package appconfig

import (
	"bytes"
	"crypto/ecdh"
	"encoding/base64"
	"regexp"
	"testing"
)

// A box computes the fingerprint from its PRIVATE key's public half; the
// console computes it from CARLOS_SECRETS_PUBKEY. They must agree byte for
// byte (nearest-region spec §6.1, R9).
func TestKeyFingerprintAgreesAcrossHalves(t *testing.T) {
	priv, err := ecdh.P256().NewPrivateKey(bytes.Repeat([]byte{1}, 32))
	if err != nil {
		t.Fatal(err)
	}
	fromPriv := KeyFingerprint(priv.PublicKey())
	fromPub, err := PublicFingerprint(base64.StdEncoding.EncodeToString(priv.PublicKey().Bytes()))
	if err != nil {
		t.Fatal(err)
	}
	if fromPriv != fromPub {
		t.Fatalf("private half %q != public half %q", fromPriv, fromPub)
	}
	if !regexp.MustCompile(`^sha256:[0-9a-f]{64}$`).MatchString(fromPriv) {
		t.Fatalf("format = %q", fromPriv)
	}
	other, _ := ecdh.P256().NewPrivateKey(bytes.Repeat([]byte{2}, 32))
	if KeyFingerprint(other.PublicKey()) == fromPriv {
		t.Fatal("two keys share a fingerprint")
	}
	if _, err := PublicFingerprint("not base64!"); err == nil {
		t.Fatal("garbage parsed")
	}
}