import assert from "node:assert/strict"
import {
  certificateRole,
  isCaCertificate,
  mapRosCertificateRow,
  type RosCertificateRow,
} from "./certificate-parse.js"

// Реальные серты пользователя: MyCA (root) → vpn-server, client1, anakondra.
const myCa: RosCertificateRow = {
  name: "MyCA",
  "common-name": "MyCA",
  "key-usage": "key-cert-sign,crl-sign",
  ca: "",
  flags: "KAT",
  authority: "true",
}
const vpnServer: RosCertificateRow = {
  name: "vpn-server",
  "common-name": "vpn.example.com",
  "key-usage": "digital-signature,key-encipherment,key-cert-sign,crl-sign,tls-server,tls-client",
  ca: "MyCA",
  flags: "KLAT",
}
const client1: RosCertificateRow = {
  name: "client1",
  "common-name": "client1",
  "key-usage": "digital-signature,key-encipherment,key-cert-sign,crl-sign,tls-server,tls-client",
  ca: "MyCA",
  flags: "KLAT",
}
const anakondra: RosCertificateRow = { ...client1, name: "anakondra", "common-name": "anakondra" }

{
  assert.ok(isCaCertificate(myCa))
  // default key-usage содержит key-cert-sign, но ca заполнен → не CA
  assert.ok(!isCaCertificate(vpnServer))
  assert.ok(!isCaCertificate(client1))
}

{
  const ctx = {
    peerCertNames: ["vpn-server"],
    identityCertNames: ["client1", "anakondra"],
  }
  assert.equal(certificateRole(myCa, ctx), "ca")
  assert.equal(certificateRole(vpnServer, ctx), "server")
  // reference-based важнее key-usage: у client1 в key-usage есть tls-server, но он client
  assert.equal(certificateRole(client1, ctx), "client")
  assert.equal(certificateRole(anakondra, ctx), "client")
  // без reference-контекста: подпись локальным CA делает серт клиентским, несмотря на tls-server в usage
  assert.equal(certificateRole(client1), "client")
  assert.equal(certificateRole(anakondra), "client")
  // без контекста — по key-usage (default содержит оба, поэтому server)
  assert.equal(certificateRole({ name: "x", "key-usage": "tls-client" }), "client")
  assert.equal(certificateRole({ name: "y", "key-usage": "digital-signature" }), "other")
}

{
  const dto = mapRosCertificateRow(1, "mt", client1)
  assert.equal(dto?.signedByCertName, "MyCA")
  assert.equal(mapRosCertificateRow(1, "mt", myCa)?.signedByCertName, undefined)
}

console.log("certificate-parse.test.ts: ok")