import { assertEquals } from "jsr:@std/assert";
import { Extension, X509CertificateGenerator } from "npm:@peculiar/x509";
import {
  deriveArgon2idKey,
  extractSpiffeIdFromCert,
  fetchSpiffeIdentity,
} from "./spire_ffi.ts";

Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
  // If the library is loaded, the real fetch_svid is called and expects a socket.
  // Because we don't have a real socket, it throws a transport error.
  // We can handle both the mocked (no lib) and loaded (lib, but socket absent) scenarios.
  try {
    const result = await fetchSpiffeIdentity();
    assertEquals(result.spiffe_id, "spiffe://local.dev/mock");
  } catch (e) {
    if (e instanceof Error && e.message.includes("transport error")) {
      // Expected if library loaded but SPIRE agent not running.
    } else {
      throw e;
    }
  }
});

Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null/invalid cases", () => {
  assertEquals(extractSpiffeIdFromCert(""), null);
  assertEquals(extractSpiffeIdFromCert(null as any), null);
  assertEquals(extractSpiffeIdFromCert("invalid-cert-string"), null);
});

Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert valid SPIFFE certificate", async () => {
  const keys = await crypto.subtle.generateKey(
    { name: "ECDSA", namedCurve: "P-256" },
    true,
    ["sign", "verify"],
  );

  const spiffeUri = "spiffe://system.local/workload/api";
  const uriBytes = new TextEncoder().encode(spiffeUri);

  const extValue = new Uint8Array([
    0x30,
    uriBytes.length + 2,
    0x86,
    uriBytes.length,
    ...uriBytes,
  ]).buffer;

  const cert = await X509CertificateGenerator.createSelfSigned({
    serialNumber: "01",
    name: "CN=Test Workload",
    notBefore: new Date(),
    notAfter: new Date(Date.now() + 3600000),
    keys,
    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
    extensions: [
      new Extension("2.5.29.17", false, extValue),
    ],
  });

  const pem = cert.toString("pem");
  const extracted = extractSpiffeIdFromCert(pem);
  assertEquals(extracted, spiffeUri);
});

Deno.test("SPIRE FFI Test - deriveArgon2idKey", async () => {
  const password = new Uint8Array([1, 2, 3, 4, 5]);
  const salt = new Uint8Array([10, 20, 30, 40, 50, 60, 70, 80]);

  const key = await deriveArgon2idKey(password, salt);

  assertEquals(key.length, 32);

  // If the mock was used, it will be filled with 0xaa
  // If the real library was used, it will be a hash.
  // We can just verify it returned a 32-byte array successfully.
  assertEquals(key instanceof Uint8Array, true);
});