package auth

import (
	"os"
	"path/filepath"
	"testing"
)

func TestAddLookupRevoke(t *testing.T) {
	dir := t.TempDir()
	keys := filepath.Join(dir, "keys.toml")
	out := filepath.Join(dir, "k")
	if err := Add(keys, "talos", "hermes-fleet", out); err != nil {
		t.Fatal(err)
	}
	st, err := os.Stat(out)
	if err != nil {
		t.Fatal(err)
	}
	if st.Mode().Perm()&0o077 != 0 {
		t.Fatalf("perms %v", st.Mode())
	}
	b, _ := os.ReadFile(out)
	key := string(b)
	if key[len(key)-1] == '\n' {
		key = key[:len(key)-1]
	}
	s, err := Load(keys)
	if err != nil {
		t.Fatal(err)
	}
	if s.LookupBearer(key) == nil || s.LookupBearer(key).Name != "talos" {
		t.Fatal("lookup failed")
	}
	if s.LookupBearer("nope") != nil {
		t.Fatal("unknown accepted")
	}
	if err := Add(keys, "x", "y", out); err == nil {
		t.Fatal("overwrite allowed")
	}
	cs, err := List(keys)
	if err != nil || len(cs) != 1 || cs[0].Name != "talos" {
		t.Fatalf("%v %v", cs, err)
	}
	if err := Revoke(keys, "talos"); err != nil {
		t.Fatal(err)
	}
	s, _ = Load(keys)
	if s.LookupBearer(key) != nil {
		t.Fatal("revoked still valid")
	}
}

func TestAddPreservesKeysMode(t *testing.T) {
	dir := t.TempDir()
	keys := filepath.Join(dir, "keys.toml")
	if err := os.WriteFile(keys, []byte(""), 0o600); err != nil {
		t.Fatal(err)
	}
	out := filepath.Join(dir, "k")
	if err := Add(keys, "talos", "hermes-fleet", out); err != nil {
		t.Fatal(err)
	}
	st, err := os.Stat(keys)
	if err != nil {
		t.Fatal(err)
	}
	if st.Mode().Perm() != 0o600 {
		t.Fatalf("mode %o", st.Mode().Perm())
	}
}