package cbssl

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"math/big"
	"testing"
	"time"
)

func TestParsePEMCerts(t *testing.T) {
	// Generate a valid self-signed certificate for testing
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Fatalf("failed to generate key: %v", err)
	}

	template := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "testca"},
		NotBefore:             time.Now().Add(-time.Hour),
		NotAfter:              time.Now().Add(time.Hour),
		IsCA:                  true,
		BasicConstraintsValid: true,
	}

	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		t.Fatalf("failed to create certificate: %v", err)
	}

	pemData := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})

	certs, err := ParsePEMCerts(pemData)
	if err != nil {
		t.Fatalf("ParsePEMCerts failed: %v", err)
	}

	if len(certs) != 1 {
		t.Fatalf("expected 1 certificate, got %d", len(certs))
	}

	if certs[0] == nil {
		t.Fatal("expected non-nil certificate")
	}
}

func TestParsePEMCertsInvalid(t *testing.T) {
	// Test invalid PEM data
	pemData := []byte(`not a valid PEM`)

	_, err := ParsePEMCerts(pemData)
	if err == nil {
		t.Fatal("expected error for invalid PEM data")
	}
}

func TestGetUserAgent(t *testing.T) {
	tests := []struct {
		browser   string
		wantStart string
	}{
		{"Chrome", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"},
		{"Firefox", "Mozilla/5.0 (X11; Linux x86_64"},
		{"Unknown", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"},
	}

	for _, tt := range tests {
		t.Run(tt.browser, func(t *testing.T) {
			ua := getUserAgent(tt.browser)
			if len(ua) < 20 {
				t.Errorf("getUserAgent() returned too short string: %s", ua)
			}
		})
	}
}

func TestBrowserTypeString(t *testing.T) {
	if BrowserChrome != "chrome" {
		t.Errorf("expected 'chrome', got %s", BrowserChrome)
	}
	if BrowserFirefox != "firefox" {
		t.Errorf("expected 'firefox', got %s", BrowserFirefox)
	}
	if BrowserAll != "all" {
		t.Errorf("expected 'all', got %s", BrowserAll)
	}
}

func TestCertInfo(t *testing.T) {
	info := CertInfo{
		Subject:   "example.com",
		Issuer:    "CA Root",
		NotBefore: time.Now(),
		NotAfter:  time.Now().Add(24 * time.Hour),
		IsCA:      false,
		PublicKey: "RSA",
		Signature: "SHA256-RSA",
	}

	if info.Subject != "example.com" {
		t.Errorf("expected subject 'example.com', got %s", info.Subject)
	}
	if info.IsCA {
		t.Error("expected IsCA to be false")
	}
}

func TestReadFile(t *testing.T) {
	// Test reading non-existent file
	data := readFile("/nonexistent/file.txt")
	if data != nil {
		t.Error("expected nil for non-existent file")
	}
}

func TestLoadBrowserCARoots(t *testing.T) {
	chrome, firefox, err := LoadBrowserCARoots()
	if err != nil {
		t.Logf("LoadBrowserCARoots failed (expected in some environments): %v", err)
		// This is expected in minimal test environments without CA certificates
		return
	}

	if chrome == nil {
		t.Error("expected non-nil chrome pool")
	}
	if firefox == nil {
		t.Error("expected non-nil firefox pool")
	}
}