// SPDX-FileCopyrightText: 2026 Echolot contributors
// SPDX-License-Identifier: GPL-3.0-or-later

package control

import (
	"encoding/base64"
	"encoding/json"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestHTTPEchoReflectsRequest(t *testing.T) {
	s := &Server{}
	req := httptest.NewRequest("POST", "/v1/echo", strings.NewReader("payload-bytes"))
	req.Header.Set("X-Injected", "canary")
	rr := httptest.NewRecorder()
	s.httpEcho(rr, req)

	var resp struct {
		RequestHeadB64 string `json:"request_head_b64"`
		BodyB64        string `json:"body_b64"`
		BodyLen        int    `json:"body_len"`
		Scheme         string `json:"scheme"`
	}
	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
		t.Fatal(err)
	}
	head, _ := base64.StdEncoding.DecodeString(resp.RequestHeadB64)
	if !strings.Contains(string(head), "X-Injected: canary") {
		t.Fatalf("echo did not reflect the injected header:\n%s", head)
	}
	body, _ := base64.StdEncoding.DecodeString(resp.BodyB64)
	if string(body) != "payload-bytes" || resp.BodyLen != 13 {
		t.Fatalf("body mismatch: %q len=%d", body, resp.BodyLen)
	}
	if resp.Scheme != "http" { // httptest requests carry no TLS
		t.Fatalf("scheme = %s, want http", resp.Scheme)
	}
}

func TestTLSReferenceReturnsChain(t *testing.T) {
	s := &Server{PinB64: "TESTPIN", CertChain: [][]byte{{0x30, 0x82, 0x01}, {0xAA, 0xBB}}}
	rr := httptest.NewRecorder()
	s.tlsReference(rr, httptest.NewRequest("GET", "/v1/tls-reference", nil))

	var resp struct {
		PinSHA256 string   `json:"pin_sha256"`
		ChainDER  []string `json:"chain_der"`
	}
	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
		t.Fatal(err)
	}
	if resp.PinSHA256 != "TESTPIN" || len(resp.ChainDER) != 2 {
		t.Fatalf("bad tls-reference: %+v", resp)
	}
	first, _ := base64.StdEncoding.DecodeString(resp.ChainDER[0])
	if len(first) != 3 || first[0] != 0x30 {
		t.Fatalf("leaf DER not round-tripped: %x", first)
	}
}