use shin::aead::{AeadError, AeadKey};
use shin::hash::Transcript;
use shin::kdf::Hkdf;
use shin::schedule::{KeySchedule, TrafficKeys};

const EARLY_SECRET: [u8; 32] = [
    0x33, 0xad, 0x0a, 0x1c, 0x60, 0x7e, 0xc0, 0x3b, 0x09, 0xe6, 0xcd, 0x98, 0x93, 0x68, 0x0c, 0xe2,
    0x10, 0xad, 0xf3, 0x00, 0xaa, 0x1f, 0x26, 0x60, 0xe1, 0xb2, 0x2e, 0x10, 0xf1, 0x70, 0xf9, 0x2a,
];

const DERIVED_FOR_HANDSHAKE: [u8; 32] = [
    0x6f, 0x26, 0x15, 0xa1, 0x08, 0xc7, 0x02, 0xc5, 0x67, 0x8f, 0x54, 0xfc, 0x9d, 0xba, 0xb6, 0x97,
    0x16, 0xc0, 0x76, 0x18, 0x9c, 0x48, 0x25, 0x0c, 0xeb, 0xea, 0xc3, 0x57, 0x6c, 0x36, 0x11, 0xba,
];

const DHE_SHARED: [u8; 32] = [
    0x8b, 0xd4, 0x05, 0x4f, 0xb5, 0x5b, 0x9d, 0x63, 0xfd, 0xfb, 0xac, 0xf9, 0xf0, 0x4b, 0x9f, 0x0d,
    0x35, 0xe6, 0xd6, 0x3f, 0x53, 0x75, 0x63, 0xef, 0xd4, 0x62, 0x72, 0x90, 0x0f, 0x89, 0x49, 0x2d,
];

const HANDSHAKE_SECRET: [u8; 32] = [
    0x1d, 0xc8, 0x26, 0xe9, 0x36, 0x06, 0xaa, 0x6f, 0xdc, 0x0a, 0xad, 0xc1, 0x2f, 0x74, 0x1b, 0x01,
    0x04, 0x6a, 0xa6, 0xb9, 0x9f, 0x69, 0x1e, 0xd2, 0x21, 0xa9, 0xf0, 0xca, 0x04, 0x3f, 0xbe, 0xac,
];

const S_HS_TRAFFIC: [u8; 32] = [
    0xb6, 0x7b, 0x7d, 0x69, 0x0c, 0xc1, 0x6c, 0x4e, 0x75, 0xe5, 0x42, 0x13, 0xcb, 0x2d, 0x37, 0xb4,
    0xe9, 0xc9, 0x12, 0xbc, 0xde, 0xd9, 0x10, 0x5d, 0x42, 0xbe, 0xfd, 0x59, 0xd3, 0x91, 0xad, 0x38,
];

const S_HS_KEY: [u8; 16] = [
    0x3f, 0xce, 0x51, 0x60, 0x09, 0xc2, 0x17, 0x27, 0xd0, 0xf2, 0xe4, 0xe8, 0x6e, 0xe4, 0x03, 0xbc,
];

const S_HS_IV: [u8; 12] = [
    0x5d, 0x31, 0x3e, 0xb2, 0x67, 0x12, 0x76, 0xee, 0x13, 0x00, 0x0b, 0x30,
];

const DERIVED_FOR_MASTER: [u8; 32] = [
    0x43, 0xde, 0x77, 0xe0, 0xc7, 0x77, 0x13, 0x85, 0x9a, 0x94, 0x4d, 0xb9, 0xdb, 0x25, 0x90, 0xb5,
    0x31, 0x90, 0xa6, 0x5b, 0x3e, 0xe2, 0xe4, 0xf1, 0x2d, 0xd7, 0xa0, 0xbb, 0x7c, 0xe2, 0x54, 0xb4,
];

const MASTER_SECRET: [u8; 32] = [
    0x18, 0xdf, 0x06, 0x84, 0x3d, 0x13, 0xa0, 0x8b, 0xf2, 0xa4, 0x49, 0x84, 0x4c, 0x5f, 0x8a, 0x47,
    0x80, 0x01, 0xbc, 0x4d, 0x4c, 0x62, 0x79, 0x84, 0xd5, 0xa4, 0x1d, 0xa8, 0xd0, 0x40, 0x29, 0x19,
];

const TRANSCRIPT_HASH_SF: [u8; 32] = [
    0x96, 0x08, 0x10, 0x2a, 0x0f, 0x1c, 0xcc, 0x6d, 0xb6, 0x25, 0x0b, 0x7b, 0x7e, 0x41, 0x7b, 0x1a,
    0x00, 0x0e, 0xaa, 0xda, 0x3d, 0xaa, 0xe4, 0x77, 0x7a, 0x76, 0x86, 0xc9, 0xff, 0x83, 0xdf, 0x13,
];

const C_AP_TRAFFIC: [u8; 32] = [
    0x9e, 0x40, 0x64, 0x6c, 0xe7, 0x9a, 0x7f, 0x9d, 0xc0, 0x5a, 0xf8, 0x88, 0x9b, 0xce, 0x65, 0x52,
    0x87, 0x5a, 0xfa, 0x0b, 0x06, 0xdf, 0x00, 0x87, 0xf7, 0x92, 0xeb, 0xb7, 0xc1, 0x75, 0x04, 0xa5,
];

const S_AP_TRAFFIC: [u8; 32] = [
    0xa1, 0x1a, 0xf9, 0xf0, 0x55, 0x31, 0xf8, 0x56, 0xad, 0x47, 0x11, 0x6b, 0x45, 0xa9, 0x50, 0x32,
    0x82, 0x04, 0xb4, 0xf4, 0x4b, 0xfb, 0x6b, 0x3a, 0x4b, 0x4f, 0x1f, 0x3f, 0xcb, 0x63, 0x16, 0x43,
];

