// Package boxidtest stands in for AWS's instance-identity signer in tests
// outside package boxid: records signed by one test key, and the
// certificates that verify them. The key, certificate and signing are
// boxid/internal/signtest's, which boxid's own tests wrap too.
package boxidtest

import (
	"crypto/x509"
	"encoding/base64"
	"encoding/json"
	"testing"

	"github.com/carlosframework/platform/internal/boxid"
	"github.com/carlosframework/platform/internal/boxid/internal/signtest"
)

// Regions are the AWS regions Certs certifies. Every region a fixture
// signs a record for must be here, or its box never verifies.
var Regions = []string{"ap-southeast-2", "eu-north-1", "eu-west-1", "eu-west-2", "us-east-1"}

// Signer is one test's AWS.
type Signer struct{ s *signtest.Signer }

// NewSigner makes a fresh key and certificate.
func NewSigner(t testing.TB) *Signer {
	t.Helper()
	return &Signer{s: signtest.New(t)}
}

// Record signs an identity document for instance in account and region and
// returns the box's record and its exact bytes.
func (s *Signer) Record(t testing.TB, box, account, region, instance string) (boxid.Record, []byte) {
	t.Helper()
	doc, sig := s.s.Sign(t, account, region, instance)
	rec := boxid.Record{V: 1, Box: box, IdentityDocument: base64.StdEncoding.EncodeToString(doc),
		IdentitySignature: base64.StdEncoding.EncodeToString(sig), WrittenAt: "2026-10-06T00:00:00Z"}
	raw, err := json.Marshal(rec)
	if err != nil {
		t.Fatal(err)
	}
	return rec, raw
}

// Certs certifies every region in Regions with this signer's certificate,
// the shape boxid.Verifier.Certs takes.
func (s *Signer) Certs() map[string]*x509.Certificate {
	out := make(map[string]*x509.Certificate, len(Regions))
	for _, r := range Regions {
		out[r] = s.s.Cert
	}
	return out
}