//! `spectra connect` (spec §8.6): a workstation trusts a server once the

//! owner confirms its instance key and delegates to it, and that key

//! vouches for its certificate; it claims a server set up with `init

//! --owner`, even though delegating changed the owner's KeyId; a new

//! certificate is refused until connect runs again; someone else's server

//! is refused.

mod common;

use common::{hermetic, run, text, Serving};

use spectra_core::keys::KeyPair;

use spectra_mcp::client::{Client, Endpoint};

use spectra_mcp::tls::Pinned;

use std::path::Path;

/// A server in `s` set up for the owner whose home is `owner_home`.

fn server_for(s: &Path, owner_home: &Path) -> (Serving, u16) {

    let owner = KeyPair::load_home(owner_home).unwrap();

    let o = run(s, &["init", "--owner", &owner.key.to_hex(), "--name", "earth"]);

    assert!(o.status.success(), "{}", text(&o));

    Serving::start_tls(s)

}

async fn instance_owner(port: u16) -> serde_json::Value {

    let p = Pinned::new(None);

    let c = Client::at(Endpoint::Tls { addr: format!("127.0.0.1:{port}"), config: p.client_config().unwrap() }, None);

    c.send("GET", "/api/v1/instance", &[], vec![]).await.unwrap().json().unwrap()["owner"].clone()

}

#[tokio::test]

async fn the_owner_connects_delegates_and_claims() {

    let (sd, cd) = (tempfile::tempdir().unwrap(), tempfile::tempdir().unwrap());

    let (s, c) = (sd.path(), cd.path());

    KeyPair::create_home(&c.join("owner"), "Andy McCall", "").unwrap();

    let (srv, port) = server_for(s, &c.join("owner"));

    let url = format!("https://127.0.0.1:{port}");

    // First contact, not at a terminal and not confirmed: nothing trusted.

    let o = run(c, &["connect", &url]);

    assert!(!o.status.success(), "{}", text(&o));

    assert!(text(&o).contains("--yes"), "{}", text(&o));

    assert!(!c.join("owner/client.toml").exists(), "nothing trusted yet");

    // A key that does not match what `init` printed is refused.

    let o = run(c, &["connect", &url, "--expect", "00ff"]);

    assert!(!o.status.success() && text(&o).contains("does not start with"), "{}", text(&o));

    // The owner checks the instance key against what `init` printed (here,

    // by --expect) and connects: their identity now delegates to it, under

    // a new KeyId ...

    let instance = KeyPair::instance(&s.join("data"), "earth").unwrap();

    let before = KeyPair::load_home(&c.join("owner")).unwrap();

    // ... and the server is trusted, pinned, and claimed as theirs.

    let o = run(c, &["connect", &url, "--expect", &instance.key.short(16)]);

    assert!(o.status.success(), "{}", text(&o));

    assert!(text(&o).contains("Claimed"), "{}", text(&o));

    let current = KeyPair::load_home(&c.join("owner")).unwrap();

    assert_ne!(current.key, before.key);

    assert!(current.identity.delegates_to(&instance.key, 1));

    let cfg = std::fs::read_to_string(c.join("owner/client.toml")).unwrap();

    assert!(cfg.contains(&instance.key.to_hex()) && cfg.contains("tls_spki"), "{cfg}");

    assert_eq!(instance_owner(port).await, current.key.to_hex(), "recorded at the owner's current identity");

    // Again: nothing to claim, still trusted.

    let o = run(c, &["connect", &url]);

    assert!(o.status.success(), "{}", text(&o));

    assert!(text(&o).contains("Connected"), "{}", text(&o));

    srv.stop();

    // A new certificate (the old one lost) is refused on the old pin ...

    std::fs::remove_file(s.join("data/keys/tls.crt")).unwrap();

    std::fs::remove_file(s.join("data/keys/tls.key")).unwrap();

    let (srv, port) = Serving::start_tls(s);

    let url = format!("https://127.0.0.1:{port}");

    let cfg = std::fs::read_to_string(c.join("owner/client.toml")).unwrap();

    let old_pin: [u8; 32] =

        hex::decode(cfg.lines().find(|l| l.starts_with("tls_spki")).unwrap().split('"').nth(1).unwrap()).unwrap().try_into().unwrap();

    let pinned = Client::at(Endpoint::tls(&url, old_pin).unwrap(), None);

    assert!(pinned.send("GET", "/api/v1/instance", &[], vec![]).await.is_err());

    // ... until connect checks that the same instance key vouches for it.

    let o = run(c, &["connect", &url]);

    assert!(o.status.success(), "{}", text(&o));

    let cfg2 = std::fs::read_to_string(c.join("owner/client.toml")).unwrap();

    assert_ne!(cfg, cfg2, "re-pinned");

    srv.stop();

    let o = hermetic(s).args(["admin", "verify"]).output().unwrap();

    assert!(o.status.success(), "{}", text(&o));

}

#[test]

fn someone_elses_server_is_refused() {

    let (sd, cd, md) = (tempfile::tempdir().unwrap(), tempfile::tempdir().unwrap(), tempfile::tempdir().unwrap());

    let (s, c, m) = (sd.path(), cd.path(), md.path());

    KeyPair::create_home(&c.join("owner"), "Andy McCall", "").unwrap();

    KeyPair::create_home(&m.join("owner"), "Mallory", "").unwrap();

    let (srv, port) = server_for(s, &m.join("owner"));

    let o = run(c, &["connect", &format!("https://127.0.0.1:{port}")]);

    assert!(!o.status.success());

    assert!(text(&o).contains("was set up for"), "{}", text(&o));

    srv.stop();

}