package certs

import (
	"bytes"
	"encoding/pem"
	"os"
	"path/filepath"
	"testing"
)

func TestLocalCAStablePrivateAndIndependent(t *testing.T) {
	dir := t.TempDir()
	a, err := LoadOrCreateLocalCA(dir)
	if err != nil {
		t.Fatal(err)
	}
	b, err := LoadOrCreateLocalCA(dir)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(a.CACertPEM(), b.CACertPEM()) {
		t.Fatal("CA rotated on restart")
	}
	c, err := LoadOrCreateLocalCA(t.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	if bytes.Equal(a.CACertPEM(), c.CACertPEM()) {
		t.Fatal("installations share a CA")
	}
	if bytes.Equal(a.CACertPEM(), EmbeddedCACertPEM()) {
		t.Fatal("legacy CA reused")
	}
	leaf, err := a.CertificateForServerName("api2.cursor.sh")
	if err != nil {
		t.Fatal(err)
	}
	if err := leaf.Leaf.CheckSignatureFrom(a.caCert); err != nil {
		t.Fatal(err)
	}
	if err := leaf.Leaf.VerifyHostname("api2.cursor.sh"); err != nil {
		t.Fatal(err)
	}
	if err := leaf.Leaf.VerifyHostname("unrelated.example"); err == nil {
		t.Fatal("hostname mismatch accepted")
	}
	bundle, err := os.ReadFile(filepath.Join(dir, "local-ca.pem"))
	if err != nil {
		t.Fatal(err)
	}
	_, key := pem.Decode(bundle)
	if _, err = NewManagerFromPEM(c.CACertPEM(), key); err == nil {
		t.Fatal("mismatched key accepted")
	}
}

func TestCorruptCADoesNotRotateOrOverwrite(t *testing.T) {
	dir := t.TempDir()
	bad := []byte("broken private authority")
	if err := os.WriteFile(filepath.Join(dir, "local-ca.pem"), bad, 0600); err != nil {
		t.Fatal(err)
	}
	if _, err := LoadOrCreateLocalCA(dir); err == nil {
		t.Fatal("corrupt CA accepted")
	}
	after, _ := os.ReadFile(filepath.Join(dir, "local-ca.pem"))
	if !bytes.Equal(bad, after) {
		t.Fatal("corrupt CA silently replaced")
	}
}