import XCTest
@testable import TXCore

final class SSHWireTests: XCTestCase {
    func testStringEncoding() {
        XCTAssertEqual(SSHWire.string([0xAA, 0xBB]), [0, 0, 0, 2, 0xAA, 0xBB])
        XCTAssertEqual(SSHWire.string(""), [0, 0, 0, 0])
        XCTAssertEqual(SSHWire.string("nistp256"), [0, 0, 0, 8] + Array("nistp256".utf8))
    }

    func testMpint() {
        // 普通正数（高位为 0）：原样。
        XCTAssertEqual(SSHWire.mpint([0x01, 0x02]), [0, 0, 0, 2, 0x01, 0x02])
        // 高位为 1：前补 0x00（否则被当负数）。
        XCTAssertEqual(SSHWire.mpint([0xFF]), [0, 0, 0, 2, 0x00, 0xFF])
        // 前导零去除。
        XCTAssertEqual(SSHWire.mpint([0x00, 0x00, 0x05]), [0, 0, 0, 1, 0x05])
        // 值为 0 → 空串。
        XCTAssertEqual(SSHWire.mpint([0x00, 0x00]), [0, 0, 0, 0])
    }

    func testDerToSSHSignatureHighBit() {
        // 构造 DER SEQUENCE{ INTEGER r(高位1，含前导00), INTEGER s(高位0) }。
        let r = [UInt8(0x00), 0xFF] + [UInt8](repeating: 0x11, count: 31)   // 33B DER 内容
        let s = [UInt8(0x01)] + [UInt8](repeating: 0x22, count: 31)         // 32B DER 内容
        var der: [UInt8] = [0x30, UInt8(2 + r.count + 2 + s.count)]
        der += [0x02, UInt8(r.count)] + r
        der += [0x02, UInt8(s.count)] + s

        let sig = ECDSAConv.derToSSHSignature(der)
        XCTAssertNotNil(sig)
        // 应等于独立计算的 mpint(r)+mpint(s)。
        let expected = SSHWire.mpint(r) + SSHWire.mpint(s)
        XCTAssertEqual(sig, expected)
        // r 高位为 1 → mpint 33 字节，长度前缀 0x21。
        XCTAssertEqual(Array(sig!.prefix(4)), [0, 0, 0, 0x21])
    }

    func testP256Blob() {
        let q = [UInt8(0x04)] + [UInt8](repeating: 0xAB, count: 64)   // X9.63 65B
        let blob = ECDSAConv.p256PublicKeyBlob(x963: q)
        // 开头必须是 string("ecdsa-sha2-nistp256")。
        XCTAssertEqual(Array(blob.prefix(4)), [0, 0, 0, 0x13])
        XCTAssertEqual(Array(blob[4 ..< 4 + 19]), Array("ecdsa-sha2-nistp256".utf8))
    }

    /// 真实向量：192.168.9.199 的 ecdsa host key，指纹须与 `ssh-keygen -lf` 一致。
    func testOpenSSHFingerprintRealVector() {
        let b64 = "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCkvFPRkGE8RGQ+scBa3JZMWnZnGUn7BWfsz8rfEtKjIojjqxxJLdZvQE9rUlaNNUFi8eGb9lfr5rO4yFS0dnsU="
        let blob = Data(base64Encoded: b64)!
        XCTAssertEqual(HostKey.opensshFingerprint(blob), "SHA256:dcpjdomtDzOZJuv/NHr1vYtm0mP5EbsEML0kClhgqxg")
    }

    func testEvaluate() {
        let a = Data([1, 2, 3]); let b = Data([1, 2, 3]); let c = Data([9])
        XCTAssertEqual(HostKey.evaluate(stored: nil, presented: a), .firstUse)
        XCTAssertEqual(HostKey.evaluate(stored: b, presented: a), .trusted)
        XCTAssertEqual(HostKey.evaluate(stored: c, presented: a), .mismatch(stored: c))
    }
}