package hardwarelicense

import (
	"testing"
	"time"

	"data-terminal-cloud/internal/audit"

	"github.com/jackc/pgx/v5/pgxpool"
)

func TestNewServiceRequiresDomainKey(t *testing.T) {
	for _, key := range []string{"", "not-hex", "00"} {
		if _, err := NewService(&pgxpool.Pool{}, audit.NewRepository(), key); err == nil {
			t.Fatalf("key %q should be rejected", key)
		}
	}
}

func TestLicenseCipherUsesBoundAAD(t *testing.T) {
	service, err := NewService(&pgxpool.Pool{}, audit.NewRepository(), "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
	if err != nil {
		t.Fatal(err)
	}
	expires := time.Date(2027, 1, 2, 3, 4, 5, 0, time.UTC)
	nonce := make([]byte, service.aead.NonceSize())
	aad := licenseAAD("license-1", "instance-1", "product-1", expires)
	ciphertext := service.aead.Seal(nil, nonce, []byte("secret-license-value"), aad)
	plaintext, err := service.aead.Open(nil, nonce, ciphertext, aad)
	if err != nil || string(plaintext) != "secret-license-value" {
		t.Fatalf("round trip = %q, %v", plaintext, err)
	}
	if _, err := service.aead.Open(nil, nonce, ciphertext, licenseAAD("license-1", "instance-1", "product-2", expires)); err == nil {
		t.Fatal("ciphertext must not decrypt for another product")
	}
}