package config

import "testing"

var testFingerprintKey = []byte("0123456789abcdef0123456789abcdef")

func TestFingerprintIsStableAndTracksSecretRotation(t *testing.T) {
	first := storeTestConfig("provider-a")
	upstream := first.Upstreams["provider-a"]
	upstream.ProxyAuth.Password = "secret-a"
	first.Upstreams["provider-a"] = upstream

	stable, err := Fingerprint(first, testFingerprintKey)
	if err != nil {
		t.Fatalf("Fingerprint(first): %v", err)
	}
	again, err := Fingerprint(first, testFingerprintKey)
	if err != nil || again != stable {
		t.Fatalf("Fingerprint(stable) = %q, %v; want %q", again, err, stable)
	}

	rotated := storeTestConfig("provider-a")
	upstream = rotated.Upstreams["provider-a"]
	upstream.ProxyAuth.Password = "secret-b"
	rotated.Upstreams["provider-a"] = upstream
	changed, err := Fingerprint(rotated, testFingerprintKey)
	if err != nil {
		t.Fatalf("Fingerprint(rotated): %v", err)
	}
	if changed == stable {
		t.Fatal("Fingerprint did not change after secret rotation")
	}
	if len(changed) != 64 {
		t.Fatalf("Fingerprint length = %d, want 64", len(changed))
	}
}

func TestFingerprintChangesWithIndependentKey(t *testing.T) {
	configuration := storeTestConfig("provider-a")
	first, err := Fingerprint(configuration, testFingerprintKey)
	if err != nil {
		t.Fatalf("Fingerprint(first key): %v", err)
	}
	second, err := Fingerprint(configuration, []byte("fedcba9876543210fedcba9876543210"))
	if err != nil {
		t.Fatalf("Fingerprint(second key): %v", err)
	}
	if first == second {
		t.Fatal("Fingerprint did not change with independent key")
	}
}

func TestFingerprintRejectsInvalidInputs(t *testing.T) {
	for name, test := range map[string]struct {
		configuration *Config
		key           []byte
	}{
		"nil configuration": {key: testFingerprintKey},
		"missing key":       {configuration: storeTestConfig("provider-a")},
		"short key":         {configuration: storeTestConfig("provider-a"), key: []byte("too-short")},
	} {
		t.Run(name, func(t *testing.T) {
			if _, err := Fingerprint(test.configuration, test.key); err == nil {
				t.Fatal("Fingerprint() succeeded")
			}
		})
	}
}