use std::path::PathBuf;

use zagan_bet::server::setup::init_identity;

#[test]
fn creates_a_usable_pkcs12_identity_and_refuses_to_overwrite() {
    let dir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("server-setup");
    let _ = std::fs::remove_dir_all(&dir);
    std::fs::create_dir_all(&dir).unwrap();

    init_identity(&dir, "localhost").expect("openssl must be available for this test");

    for name in ["identity.p12", "key.pem", "cert.pem"] {
        let path = dir.join(name);
        assert!(path.exists(), "{name} was not created");
        assert!(
            std::fs::metadata(&path).unwrap().len() > 0,
            "{name} is empty"
        );
    }

    let p12 = std::fs::read(dir.join("identity.p12")).unwrap();
    native_tls::Identity::from_pkcs12(&p12, "").expect("generated identity must load");

    let second = init_identity(&dir, "localhost");
    assert!(second.is_err(), "setup must not overwrite existing keys");

    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        let mode = std::fs::metadata(dir.join("key.pem"))
            .unwrap()
            .permissions()
            .mode()
            & 0o777;
        assert_eq!(mode, 0o600, "private key should not be world-readable");
    }
}