// SPDX-License-Identifier: MPL-2.0

package authwebauthn

import (
	"crypto/ecdh"
	"crypto/rand"
	"errors"
	"testing"

	"gamertan.com/web/internal/webauthnvendored/protocol/webauthncbor"
	"gamertan.com/web/internal/webauthnvendored/protocol/webauthncose"
	wa "gamertan.com/web/internal/webauthnvendored/webauthn"
)

func TestEnforceCredentialAlgorithmUsesVerifiedCOSEKey(t *testing.T) {
	privateKey, err := ecdh.P256().GenerateKey(rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	publicKey := privateKey.PublicKey().Bytes()
	encoded, err := webauthncbor.Marshal(map[int64]any{
		1:  int64(webauthncose.EllipticKey),
		3:  int64(webauthncose.AlgES256),
		-1: int64(webauthncose.P256),
		-2: publicKey[1:33],
		-3: publicKey[33:65],
	})
	if err != nil {
		t.Fatal(err)
	}

	credential := &wa.Credential{
		PublicKey: encoded,
		// This value is absent when a standards-compliant client serializes the
		// mandatory attestation object without optional response conveniences.
		Attestation: wa.CredentialAttestation{PublicKeyAlgorithm: 0},
	}
	if err = enforceCredentialAlgorithm(credential); err != nil {
		t.Fatalf("verified ES256 COSE key rejected when convenience value was absent: %v", err)
	}
}

func TestEnforceCredentialAlgorithmRejectsOtherOrInvalidKeys(t *testing.T) {
	rsaKey, err := webauthncbor.Marshal(map[int64]any{
		1:  int64(webauthncose.RSAKey),
		3:  int64(webauthncose.AlgRS256),
		-1: []byte{0xff},
		-2: []byte{0x01, 0x00, 0x01},
	})
	if err != nil {
		t.Fatal(err)
	}
	for name, credential := range map[string]*wa.Credential{
		"nil":       nil,
		"malformed": {PublicKey: []byte("not-cose")},
		"rsa":       {PublicKey: rsaKey},
	} {
		t.Run(name, func(t *testing.T) {
			if err := enforceCredentialAlgorithm(credential); !errors.Is(err, ErrUnsupportedCredential) {
				t.Fatalf("error=%v", err)
			}
		})
	}
}