use std::path::PathBuf;

#[cfg(windows)]
use proxywarden_lib::process::AuthenticodePublisher;
use proxywarden_lib::process::{verify_authenticode, AuthenticodeError};

#[cfg(windows)]
#[test]
fn bundled_windows_packet_filter_has_expected_trusted_publisher() {
    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
        .join("bundled/components/windows-packet-filter/Windows.Packet.Filter.3.6.2.1.x64.msi");

    let verification = verify_authenticode(path).expect("bundled MSI should be verifiable");

    assert!(verification.is_trusted);
    assert_eq!(
        verification.publisher,
        Some(AuthenticodePublisher {
            common_name: "The Anti-Cloud Corporation".to_owned(),
            organization: "The Anti-Cloud Corporation".to_owned(),
        })
    );
    assert_eq!(verification.status_code, 0);
}

#[cfg(windows)]
#[test]
fn unsigned_regular_file_is_not_trusted() {
    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("Cargo.toml");

    let verification = verify_authenticode(path).expect("regular file should be inspectable");

    assert!(!verification.is_trusted);
    assert_eq!(verification.publisher, None);
    assert_ne!(verification.status_code, 0);
}

#[cfg(windows)]
#[test]
fn reparse_target_is_rejected_when_symlink_creation_is_available() {
    use std::{fs, os::windows::fs::symlink_file};

    let root = std::env::temp_dir().join(format!(
        "proxywarden-authenticode-test-{}",
        uuid::Uuid::new_v4().simple()
    ));
    fs::create_dir(&root).expect("test root should be creatable");
    let link = root.join("linked-target.exe");
    let target = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("Cargo.toml");
    if let Err(error) = symlink_file(target, &link) {
        fs::remove_dir(&root).expect("test root should be removable");
        if error.raw_os_error() == Some(1314) {
            eprintln!("skipping reparse probe because this process lacks symlink privilege");
            return;
        }
        panic!("test symlink creation failed: {error}");
    }

    let result = verify_authenticode(&link);
    fs::remove_file(&link).expect("test symlink should be removable");
    fs::remove_dir(&root).expect("test root should be removable");

    assert_eq!(result, Err(AuthenticodeError::UnsafeTarget));
}

#[test]
fn missing_target_fails_closed() {
    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("missing-signature-target.exe");

    #[cfg(windows)]
    assert_eq!(
        verify_authenticode(path),
        Err(AuthenticodeError::InvalidTarget)
    );

    #[cfg(not(windows))]
    assert_eq!(
        verify_authenticode(path),
        Err(AuthenticodeError::UnsupportedPlatform)
    );
}