package manifest

import (
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"testing"
)

func validManifest() Manifest {
	var m Manifest
	m.SchemaVersion = 1
	m.PluginID = "qiu.subscription-admin"
	m.Name = "Subscription Admin"
	m.Version = "0.1.0"
	m.CoreAPIBaseline = "sub2api-0.1.183"
	m.Capabilities = []string{"subscription.admin.v1"}
	m.TestedCoreVersions = []string{"0.1.183"}
	m.Backend.HealthPath = "/healthz"
	m.Backend.ReadinessPath = "/readyz"
	m.Backend.ListenEnv = "PLUGIN_PORT"
	m.UI.Entrypoint = "ui/index.html"
	m.UI.Menu.ID = m.PluginID
	m.UI.Menu.Label = "订阅管理"
	m.UI.Menu.Visibility = "admin"
	m.UI.Menu.SortOrder = 200
	m.Publisher.KeyID = "test-key"
	m.CoreAPIAllowlist = RequiredAllowlist()
	return m
}

func TestValidateManifest(t *testing.T) {
	if err := Validate(validManifest()); err != nil {
		t.Fatal(err)
	}
	m := validManifest()
	m.CoreAPIAllowlist = append(m.CoreAPIAllowlist, "GET /api/v1/admin/users")
	if err := Validate(m); err == nil {
		t.Fatal("expected exact allowlist validation failure")
	}
}

func TestVerifySignature(t *testing.T) {
	publicKey, privateKey, err := ed25519.GenerateKey(nil)
	if err != nil {
		t.Fatal(err)
	}
	manifestBytes := []byte(`{"schema_version":1}`)
	signature := Signature{Algorithm: "ed25519", KeyID: "test-key", Signature: base64.StdEncoding.EncodeToString(ed25519.Sign(privateKey, manifestBytes))}
	signatureBytes, err := json.Marshal(signature)
	if err != nil {
		t.Fatal(err)
	}
	publicKeyBytes := []byte(base64.StdEncoding.EncodeToString(publicKey))
	if err := VerifySignature(manifestBytes, signatureBytes, publicKeyBytes); err != nil {
		t.Fatal(err)
	}
	manifestBytes[0] = '{'
	if err := VerifySignature([]byte(`{"schema_version":2}`), signatureBytes, publicKeyBytes); err == nil {
		t.Fatal("expected tamper failure")
	}
}