package db

import "testing"

// R2-B1:SSH 隧道改写 Host 后,TLS ServerName 必须保留原 Host(隧道内 TLS 校验依赖)。
func TestRewriteHostForTunnelPreservesServerName(t *testing.T) {
	c := ConnReq{Host: "db.internal", Port: 3306, SSHEnabled: true}
	out := rewriteHostForTunnel(c, 45678)
	if out.Host != "127.0.0.1" || out.Port != 45678 {
		t.Fatalf("隧道地址改写错误: %s:%d", out.Host, out.Port)
	}
	if out.SSHEnabled {
		t.Fatal("SSHEnabled 应置 false,防嵌套隧道")
	}
	if out.TLSServerName != "db.internal" {
		t.Fatalf("TLSServerName 应保留原 Host, got %q", out.TLSServerName)
	}
}

// 用户显式指定 tlsServerName 时,隧道改写不得覆盖。
func TestRewriteHostForTunnelKeepsExplicitServerName(t *testing.T) {
	c := ConnReq{Host: "db.internal", TLSServerName: "db.example.com", SSHEnabled: true}
	out := rewriteHostForTunnel(c, 40001)
	if out.TLSServerName != "db.example.com" {
		t.Fatalf("显式 TLSServerName 应保留, got %q", out.TLSServerName)
	}
}

func TestTLSServerNameFor(t *testing.T) {
	if got := tlsServerNameFor(ConnReq{Host: "db.example"}); got != "db.example" {
		t.Fatalf("空 tlsserverName 应用 Host, got %q", got)
	}
	if got := tlsServerNameFor(ConnReq{Host: "127.0.0.1", TLSServerName: "db.example"}); got != "db.example" {
		t.Fatalf("显式 tlsserverName 优先, got %q", got)
	}
}