package crypto

import (
	"crypto/rand"
	"encoding/base64"
	"testing"
)

func generateTestKey(t *testing.T) (MasterKey, string) {
	t.Helper()
	var raw [32]byte
	if _, err := rand.Read(raw[:]); err != nil {
		t.Fatal(err)
	}
	encoded := base64.StdEncoding.EncodeToString(raw[:])
	key, err := ParseMasterKey(encoded)
	if err != nil {
		t.Fatal(err)
	}
	return key, encoded
}

func TestEncryptDecrypt(t *testing.T) {
	key, _ := generateTestKey(t)
	aad := ComputeAAD("did:plc:alice", "batch-1", "req-1")

	secret := "ghp_supersecretgithubtoken12345"
	encrypted, err := Encrypt(key, secret, aad)
	if err != nil {
		t.Fatalf("encrypt failed: %v", err)
	}

	decrypted, err := Decrypt(key, encrypted, aad)
	if err != nil {
		t.Fatalf("decrypt failed: %v", err)
	}

	if decrypted != secret {
		t.Fatalf("got %q, want %q", decrypted, secret)
	}
}

func TestDecryptRejectsMismatchedAAD(t *testing.T) {
	key, _ := generateTestKey(t)
	aad1 := ComputeAAD("did:plc:alice", "batch-1", "req-1")
	aad2 := ComputeAAD("did:plc:bob", "batch-1", "req-1")

	secret := "ghp_secret"
	encrypted, err := Encrypt(key, secret, aad1)
	if err != nil {
		t.Fatal(err)
	}

	if _, err := Decrypt(key, encrypted, aad2); err == nil {
		t.Fatal("expected decryption failure with mismatched AAD")
	}
}

func TestDecryptRejectsCiphertextSwapBetweenBatches(t *testing.T) {
	key, _ := generateTestKey(t)
	aadBatchA := ComputeAAD("did:plc:alice", "batch-A", "req-1")
	aadBatchB := ComputeAAD("did:plc:alice", "batch-B", "req-2")

	encryptedA, err := Encrypt(key, "tokenA", aadBatchA)
	if err != nil {
		t.Fatal(err)
	}

	if _, err := Decrypt(key, encryptedA, aadBatchB); err == nil {
		t.Fatal("expected decryption failure when ciphertext swapped to different batch AAD")
	}
}

func TestParseMasterKey(t *testing.T) {
	_, err := ParseMasterKey("invalid-base64!!!")
	if err == nil {
		t.Fatal("expected error for invalid base64")
	}

	short := base64.StdEncoding.EncodeToString([]byte("too-short"))
	if _, err := ParseMasterKey(short); err == nil {
		t.Fatal("expected error for non-32-byte key")
	}
}