import { describe, expect, it } from "vitest";
import {
  checkCertificateHostname,
  inspectCryptoInput,
  parsePemBlocks,
} from "../../src/crypto/inspection";

describe("crypto input inspection", () => {
  it("parses bounded PEM blocks and detects encrypted key material", () => {
    const pem =
      "-----BEGIN ENCRYPTED PRIVATE KEY-----\nAQID\n-----END ENCRYPTED PRIVATE KEY-----";
    expect(parsePemBlocks(pem)).toMatchObject([
      { label: "ENCRYPTED PRIVATE KEY", encrypted: true },
    ]);
    expect(parsePemBlocks(pem)[0]?.bytes).toEqual(Uint8Array.of(1, 2, 3));
  });

  it("computes the RFC 7638 thumbprint without serialising private values", async () => {
    const inspection = await inspectCryptoInput(
      JSON.stringify({
        kty: "RSA",
        n: "AQAB",
        e: "AQAB",
        d: "do-not-display",
        kid: "test",
      }),
    );
    expect(inspection.items[0]?.facts["RFC 7638 SHA-256 thumbprint"]).toMatch(
      /^[A-Za-z0-9_-]{43}$/u,
    );
    expect(JSON.stringify(inspection)).not.toContain("do-not-display");
    expect(inspection.items[0]?.findings[0]?.severity).toBe("warning");
  });

  it("does not use a legacy common-name hostname fallback", () => {
    expect(
      checkCertificateHostname(
        {
          id: "x",
          type: "X.509 certificate",
          title: "x",
          facts: {},
          findings: [],
          dnsNames: [],
        },
        "example.com",
      ),
    ).toEqual({ valid: false, message: "Select a certificate." });
  });

  it("rejects unrelated JSON", async () => {
    await expect(inspectCryptoInput('{"hello":"world"}')).rejects.toThrow(
      /JWK or a JWKS/u,
    );
    await expect(inspectCryptoInput("null")).rejects.toThrow(/PEM or JWK/u);
  });

  it("rejects wildcards and invalid labels as hostname inputs", () => {
    const item = {
      id: "x",
      type: "X.509 certificate",
      title: "x",
      facts: {},
      findings: [],
      certificate: {} as never,
      dnsNames: ["*.example.com"],
    };
    expect(checkCertificateHostname(item, "*.example.com").valid).toBe(false);
    expect(checkCertificateHostname(item, "bad_label.example.com").valid).toBe(
      false,
    );
  });
});