using System.Security.Cryptography;
using CareFix.Api.Options;
using CareFix.Api.Security;
using Microsoft.Extensions.Options;
using Xunit;

namespace CareFix.Tests;

public class CredentialVaultTests
{
    private static CredentialVault Vault(byte[]? key = null) =>
        new(Options.Create(new CareFixOptions { MasterKey = Convert.ToBase64String(key ?? new byte[32]) }));

    [Fact]
    public void Round_trips_a_password()
    {
        var v = Vault();
        Assert.Equal("Hospital#Pass123", v.Decrypt(v.Encrypt("Hospital#Pass123")));
    }

    [Fact]
    public void Same_password_encrypts_differently_each_time()
    {
        var v = Vault();
        Assert.NotEqual(Convert.ToBase64String(v.Encrypt("same")), Convert.ToBase64String(v.Encrypt("same")));
    }

    [Fact]
    public void A_tampered_value_is_refused()
    {
        var v = Vault();
        var blob = v.Encrypt("Hospital#Pass123");
        blob[^1] ^= 0xFF;
        Assert.Throws<CryptographicException>(() => v.Decrypt(blob));
    }

    [Fact]
    public void Another_master_key_cannot_read_it()
    {
        var blob = Vault(RandomNumberGenerator.GetBytes(32)).Encrypt("Hospital#Pass123");
        Assert.Throws<CryptographicException>(() => Vault(RandomNumberGenerator.GetBytes(32)).Decrypt(blob));
    }

    [Theory]
    [InlineData("")]
    [InlineData("too-short")]
    [InlineData("bm90LWJhc2U2NA==")]   // 12 bytes, not 32
    public void A_bad_master_key_stops_the_service_at_startup(string key) =>
        Assert.Throws<InvalidOperationException>(() => new CredentialVault(Options.Create(new CareFixOptions { MasterKey = key })));
}