package dsse

import (
	"crypto/ed25519"
	"crypto/rand"
	"encoding/base64"
	"errors"
	"testing"
)

func TestVerify_HappyPath(t *testing.T) {
	pub, priv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		t.Fatalf("generate: %v", err)
	}
	env := Sign("application/vnd.in-toto+json", []byte(`{"_type":"x"}`), "k1", priv)
	payload, kid, err := Verify(env, Keyring{"k1": pub})
	if err != nil {
		t.Fatalf("verify: %v", err)
	}
	if kid != "k1" {
		t.Fatalf("keyid: want k1, got %q", kid)
	}
	if string(payload) != `{"_type":"x"}` {
		t.Fatalf("payload: want %q, got %q", `{"_type":"x"}`, payload)
	}
}

func TestVerify_UnknownKey(t *testing.T) {
	_, priv, _ := ed25519.GenerateKey(rand.Reader)
	otherPub, _, _ := ed25519.GenerateKey(rand.Reader)
	env := Sign("application/vnd.in-toto+json", []byte("x"), "k1", priv)
	_, _, err := Verify(env, Keyring{"k2": otherPub})
	if !errors.Is(err, ErrUnknownKey) {
		t.Fatalf("want ErrUnknownKey, got %v", err)
	}
}

func TestVerify_InvalidSignature(t *testing.T) {
	pub, priv, _ := ed25519.GenerateKey(rand.Reader)
	env := Sign("application/vnd.in-toto+json", []byte("x"), "k1", priv)
	// Flip one bit of the signature.
	raw, _ := base64.RawURLEncoding.DecodeString(env.Signatures[0].Sig)
	raw[0] ^= 0xff
	env.Signatures[0].Sig = base64.RawURLEncoding.EncodeToString(raw)
	_, _, err := Verify(env, Keyring{"k1": pub})
	if !errors.Is(err, ErrSignatureInvalid) {
		t.Fatalf("want ErrSignatureInvalid, got %v", err)
	}
}

func TestVerify_EmptySignatures(t *testing.T) {
	env := Envelope{PayloadType: "application/vnd.in-toto+json", Payload: ""}
	_, _, err := Verify(env, Keyring{})
	if !errors.Is(err, ErrNoSignatures) {
		t.Fatalf("want ErrNoSignatures, got %v", err)
	}
}