package mail

import (
	"encoding/base64"
	"testing"
)

// The derivation is structurally pinned: AWS's algorithm prefixes a
// one-byte version (0x04) to a 32-byte HMAC-SHA256, so every password
// decodes to exactly 33 bytes starting 0x04. A change that breaks either
// invariant produces credentials SES rejects at auth time — hours later,
// in someone else's deployment.
func TestSMTPPasswordShape(t *testing.T) {
	// wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY is AWS's own published
	// documentation example secret access key, not a credential — the
	// golden output below is pinned to this exact value.
	got := SMTPPassword("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "eu-west-1")
	raw, err := base64.StdEncoding.DecodeString(got)
	if err != nil {
		t.Fatalf("password is not base64: %v", err)
	}
	if len(raw) != 33 {
		t.Fatalf("decoded length = %d, want 33", len(raw))
	}
	if raw[0] != 0x04 {
		t.Fatalf("version byte = %#x, want 0x04", raw[0])
	}
}

// Region is part of the signing chain, so the same secret yields a
// DIFFERENT password per region. This is why §8's multi-region delivery
// must derive per region rather than reuse one string.
func TestSMTPPasswordIsRegionScoped(t *testing.T) {
	secret := "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
	if SMTPPassword(secret, "eu-west-1") == SMTPPassword(secret, "us-east-1") {
		t.Fatal("password did not change with region")
	}
}

func TestSMTPPasswordIsDeterministic(t *testing.T) {
	secret := "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
	if SMTPPassword(secret, "eu-west-1") != SMTPPassword(secret, "eu-west-1") {
		t.Fatal("derivation is not deterministic")
	}
}

// A golden value produced by AWS's own reference implementation, not by
// this package. The property tests above cannot tell a correct chain from
// a wrong-but-well-formed one (transpose region and service and every
// property still holds), so this is the only test here with an independent
// oracle. Regenerate it from the SES Developer Guide, never from our code.
func TestSMTPPasswordGolden(t *testing.T) {
	const want = "BMW5RDrXmmVs0lV7GpI4oLkHXpZ4stDsk6q91z1g38Pk"
	got := SMTPPassword("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "eu-west-1")
	if got != want {
		t.Fatalf("SMTPPassword = %q, want %q", got, want)
	}
}