package credssp

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"math/big"
	"testing"
	"time"
)

func TestSubjectPublicKeyDiffersFromPKIX(t *testing.T) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Fatal(err)
	}
	certDER, err := x509.CreateCertificate(rand.Reader, &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject:      pkix.Name{CommonName: "rdp-test"},
		NotBefore:    time.Now().Add(-time.Hour),
		NotAfter:     time.Now().Add(time.Hour),
	}, &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject:      pkix.Name{CommonName: "rdp-test"},
		NotBefore:    time.Now().Add(-time.Hour),
		NotAfter:     time.Now().Add(time.Hour),
	}, &key.PublicKey, key)
	if err != nil {
		t.Fatal(err)
	}
	cert, err := x509.ParseCertificate(certDER)
	if err != nil {
		t.Fatal(err)
	}
	subjectKey, err := subjectPublicKey(cert)
	if err != nil {
		t.Fatal(err)
	}
	pkixKey, err := x509.MarshalPKIXPublicKey(cert.PublicKey)
	if err != nil {
		t.Fatal(err)
	}
	if string(subjectKey) == string(pkixKey) {
		t.Fatal("SubjectPublicKey 不应等于完整 SPKI")
	}
	rsaDER, err := asn1.Marshal(*cert.PublicKey.(*rsa.PublicKey))
	if err != nil {
		t.Fatal(err)
	}
	if string(subjectKey) != string(rsaDER) {
		t.Fatalf("SubjectPublicKey 应与 RSA PKCS#1 DER 一致，len=%d/%d", len(subjectKey), len(rsaDER))
	}
}