//go:build linux

package provisioner

import (
	"bytes"
	"testing"
)

func TestAgeCredentialCustody(t *testing.T) {
	floor, key := floorFixture(t)
	password := []byte("synthetic-test-passphrase")
	wrapped, e := wrapCredential(key, floor.identity, password)
	if e != nil {
		t.Fatal(e)
	}
	if bytes.Contains(wrapped, password) || bytes.Contains(wrapped, []byte(floor.identity.Registry)) {
		t.Fatal("plaintext credential in envelope")
	}
	if e = floor.dir.create("credential.age", wrapped); e != nil {
		t.Fatal(e)
	}
	stored, e := floor.dir.read("credential.age", 128<<10)
	if e != nil {
		t.Fatal(e)
	}
	id, opened, e := unwrapCredential(stored, password)
	if e != nil || id != floor.identity || !bytes.Equal(opened.SignPub(), key.SignPub()) || !bytes.Equal(opened.BoxPub(), key.BoxPub()) {
		t.Fatal("credential round trip", e)
	}
	if _, _, e = unwrapCredential(stored, []byte("wrong")); e != ErrRefused {
		t.Fatal("wrong passphrase", e)
	}
	stored[len(stored)-1] ^= 1
	if _, _, e = unwrapCredential(stored, password); e != ErrRefused {
		t.Fatal("tampered credential", e)
	}
}