package main

import (
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestValidateRecoveryGateFailsClosed(t *testing.T) {
	valid := recoveryGate{
		FormatVersion: 1, Product: "tera-core-x48-pro", HardwareProfile: "fet3568j-c", Authorized: true,
		TargetEvidenceID: "target-gate-20260724", RecoveryFITSHA256: strings.Repeat("a", 64), UBootSHA256: strings.Repeat("b", 64),
	}
	path := filepath.Join(t.TempDir(), "gate.json")
	writeGate(t, path, valid)
	if err := validateRecoveryGate(path, valid.Product, valid.HardwareProfile); err != nil {
		t.Fatal(err)
	}
	for name, mutate := range map[string]func(*recoveryGate){
		"unauthorized":     func(value *recoveryGate) { value.Authorized = false },
		"wrong-profile":    func(value *recoveryGate) { value.HardwareProfile = "other" },
		"missing-evidence": func(value *recoveryGate) { value.TargetEvidenceID = "" },
		"bad-fit-hash":     func(value *recoveryGate) { value.RecoveryFITSHA256 = "bad" },
	} {
		t.Run(name, func(t *testing.T) {
			candidate := valid
			mutate(&candidate)
			candidatePath := filepath.Join(t.TempDir(), "gate.json")
			writeGate(t, candidatePath, candidate)
			if err := validateRecoveryGate(candidatePath, valid.Product, valid.HardwareProfile); err == nil {
				t.Fatal("invalid recovery gate was accepted")
			}
		})
	}
}

func writeGate(t *testing.T, path string, value recoveryGate) {
	t.Helper()
	data, err := json.Marshal(value)
	if err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(path, data, 0o600); err != nil {
		t.Fatal(err)
	}
}