package db

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"math/big"
	"os"
	"path/filepath"
	"testing"
	"time"
)

func TestEffectiveSSLMode(t *testing.T) {
	if got := EffectiveSSLMode(ConnReq{}); got != "disable" {
		t.Fatalf("empty -> disable, got %s", got)
	}
	if got := EffectiveSSLMode(ConnReq{SSL: true}); got != "require" {
		t.Fatalf("ssl true -> require, got %s", got)
	}
	if got := EffectiveSSLMode(ConnReq{SSL: true, SSLMode: "skip-verify"}); got != "skip-verify" {
		t.Fatalf("mode wins, got %s", got)
	}
	if got := EffectiveSSLMode(ConnReq{SSL: true, SSLMode: "disable"}); got != "disable" {
		t.Fatalf("explicit disable, got %s", got)
	}
	if !SSLEnabled(ConnReq{SSLMode: "require"}) {
		t.Fatal("require should enable")
	}
}

func TestTLSConfigFromDisable(t *testing.T) {
	cfg, err := tlsConfigFrom(ConnReq{})
	if err != nil || cfg != nil {
		t.Fatalf("disable => nil,nil got %#v %v", cfg, err)
	}
}

func TestTLSConfigFromSkipVerify(t *testing.T) {
	cfg, err := tlsConfigFrom(ConnReq{SSL: true, SSLMode: "skip-verify", Host: "db.example"})
	if err != nil {
		t.Fatal(err)
	}
	if cfg == nil || !cfg.InsecureSkipVerify {
		t.Fatalf("expected InsecureSkipVerify, got %#v", cfg)
	}
	if cfg.ServerName != "db.example" {
		t.Fatalf("ServerName %q", cfg.ServerName)
	}
}

func TestTLSConfigFromVerifyCARequiresPath(t *testing.T) {
	_, err := tlsConfigFrom(ConnReq{SSLMode: "verify-ca"})
	if err == nil {
		t.Fatal("expected error without CA")
	}
}

func TestTLSConfigFromVerifyCAWithPEM(t *testing.T) {
	dir := t.TempDir()
	caPath := filepath.Join(dir, "ca.pem")
	if err := writeTestCA(caPath); err != nil {
		t.Fatal(err)
	}
	cfg, err := tlsConfigFrom(ConnReq{SSLMode: "verify-ca", SSLCA: caPath, Host: "127.0.0.1"})
	if err != nil {
		t.Fatal(err)
	}
	if cfg == nil || cfg.RootCAs == nil {
		t.Fatal("expected RootCAs")
	}
	if cfg.VerifyPeerCertificate == nil {
		t.Fatal("expected custom verify for verify-ca")
	}
}

func TestTLSConfigFromBadCAPath(t *testing.T) {
	_, err := tlsConfigFrom(ConnReq{SSLMode: "require", SSLCA: "/no/such/ca.pem"})
	if err == nil {
		t.Fatal("expected read error")
	}
}

func writeTestCA(path string) error {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return err
	}
	tmpl := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "opsxdb-test-ca"},
		NotBefore:             time.Now().Add(-time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return err
	}
	f, err := os.Create(path)
	if err != nil {
		return err
	}
	defer f.Close()
	return pem.Encode(f, &pem.Block{Type: "CERTIFICATE", Bytes: der})
}