package openssl_test

import (
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"math/big"
	"os"
	"path"
	"strings"
	"testing"
	"time"

	"git.cacert.org/cacert-gosigner/x509/openssl"
	"git.cacert.org/cacert-gosigner/x509/revoking"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestStoreRevocation(t *testing.T) {
	tempdir := t.TempDir()

	fr, err := openssl.NewFileRepository(tempdir)
	require.NoError(t, err)

	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
	if err != nil {
		t.Errorf("could not create random serial: %v", err)
	}

	notAfter := time.Now().UTC().Add(24 * time.Hour).UTC()

	err = fr.StoreRevocation(&pkix.RevokedCertificate{
		SerialNumber:   serial,
		RevocationTime: notAfter,
		Extensions:     []pkix.Extension{revoking.CRLReasonKeyCompromise.BuildExtension()},
	})

	assert.ErrorIs(t, err, openssl.CannotRevokeUnknown{Serial: serial})

	err = os.WriteFile(path.Join(tempdir, "index.txt"), []byte(
		strings.Join(
			[]string{
				"V",
				notAfter.Format(openssl.TimeSpec),
				"",
				strings.ToUpper(serial.Text(16)),
				"unknown",
				pkix.Name{CommonName: "test.example.org"}.String(),
			},
			"\t",
		)+"\n",
	), 0o600)
	assert.NoError(t, err)

	err = fr.StoreRevocation(&pkix.RevokedCertificate{
		SerialNumber:   serial,
		RevocationTime: time.Now(),
		Extensions:     []pkix.Extension{revoking.CRLReasonKeyCompromise.BuildExtension()},
	})
	assert.NoError(t, err)

	assert.FileExists(t, path.Join(tempdir, "index.txt"))
}

func TestStoreCertificate(t *testing.T) {
	tempdir := t.TempDir()

	fr, err := openssl.NewFileRepository(tempdir)
	require.NoError(t, err)

	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
	if err != nil {
		t.Errorf("could not create random serial: %v", err)
	}

	err = fr.StoreCertificate(&x509.Certificate{
		SerialNumber: serial,
		Issuer: pkix.Name{
			CommonName: "Test CA",
		},
		Subject: pkix.Name{
			CommonName: "test.example.org",
		},
		NotBefore:   time.Now().Add(-1 * time.Hour).UTC(),
		NotAfter:    time.Now().Add(24 * time.Hour).UTC(),
		KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement,
		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		DNSNames:    []string{"test.example.org"},
	})
	assert.NoError(t, err)

	assert.FileExists(t, path.Join(tempdir, "index.txt"))
}