package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"testing"
	"time"
)

// mkCA returns a self-signed CA cert + key and a pool trusting it.
func mkCA(t *testing.T) (*x509.Certificate, *ecdsa.PrivateKey, *x509.CertPool) {
	t.Helper()
	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	tmpl := &x509.Certificate{
		SerialNumber: bigOne(), Subject: pkixCN("fleet CA"),
		IsCA: true, BasicConstraintsValid: true,
		NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(24 * time.Hour),
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		t.Fatalf("create CA: %v", err)
	}
	ca, _ := x509.ParseCertificate(der)
	pool := x509.NewCertPool()
	pool.AddCert(ca)
	return ca, key, pool
}

// mkLeaf issues a client leaf DER signed by (caCert, caKey), valid over [nb, na].
func mkLeaf(t *testing.T, caCert *x509.Certificate, caKey *ecdsa.PrivateKey, nb, na time.Time) []byte {
	t.Helper()
	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	tmpl := &x509.Certificate{
		SerialNumber: bigN(0x1234), Subject: pkixCN("fleet-host"),
		NotBefore: nb, NotAfter: na,
		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, caCert, &key.PublicKey, caKey)
	if err != nil {
		t.Fatalf("create leaf: %v", err)
	}
	return der
}

func TestClassifyNVCert(t *testing.T) {
	now := time.Now()
	ca, caKey, pool := mkCA(t)
	valid := mkLeaf(t, ca, caKey, now.Add(-time.Hour), now.Add(time.Hour))
	expired := mkLeaf(t, ca, caKey, now.Add(-2*time.Hour), now.Add(-time.Hour))

	// a leaf from a DIFFERENT CA (foreign / not our fleet)
	otherCA, otherKey, _ := mkCA(t)
	foreign := mkLeaf(t, otherCA, otherKey, now.Add(-time.Hour), now.Add(time.Hour))

	cases := []struct {
		name     string
		der      []byte
		pool     *x509.CertPool
		enrolled bool
	}{
		{"valid fleet cert chains to CA", valid, pool, true},
		{"garbage bytes are not a cert", []byte("not a certificate at all"), pool, false},
		{"expired cert triggers re-enrol", expired, pool, false},
		{"foreign cert does not chain", foreign, pool, false},
		{"no CA pool: parseable+unexpired accepted", valid, nil, true},
		{"no CA pool: expired still rejected", expired, nil, false},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			got, detail := classifyNVCert(c.der, c.pool, now)
			if got != c.enrolled {
				t.Fatalf("enrolled=%v want %v (detail: %s)", got, c.enrolled, detail)
			}
		})
	}
}