca_module = types.SimpleNamespace(CAhandler=DummyCAhandler)

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            result = self.order._load_profile_mapping_field({})

        self.assertEqual(result, "noarg_instance_profile")

    def test_178_load_profile_mapping_field_from_class_attribute(self):
        class DummyCAhandler:
            profile_mapping_field = "class_profile"

            def __init__(self, logger=None):
                self.logger = logger

        ca_module = types.SimpleNamespace(CAhandler=DummyCAhandler)

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            result = self.order._load_profile_mapping_field({})

        self.assertEqual(result, "class_profile")

    def test_179_load_profile_mapping_field_returns_none_without_handler_class(self):
        ca_module = types.SimpleNamespace()

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            self.assertIsNone(self.order._load_profile_mapping_field({}))

    def test_180_load_profile_mapping_field_class_fallback_after_empty_instance(self):
        class DummyCAhandler:
            profile_mapping_field = "class_profile"

            def __init__(self, logger=None):
                self.logger = logger
                # Shadow class attribute so instance lookup returns falsy and class fallback is used.
                self.profile_mapping_field = None

        ca_module = types.SimpleNamespace(CAhandler=DummyCAhandler)

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            result = self.order._load_profile_mapping_field({})

        self.assertEqual(result, "class_profile")

    def test_181_load_profile_mapping_field_returns_none_when_not_defined(self):
        class DummyCAhandler:
            def __init__(self, logger=None):
                self.logger = logger
                self.profile_mapping_field = None

        ca_module = types.SimpleNamespace(CAhandler=DummyCAhandler)

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            self.assertIsNone(self.order._load_profile_mapping_field({}))

    def test_182_load_profile_mapping_field_warns_when_noarg_fallback_fails(self):
        class DummyCAhandler:
            def __init__(self):
                raise RuntimeError("noarg constructor failed")

        ca_module = types.SimpleNamespace(CAhandler=DummyCAhandler)

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            with self.assertLogs("test_a2c", level="WARNING") as log_cm:
                result = self.order._load_profile_mapping_field({})

        self.assertIsNone(result)
        self.assertTrue(
            any(
                "failed to instantiate CAhandler without logger" in msg
                for msg in log_cm.output
            )
        )

    def test_183_load_profile_mapping_field_warns_when_logger_init_fails(self):
        class DummyCAhandler:
            def __init__(self, logger=None):
                raise RuntimeError("logger constructor failed")

        ca_module = types.SimpleNamespace(CAhandler=DummyCAhandler)

        with patch("acme2certifier.acme_srv.order.ca_handler_load", return_value=ca_module):
            with self.assertLogs("test_a2c", level="WARNING") as log_cm:
                result = self.order._load_profile_mapping_field({})

        self.assertIsNone(result)
        self.assertTrue(
            any(
                "failed to instantiate CAhandler with logger" in msg
                for msg in log_cm.output
            )
        )

    def test_184_profile_mapping_to_dict_none(self):
        self.assertEqual(self.order._profile_mapping_to_dict(None), {})

    def test_185_profile_mapping_to_dict_string(self):
        self.assertEqual(
            self.order._profile_mapping_to_dict("  profile_a  "),
            {"profile_a": True},
        )
        self.assertEqual(self.order._profile_mapping_to_dict("   "), {})

    def test_186_profile_mapping_to_dict_list(self):
        value = [" profile_a ", "profile_b", "", None, 123]
        self.assertEqual(
            self.order._profile_mapping_to_dict(value),
            {"profile_a": True, "profile_b": True, "123": True},
        )

    def test_187_profile_mapping_to_dict_dict_passthrough(self):
        value = {"profile_a": True, "profile_b": False}
        self.assertEqual(self.order._profile_mapping_to_dict(value), value)

    def test_188_profile_mapping_to_dict_unsupported_type(self):
        with self.assertLogs("test_a2c", level="WARNING") as log_cm:
            self.assertEqual(self.order._profile_mapping_to_dict(42.0), {})
        self.assertIn(
            "WARNING:test_a2c:Unsupported profile mapping type: float",
            log_cm.output,
        )

    def test_189_load_eab_profile_mapping_without_mapping_field(self):
        self.order.config.profile_mapping_field = None
        self.assertEqual(self.order._load_eab_profile_mapping({"kid": {}}, "kid"), {})

    def test_190_load_eab_profile_mapping_uses_param_and_normalizer(self):
        self.order.config.profile_mapping_field = "template"
        with (
            patch.object(
                self.order,
                "_load_eab_profile_param",
                return_value="profile-a",
            ) as mock_load_param,
            patch.object(
                self.order,
                "_profile_mapping_to_dict",
                return_value={"profile-a": True},
            ) as mock_to_dict,
        ):
            result = self.order._load_eab_profile_mapping({"kid": {}}, "kid")

        mock_load_param.assert_called_once_with({"kid": {}}, "kid", "template", None)
        mock_to_dict.assert_called_once_with("profile-a")
        self.assertEqual(result, {"profile-a": True})

    def test_191_apply_eab_profile_mapping_updates_profiles(self):
        self.order.config.profiles = {"old": True}
        with self.assertLogs("test_a2c", level="DEBUG") as log_cm:
            self.order._apply_eab_profile_mapping("acct1", {"new": True})

        self.assertEqual(self.order.config.profiles, {"new": True})
        self.assertIn(
            "DEBUG:test_a2c:Order._apply_eab_profile() - overwrite profile information from eab profile for account acct1",
            log_cm.output,
        )

    def test_192_apply_eab_profile_mapping_noop_for_empty_mapping(self):
        self.order.config.profiles = {"keep": True}
        self.order._apply_eab_profile_mapping("acct1", {})
        self.assertEqual(self.order.config.profiles, {"keep": True})


if __name__ == "__main__":
    unittest.main()
