#!/usr/bin/env bash

# MIT License
# Copyright (c) 2026 Sławomir Koszewski
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

# This script runs integration tests against one or more simple-ca implementations.
# Usage: run-tests.sh [bash|python|go|all]   (default: all)
set -e

TEST_TARGET="${1:-all}"

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CERT_DIR="$SCRIPT_DIR/tests"
CA_DIR="$CERT_DIR/ca"

clean_up_test_dir() {
    if [[ -d "$CERT_DIR" ]]; then
        echo "Cleaning up test directory $CERT_DIR..."
        rm -rf "$CERT_DIR"/*
    fi
    echo "Creating test directory $CERT_DIR and ca subdirectory..."
    mkdir -p "$CA_DIR"
}

display_certificate() {
    local CERT_PATH="$1"

    echo -e "\nDisplaying generated certificate for verification ($CERT_PATH):"
    openssl x509 -in "$CERT_PATH" -noout -subject -issuer -serial -fingerprint
    echo

    echo -e "\nVerifying certificate against the CA bundle ($CA_DIR/ca_bundle.pem)..."
    if openssl verify -CAfile "$CA_DIR/ca_bundle.pem" "$CERT_PATH" 2>/dev/null; then
        echo "Certificate verification successful."
    else
        echo "ERROR: Certificate verification failed." >&2
        exit 1
    fi
}

# run_flow NAME MAKE_CA_CMD MAKE_CERT_CMD MAKE_PFX_CMD
# Command variables are left unquoted on use, so multi-word prefixes
# (e.g. "python3 simple-ca.py make-ca") word-split as expected.
run_flow() {
    local NAME="$1"
    local MAKE_CA_CMD="$2"
    local MAKE_CERT_CMD="$3"
    local MAKE_PFX_CMD="$4"

    echo
    echo "============================================================"
    echo "Running tests for '$NAME' implementation"
    echo "============================================================"

    echo
    echo "--- [$NAME] Standalone CA ---"
    clean_up_test_dir
    $MAKE_CA_CMD "$CA_DIR" "Test CA"
    display_certificate "$CA_DIR/ca_cert.pem"
    $MAKE_CERT_CMD --ca-dir "$CA_DIR" "$CERT_DIR" "test" "test.example.com" "127.0.0.1"
    display_certificate "$CERT_DIR/test_cert.pem"

    echo
    echo "--- [$NAME] Two-level CA ---"
    clean_up_test_dir
    $MAKE_CA_CMD "$CA_DIR" "Test Two Level CA"
    display_certificate "$CA_DIR/ca_cert.pem"
    $MAKE_CA_CMD --issuing-ca "issuing_ca" "$CA_DIR" "Issuing CA"
    display_certificate "$CA_DIR/issuing_ca_cert.pem"
    $MAKE_CERT_CMD --ca-dir "$CA_DIR" --issuing-ca "issuing_ca" "$CERT_DIR" "test" "test.example.com" "127.0.0.1"
    display_certificate "$CERT_DIR/test_cert.pem"
    $MAKE_PFX_CMD --ca-dir "$CA_DIR" --issuing-ca "issuing_ca" --path "$CERT_DIR/test_cert.pem" --password "s3cr3t"

    echo -e "\nVerifying contents of generated PKCS#12 (PFX) file ($CERT_DIR/test.pfx):"
    openssl pkcs12 -in "$CERT_DIR/test.pfx" -noout -info -password pass:"s3cr3t"
}

# Uses ;;& to fall through to subsequent patterns so 'all' matches every block.
case "$TEST_TARGET" in
    bash|all)
        # shellcheck disable=SC1091
        source "$SCRIPT_DIR/simple-ca.sh"
        run_flow "bash" "make_ca" "make_cert" "make_pfx"
        ;;&
    python|all)
        command -v python3 >/dev/null || { echo "ERROR: python3 not found" >&2; exit 1; }
        PY_PREFIX="python3 $SCRIPT_DIR/simple-ca.py"
        run_flow "python" "$PY_PREFIX make-ca" "$PY_PREFIX make-cert" "$PY_PREFIX make-pfx"
        ;;&
    go|all)
        command -v go >/dev/null || { echo "ERROR: go not found" >&2; exit 1; }
        GO_SRC="$SCRIPT_DIR/src/simple-ca"
        GO_BIN="$GO_SRC/simple-ca"
        echo "Building Go binary..."
        (cd "$GO_SRC" && go build -o simple-ca .)
        run_flow "go" "$GO_BIN make-ca" "$GO_BIN make-cert" "$GO_BIN make-pfx"
        ;;&
    bash|python|go|all)
        ;;
    *)
        echo "ERROR: unknown target '$TEST_TARGET' (expected: bash|python|go|all)" >&2
        exit 1
        ;;
esac

echo
echo "All requested tests passed."