package auth

import (
	"testing"

	"switchboard-core/store"
)

func TestParseDN(t *testing.T) {
	tests := []struct {
		name   string
		dn     string
		expect map[string]string
	}{
		{
			name: "standard cert DN",
			dn:   "CN=Jeff Smith,O=Acme Corp,OU=Engineering",
			expect: map[string]string{
				"CN": "Jeff Smith",
				"O":  "Acme Corp",
				"OU": "Engineering",
			},
		},
		{
			name: "with email",
			dn:   "CN=Jane Doe,emailAddress=jane@acme.com,O=Acme Corp",
			expect: map[string]string{
				"CN":           "Jane Doe",
				"emailAddress": "jane@acme.com",
				"O":            "Acme Corp",
			},
		},
		{
			name: "spaces around equals",
			dn:   "CN = Test User , O = Test Org",
			expect: map[string]string{
				"CN": "Test User",
				"O":  "Test Org",
			},
		},
		{
			name: "single field",
			dn:   "CN=Solo",
			expect: map[string]string{
				"CN": "Solo",
			},
		},
		{
			name:   "empty string",
			dn:     "",
			expect: map[string]string{},
		},
		{
			name: "no equals sign",
			dn:   "garbage,data",
			expect: map[string]string{},
		},
		{
			name: "country and state",
			dn:   "CN=Server,C=US,ST=Maryland,L=Laurel,O=DoD",
			expect: map[string]string{
				"CN": "Server",
				"C":  "US",
				"ST": "Maryland",
				"L":  "Laurel",
				"O":  "DoD",
			},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			result := ParseDN(tt.dn)
			for k, want := range tt.expect {
				got := result[k]
				if got != want {
					t.Errorf("ParseDN(%q)[%q] = %q, want %q", tt.dn, k, got, want)
				}
			}
			if len(result) != len(tt.expect) {
				t.Errorf("ParseDN(%q) returned %d fields, want %d", tt.dn, len(result), len(tt.expect))
			}
		})
	}
}

func TestMTLSConfig_Defaults(t *testing.T) {
	p := NewMTLSProvider(MTLSConfig{})

	if p.cfg.HeaderDN != "X-SSL-Client-DN" {
		t.Errorf("HeaderDN = %q, want X-SSL-Client-DN", p.cfg.HeaderDN)
	}
	if p.cfg.HeaderVerify != "X-SSL-Client-Verify" {
		t.Errorf("HeaderVerify = %q, want X-SSL-Client-Verify", p.cfg.HeaderVerify)
	}
	if p.cfg.HeaderFingerprint != "X-SSL-Client-Fingerprint" {
		t.Errorf("HeaderFingerprint = %q, want X-SSL-Client-Fingerprint", p.cfg.HeaderFingerprint)
	}
	if p.cfg.DefaultRole != "user" {
		t.Errorf("DefaultRole = %q, want user", p.cfg.DefaultRole)
	}
}

func TestMTLSConfig_Custom(t *testing.T) {
	p := NewMTLSProvider(MTLSConfig{
		HeaderDN:     "X-Client-Cert-DN",
		HeaderVerify: "X-Client-Cert-Verify",
		DefaultRole:  "admin",
	})

	if p.cfg.HeaderDN != "X-Client-Cert-DN" {
		t.Errorf("HeaderDN = %q, want X-Client-Cert-DN", p.cfg.HeaderDN)
	}
	if p.cfg.DefaultRole != "admin" {
		t.Errorf("DefaultRole = %q, want admin", p.cfg.DefaultRole)
	}
}

func TestMTLSProvider_Mode(t *testing.T) {
	p := NewMTLSProvider(MTLSConfig{})
	if p.Mode() != ModeMTLS {
		t.Errorf("Mode() = %q, want %q", p.Mode(), ModeMTLS)
	}
}

func TestMTLSProvider_NoRegistration(t *testing.T) {
	p := NewMTLSProvider(MTLSConfig{})
	if p.SupportsRegistration() {
		t.Error("mTLS should not support registration")
	}
	_, err := p.Register(nil, store.Stores{})
	if err != ErrNotSupported {
		t.Errorf("Register() = %v, want ErrNotSupported", err)
	}
}