package tlscert

import (
	"bytes"
	"path/filepath"
	"testing"
	"time"
)

func TestFactoryCertificateRecoversAfterInitialClockSync(t *testing.T) {
	now := time.Unix(100, 0)
	options := Options{Root: t.TempDir(), Clock: func() time.Time { return now }}
	options.ActiveCert = filepath.Join(options.Root, "active", "server.crt")
	options.ActiveKey = filepath.Join(options.Root, "active", "server.key")
	r, err := Open(options)
	if err != nil {
		t.Fatal(err)
	}
	key := append([]byte(nil), r.records[FactoryCertificateID].keyPEM...)
	old, _ := r.Metadata(FactoryCertificateID)
	if _, err = r.Generate("user-cert", Subject{CommonName: "user.example"}); err != nil {
		t.Fatal(err)
	}
	now = time.Date(2026, 9, 9, 0, 0, 0, 0, time.UTC)
	fresh, err := r.Activate(FactoryCertificateID)
	if err != nil {
		t.Fatal(err)
	}
	if fresh.NotBefore.Year() != 2026 || fresh.FingerprintSHA256 == old.FingerprintSHA256 {
		t.Fatal("factory certificate was not reissued")
	}
	if !bytes.Equal(key, r.records[FactoryCertificateID].keyPEM) {
		t.Fatal("factory private key changed")
	}
	again, err := r.Activate(FactoryCertificateID)
	if err != nil || again.FingerprintSHA256 != fresh.FingerprintSHA256 {
		t.Fatal("unnecessary repeat renewal")
	}
	if _, err = r.Activate("user-cert"); err == nil {
		t.Fatal("invalid user certificate accepted")
	}
	reopened, err := Open(options)
	if err != nil {
		t.Fatal(err)
	}
	persisted, err := reopened.Activate(FactoryCertificateID)
	if err != nil || persisted.FingerprintSHA256 != fresh.FingerprintSHA256 {
		t.Fatal("repaired certificate not persisted")
	}
	now = now.AddDate(11, 0, 0)
	if _, err = r.Activate(FactoryCertificateID); err == nil {
		t.Fatal("normally expired factory certificate silently renewed")
	}
}