/*
 * Copyright 2025 Signal Messenger, LLC
 * SPDX-License-Identifier: AGPL-3.0-only
 */

package org.whispersystems.textsecuregcm.metrics;

import static org.junit.jupiter.api.Assertions.assertEquals;

import java.security.KeyStore;
import java.time.Instant;
import java.util.Map;
import org.eclipse.jetty.util.resource.Resource;
import org.eclipse.jetty.util.security.CertificateUtils;
import org.junit.jupiter.api.Test;
import org.whispersystems.textsecuregcm.util.jetty.TestResource;

class TlsCertificateExpirationUtilTest {

  // Please note that this certificate is used only for testing and is not used anywhere outside of this test.
  // It was generated with:
  //
  // ```shell
  // #!/bin/bash
  //
  // export PASSWORD=test123
  //
  // openssl req -newkey rsa:2048 -keyout test-root.key -nodes -x509 -days 36500 -out test-root.crt \
  //     -subj "/CN=test-root" \
  //     -addext "basicConstraints=critical,CA:TRUE"
  //
  // openssl req -new -newkey rsa:2048 -keyout test-rsa.key -out test-rsa.csr -passout env:PASSWORD \
  //     -subj "/CN=localhost" \
  //     -addext "subjectAltName = DNS:localhost"
  //
  // openssl req -new -newkey ED25519 -keyout test-ed25519.key -out test-ed25519.csr -passout env:PASSWORD \
  //     -subj "/CN=localhost" \
  //     -addext "subjectAltName = DNS:localhost"
  //
  // openssl x509 -req  -CAkey test-root.key -CA test-root.crt -days 36500  -copy_extensions copyall \
  //     -in test-rsa.csr \
  //     -out test-rsa.crt
  //
  // # create unique timestamps
  // sleep 3
  //
  // openssl x509 -req  -CAkey test-root.key -CA test-root.crt -days 36500  -copy_extensions copyall \
  //     -in test-ed25519.csr \
  //     -out test-ed25519.crt
  //
  // cat test-root.crt >> test-rsa.crt
  //
  // openssl pkcs12 -export -in test-ed25519.crt -inkey test-ed25519.key -name 'ed25519' -out keystore.p12 \
  //     -passin env:PASSWORD -passout env:PASSWORD
  //
  // openssl pkcs12 -export -in test-rsa.crt -inkey test-rsa.key -name 'rsa' -out keystore-rsa.p12 \
  //     -passin env:PASSWORD -passout env:PASSWORD
  //
  // keytool -importkeystore -noprompt \
  //     -srckeystore keystore-rsa.p12 \
  //     -srcstoretype PKCS12 \
  //     -srcstorepass $PASSWORD \
  //     -destkeystore keystore.p12 \
  //     -deststoretype PKCS12 \
  //     -deststorepass $PASSWORD
  //
  // base64 -b 80 -i keystore.p12
  // ```
  private static final String KEYSTORE_BASE64 = """
[encoded data, 6351 characters]
      N6VjWLZbEYq1VlM8QpdcaaoCAggA
      """;
  private static final String KEYSTORE_PASSWORD = "test123";

  private static final Instant EDDSA_EXPIRATION = Instant.ofEpochSecond(4897215163L);
  private static final Instant RSA_EXPIRATION = Instant.ofEpochSecond(4897215160L);

  @Test
  void test() throws Exception {
    try (Resource keystore = TestResource.fromBase64Mime("keystore", KEYSTORE_BASE64)) {

      final KeyStore keyStore = CertificateUtils.getKeyStore(keystore, "PKCS12", null, KEYSTORE_PASSWORD);

      final Map<String, Instant> expected = Map.of(
          "localhost:EdDSA", EDDSA_EXPIRATION,
          "localhost:RSA", RSA_EXPIRATION);
      assertEquals(expected, TlsCertificateExpirationUtil.getIdentifiersAndExpirations(keyStore, KEYSTORE_PASSWORD));
    }
  }

}