#[test]
fn sha256_empty_string_matches_known_value() {
    const KNOWN: [u8; 32] = [
        0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f, 0xb9,
        0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52,
        0xb8, 0x55,
    ];
    assert_eq!(Transcript::hash_empty(), KNOWN);
}

#[test]
fn early_secret_matches_rfc8448() {
    let zero = [0u8; 32];
    let early = Hkdf::extract(&zero, &zero);
    assert_eq!(early, EARLY_SECRET);
}

#[test]
fn derive_secret_for_handshake_matches_rfc8448() {
    let derived = Hkdf::derive_secret(&EARLY_SECRET, "derived", &Transcript::hash_empty());
    assert_eq!(derived, DERIVED_FOR_HANDSHAKE);
}

#[test]
fn handshake_secret_matches_rfc8448() {
    let hs_secret = Hkdf::extract(&DERIVED_FOR_HANDSHAKE, &DHE_SHARED);
    assert_eq!(hs_secret, HANDSHAKE_SECRET);
}

#[test]
fn key_schedule_walks_to_handshake_secret() {
    let ks = KeySchedule::new();
    assert_eq!(ks.secret(), &EARLY_SECRET);
    let ks = ks.into_handshake(&DHE_SHARED);
    assert_eq!(ks.secret(), &HANDSHAKE_SECRET);
}

#[test]
fn server_handshake_traffic_keys_match_rfc8448() {
    let tk = TrafficKeys::aes_128_gcm(&S_HS_TRAFFIC);
    assert_eq!(tk.key, S_HS_KEY);
    assert_eq!(tk.iv, S_HS_IV);
}

#[test]
fn master_secret_matches_rfc8448() {
    let derived = Hkdf::derive_secret(&HANDSHAKE_SECRET, "derived", &Transcript::hash_empty());
    assert_eq!(derived, DERIVED_FOR_MASTER);
    let zero = [0u8; 32];
    let master = Hkdf::extract(&derived, &zero);
    assert_eq!(master, MASTER_SECRET);
}

#[test]
fn key_schedule_walks_to_master_secret() {
    let ks = KeySchedule::new().into_handshake(&DHE_SHARED).into_master();
    assert_eq!(ks.secret(), &MASTER_SECRET);
}

#[test]
fn application_traffic_secrets_match_rfc8448() {
    let ks = KeySchedule::new().into_handshake(&DHE_SHARED).into_master();
    assert_eq!(
        ks.client_application_traffic_secret(&TRANSCRIPT_HASH_SF),
        C_AP_TRAFFIC
    );
    assert_eq!(
        ks.server_application_traffic_secret(&TRANSCRIPT_HASH_SF),
        S_AP_TRAFFIC
    );
}

#[test]
fn hkdf_expand_label_matches_explicit_info() {
    let mut from_label = [0u8; 16];
    Hkdf::expand_label(&S_HS_TRAFFIC, "key", &[], &mut from_label);
    assert_eq!(from_label, S_HS_KEY);

    let mut from_explicit = [0u8; 16];
    let info = [
        0x00, 0x10, 0x09, b't', b'l', b's', b'1', b'3', b' ', b'k', b'e', b'y', 0x00,
    ];
    shin::kdf::Hkdf::expand(&S_HS_TRAFFIC, &info, &mut from_explicit);
    assert_eq!(from_explicit, S_HS_KEY);

    assert_eq!(from_label, from_explicit);
}

#[test]
fn aead_seal_open_round_trip() {
    let key = AeadKey::aes_128_gcm(&S_HS_KEY, S_HS_IV);
    let plaintext = b"some plaintext payload";
    let aad = b"associated data";
    let mut sealed = key.seal(0, aad, plaintext);
    let opened = key.open(0, aad, &mut sealed).unwrap();
    assert_eq!(opened, plaintext);
}

#[test]
fn aead_open_rejects_tampered_tag() {
    let key = AeadKey::aes_128_gcm(&S_HS_KEY, S_HS_IV);
    let mut sealed = key.seal(0, b"aad", b"payload");
    let last = sealed.len() - 1;
    sealed[last] ^= 0x01;
    assert_eq!(key.open(0, b"aad", &mut sealed), Err(AeadError::OpenFailed));
}

#[test]
fn aead_open_rejects_wrong_aad() {
    let key = AeadKey::aes_128_gcm(&S_HS_KEY, S_HS_IV);
    let mut sealed = key.seal(0, b"aad-a", b"payload");
    assert_eq!(
        key.open(0, b"aad-b", &mut sealed),
        Err(AeadError::OpenFailed)
    );
}

#[test]
fn aead_open_rejects_wrong_seq() {
    let key = AeadKey::aes_128_gcm(&S_HS_KEY, S_HS_IV);
    let mut sealed = key.seal(0, b"aad", b"payload");
    assert_eq!(key.open(7, b"aad", &mut sealed), Err(AeadError::OpenFailed));
}

#[test]
fn aead_seq_mutates_nonce() {
    let key = AeadKey::aes_128_gcm(&S_HS_KEY, S_HS_IV);
    let n0 = key.nonce(0);
    let n1 = key.nonce(1);
    assert_eq!(&n0[..4], &S_HS_IV[..4]);
    assert_eq!(n0, S_HS_IV);
    assert_ne!(n0, n1);
    assert_eq!(n1[11], S_HS_IV[11] ^ 1);
}
