package main

import (
	"os"
	"testing"
)

func TestLoadOrCreateHubCert_GeneratesAndPersists(t *testing.T) {
	testExeDir = t.TempDir()
	defer func() { testExeDir = "" }()

	cert, fp, generated, err := loadOrCreateHubCert()
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if !generated {
		t.Fatal("expected a fresh cert to be reported as generated")
	}
	if len(fp) != 64 {
		t.Fatalf("fingerprint should be a 64-char hex SHA-256, got %d chars: %q", len(fp), fp)
	}
	if cert.Leaf == nil {
		t.Fatal("expected cert.Leaf to be populated")
	}
	if _, err := os.Stat(hubCertPath()); err != nil {
		t.Fatalf("cert file wasn't persisted: %v", err)
	}
	if _, err := os.Stat(hubKeyPath()); err != nil {
		t.Fatalf("key file wasn't persisted: %v", err)
	}
}

func TestLoadOrCreateHubCert_ReusesSameFingerprint(t *testing.T) {
	testExeDir = t.TempDir()
	defer func() { testExeDir = "" }()

	_, fp1, gen1, err := loadOrCreateHubCert()
	if err != nil || !gen1 {
		t.Fatalf("first call should generate: gen=%v err=%v", gen1, err)
	}
	_, fp2, gen2, err := loadOrCreateHubCert()
	if err != nil {
		t.Fatalf("unexpected error on reload: %v", err)
	}
	if gen2 {
		t.Fatal("second call should reuse the persisted cert, not generate a new one")
	}
	if fp1 != fp2 {
		t.Fatalf("fingerprint changed across reload: %q vs %q", fp1, fp2)
	}
}

func TestLoadOrCreateHubCert_DifferentInstallationsDiffer(t *testing.T) {
	testExeDir = t.TempDir()
	_, fpA, _, err := loadOrCreateHubCert()
	if err != nil {
		t.Fatal(err)
	}

	testExeDir = t.TempDir()
	_, fpB, _, err := loadOrCreateHubCert()
	testExeDir = ""
	if err != nil {
		t.Fatal(err)
	}

	if fpA == fpB {
		t.Fatal("two installations generated the same certificate fingerprint")
	}
}

func TestLoadOrCreateHubCert_PartialPairFails(t *testing.T) {
	testExeDir = t.TempDir()
	defer func() { testExeDir = "" }()

	if err := writePEM(hubCertPath(), "CERTIFICATE", []byte("not a real cert")); err != nil {
		t.Fatal(err)
	}
	// key file intentionally left missing

	if _, _, _, err := loadOrCreateHubCert(); err == nil {
		t.Fatal("expected an error for a partial/broken cert+key pair")
	}
}