import { assertEquals } from "jsr:@std/assert";
import { Extension, X509CertificateGenerator } from "npm:@peculiar/x509";
import { extractSpiffeIdFromCert, fetchSpiffeIdentity } from "./spire_ffi.ts";

Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
  const result = await fetchSpiffeIdentity();
  assertEquals(result.spiffe_id, "spiffe://local.dev/mock");
});

Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null/invalid cases", () => {
  assertEquals(extractSpiffeIdFromCert(""), null);
  assertEquals(extractSpiffeIdFromCert(null as any), null);
  assertEquals(extractSpiffeIdFromCert("invalid-cert-string"), null);
});

Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert valid SPIFFE certificate", async () => {
  const keys = await crypto.subtle.generateKey(
    { name: "ECDSA", namedCurve: "P-256" },
    true,
    ["sign", "verify"],
  );

  const spiffeUri = "spiffe://system.local/workload/api";
  const uriBytes = new TextEncoder().encode(spiffeUri);

  const extValue = new Uint8Array([
    0x30,
    uriBytes.length + 2,
    0x86,
    uriBytes.length,
    ...uriBytes,
  ]).buffer;

  const cert = await X509CertificateGenerator.createSelfSigned({
    serialNumber: "01",
    name: "CN=Test Workload",
    notBefore: new Date(),
    notAfter: new Date(Date.now() + 3600000),
    keys,
    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
    extensions: [
      new Extension("2.5.29.17", false, extValue),
    ],
  });

  const pem = cert.toString("pem");
  const extracted = extractSpiffeIdFromCert(pem);
  assertEquals(extracted, spiffeUri);
});