/*
 * The contents of this file are subject to the terms of the Common Development and
 * Distribution License (the License). You may not use this file except in compliance with the
 * License.
 *
 * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
 * specific language governing permission and limitations under the License.
 *
 * When distributing Covered Software, include this CDDL Header Notice in each file and include
 * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
 * Header, with the fields enclosed by brackets [] replaced by your own identifying
 * information: "Portions copyright [year] [name of copyright owner]".
 *
 * Copyright 2026 3A Systems, LLC.
 */
package org.opends.server.tools;

import static org.opends.server.TestCaseUtils.withoutJceService;
import static org.testng.Assert.*;

import java.io.ByteArrayOutputStream;
import java.io.OutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.Provider;
import java.security.Security;

import javax.crypto.Cipher;

import org.forgerock.i18n.LocalizableMessage;
import org.opends.server.TestCaseUtils;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.Test;

/** Tests the setup-time configuration done by {@link ConfigureDS}. */
@SuppressWarnings("javadoc")
public class ConfigureDSTestCase extends ToolsTestCase
{
  private static final String DEFAULT_KEY_WRAPPING_TRANSFORMATION = "RSA/ECB/OAEPWITHSHA-1ANDMGF1PADDING";

  /** The tool locates the server lock file when it is created, from the server environment. */
  @BeforeClass
  public void startServer() throws Exception
  {
    TestCaseUtils.startServer();
  }

  /** A runtime which has the default transformation keeps it. */
  @Test
  public void testKeyWrappingTransformationStaysTheDefaultWhereTheRuntimeHasIt() throws Exception
  {
    assertEquals(ConfigureDS.supportedKeyWrappingTransformation(DEFAULT_KEY_WRAPPING_TRANSFORMATION),
        DEFAULT_KEY_WRAPPING_TRANSFORMATION);
  }

  /**
   * A runtime without RSA-OAEP under either spelling gets no transformation at all, rather than
   * a weaker one: setup is to say so, and the administrator is to choose.
   */
  @Test
  public void testNoKeyWrappingTransformationIsChosenWhereTheRuntimeHasNoRsaOaep() throws Exception
  {
    withoutJceService("Cipher", "RSA", () ->
    {
      try
      {
        final String chosen = ConfigureDS.supportedKeyWrappingTransformation(DEFAULT_KEY_WRAPPING_TRANSFORMATION);
        fail("a transformation was chosen on a runtime without RSA-OAEP: " + chosen);
      }
      catch (GeneralSecurityException expected)
      {
        assertTrue(expected.getMessage().contains(DEFAULT_KEY_WRAPPING_TRANSFORMATION), expected.getMessage());
      }
      return null;
    });
  }

  /**
   * A runtime whose only RSA cipher is PKCS#1 v1.5, as a SunPKCS11 provider on its own, does not
   * get that transformation as the fallback either (#776). Withdrawing {@code Cipher.RSA} alone
   * cannot show it, since the PKCS#1 v1.5 transformation goes through that service as well.
   */
  @Test
  public void testNoKeyWrappingTransformationIsChosenWhereTheRuntimeHasOnlyPkcs1() throws Exception
  {
    withoutJceService("Cipher", "RSA", () ->
    {
      final Provider pkcs1Only = new Provider("Pkcs1OnlyRsa", "1.0", "RSA with PKCS#1 v1.5 padding only") {};
      pkcs1Only.put("Cipher.RSA/ECB/PKCS1Padding", "com.sun.crypto.provider.RSACipher");
      Security.insertProviderAt(pkcs1Only, 1);
      try
      {
        assertEquals(Cipher.getInstance("RSA/ECB/PKCS1Padding").getProvider().getName(), pkcs1Only.getName(),
            "the fixture offers no PKCS#1 v1.5 transformation");
        try
        {
          final String chosen = ConfigureDS.supportedKeyWrappingTransformation(DEFAULT_KEY_WRAPPING_TRANSFORMATION);
          fail("a transformation was chosen on a runtime whose only RSA cipher is PKCS#1 v1.5: " + chosen);
        }
        catch (GeneralSecurityException expected)
        {
          assertTrue(expected.getMessage().contains(DEFAULT_KEY_WRAPPING_TRANSFORMATION), expected.getMessage());
        }
      }
      finally
      {
        Security.removeProvider(pkcs1Only.getName());
      }
      return null;
    });
  }

  /** Where the runtime has the default transformation, setup has nothing to warn about. */
  @Test
  public void testNoWarningWhereTheRuntimeHasTheDefaultKeyWrappingTransformation() throws Exception
  {
    assertNull(ConfigureDS.unsupportedKeyWrappingTransformationWarning());
    assertEquals(updateCryptoCipher(), "");
  }

  /**
   * Where the runtime has no RSA-OAEP, the warning names the default transformation and the
   * property to set, both the one the installer gives and the one configure-ds writes; and the
   * configuration keeps the default (the configuration handler is not even there to change it).
   */
  @Test
  public void testWarningNamesTheTransformationAndThePropertyWhereTheRuntimeHasNoRsaOaep() throws Exception
  {
    withoutJceService("Cipher", "RSA", () ->
    {
      final LocalizableMessage warning = ConfigureDS.unsupportedKeyWrappingTransformationWarning();
      assertNotNull(warning, "no warning on a runtime without RSA-OAEP");
      assertNamesTransformationAndProperty(warning.toString());

      assertNamesTransformationAndProperty(updateCryptoCipher());
      return null;
    });
  }

  private static void assertNamesTransformationAndProperty(final String warning)
  {
    final String text = warning.replaceAll("\\s+", " ");
    assertTrue(text.startsWith("This Java runtime supports neither the default key wrapping transformation "
        + DEFAULT_KEY_WRAPPING_TRANSFORMATION + " "), text);
    assertTrue(text.contains("the key-wrapping-transformation property"), text);
  }

  /**
   * Runs the key wrapping step of configure-ds on its own, and returns what it wrote to its error
   * stream. The tool has no configuration handler here, so a step which tried to change the
   * configuration would fail.
   */
  private static String updateCryptoCipher() throws Exception
  {
    final ByteArrayOutputStream err = new ByteArrayOutputStream();
    final Constructor<ConfigureDS> constructor =
        ConfigureDS.class.getDeclaredConstructor(String[].class, OutputStream.class, OutputStream.class);
    constructor.setAccessible(true);
    final ConfigureDS tool = constructor.newInstance(new String[0], new ByteArrayOutputStream(), err);
    final Method updateCryptoCipher = ConfigureDS.class.getDeclaredMethod("updateCryptoCipher");
    updateCryptoCipher.setAccessible(true);
    updateCryptoCipher.invoke(tool);
    return new String(err.toByteArray(), StandardCharsets.UTF_8);
  }
}