package sign_test

import (
	"encoding/json"
	"os"
	"path/filepath"
	"testing"

	"github.com/netkingdom/flex-auth/internal/sign"
	"github.com/netkingdom/flex-auth/pkg/api"
)

func TestWriteReplaySignatureFixtures(t *testing.T) {
	if os.Getenv("UPDATE_FIXTURES") != "1" {
		t.Skip("set UPDATE_FIXTURES=1 to regenerate signed replay fixtures")
	}
	dir := filepath.Join("..", "..", "examples", "secrets-engine", "replay")
	data, err := os.ReadFile(filepath.Join(dir, "decision_rotate.json"))
	if err != nil {
		t.Fatal(err)
	}
	var envelope api.DecisionEnvelope
	if err := json.Unmarshal(data, &envelope); err != nil {
		t.Fatal(err)
	}
	_, priv := fixtureKey()
	if err := sign.Sign(&envelope, priv, "testdata-ed25519"); err != nil {
		t.Fatal(err)
	}
	writeJSON(t, filepath.Join(dir, "decision_rotate_signed.json"), envelope)
	envelope.Effect = api.DecisionEffectDeny
	envelope.Reason = "tampered_after_signing"
	writeJSON(t, filepath.Join(dir, "decision_rotate_signed_tampered.json"), envelope)
}

func writeJSON(t *testing.T, path string, value any) {
	t.Helper()
	data, err := json.MarshalIndent(value, "", "  ")
	if err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
		t.Fatal(err)
	}
}