// A hub with a self-signed certificate: plain fetch refuses it, and the

// fetch that trusts the remote's CA file reaches it.

import { test } from "node:test";

import assert from "node:assert/strict";

import { execFileSync } from "node:child_process";

import { mkdtempSync, readFileSync } from "node:fs";

import { createServer } from "node:https";

import { tmpdir } from "node:os";

import { join } from "node:path";

import { fetchTrusting, HubClient } from "../out/hub.mjs";

test("a self-signed hub is reached with its CA file", async () => {

  const dir = mkdtempSync(join(tmpdir(), "hubtls-"));

  const key = join(dir, "key.pem");

  const cert = join(dir, "cert.pem");

  execFileSync("openssl", ["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-keyout", key, "-out", cert, "-days", "1", "-subj", "/CN=127.0.0.1", "-addext", "subjectAltName=IP:127.0.0.1"], { stdio: "ignore" });

  const server = createServer({ key: readFileSync(key), cert: readFileSync(cert) }, (req, res) => {

    let body = "";

    req.on("data", (c) => (body += c));

    req.on("end", () => {

      if (req.url === "/api/v1/user") {

        res.writeHead(200, { "content-type": "application/json" });

        res.end(JSON.stringify({ username: "andy", auth: req.headers.authorization ?? "" }));

      } else if (req.url === "/echo") {

        res.writeHead(201, { "content-type": "application/json" });

        res.end(JSON.stringify({ method: req.method, body }));

      } else {

        res.writeHead(204);

        res.end();

      }

    });

  });

  await new Promise((r) => server.listen(0, "127.0.0.1", r));

  const base = `https://127.0.0.1:${server.address().port}`;

  try {

    await assert.rejects(fetch(`${base}/api/v1/user`), "plain fetch does not trust it");

    const trusting = fetchTrusting(cert);

    const me = await new HubClient(base, "tok", trusting).me();

    assert.equal(me.username, "andy");

    assert.equal(me.auth, "Bearer tok", "headers go through");

    const echo = await trusting(`${base}/echo`, { method: "POST", body: '{"a":1}', headers: { "content-type": "application/json" } });

    assert.equal(echo.status, 201);

    assert.deepEqual(await echo.json(), { method: "POST", body: '{"a":1}' });

    assert.equal((await trusting(`${base}/other`)).status, 204);

    await assert.rejects(fetchTrusting(join(dir, "missing.pem"))(`${base}/api/v1/user`), /cannot read the hub's CA file/);

  } finally {

    server.close();

  }

});