package credentiallease

import (
	"bytes"
	"encoding/base64"
	"errors"
	"os"
	"path/filepath"
	"runtime"
	"testing"
)

func TestLoadPrivateKeyFile(t *testing.T) {
	want := bytes.Repeat([]byte{0x5a}, 32)
	path := filepath.Join(t.TempDir(), "recipient.key")
	if err := os.WriteFile(path, []byte(base64.StdEncoding.EncodeToString(want)), 0o600); err != nil {
		t.Fatal(err)
	}
	secureTestKeyFile(t, path)

	got, err := LoadPrivateKeyFile(path, len(want))
	if err != nil {
		t.Fatalf("LoadPrivateKeyFile() error = %v", err)
	}
	if !bytes.Equal(got, want) {
		t.Fatal("LoadPrivateKeyFile() returned unexpected key material")
	}
}

func TestLoadPrivateKeyFileRejectsInsecureUnixMode(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("Windows private-key access is validated from the file DACL")
	}
	path := filepath.Join(t.TempDir(), "recipient.key")
	encoded := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x5a}, 32))
	if err := os.WriteFile(path, []byte(encoded), 0o644); err != nil {
		t.Fatal(err)
	}

	_, err := LoadPrivateKeyFile(path, 32)
	if !errors.Is(err, ErrKey) {
		t.Fatalf("LoadPrivateKeyFile() error = %v, want ErrKey", err)
	}
}