import Foundation
import Testing
@testable import ClientTLS

// C-iOS-1 · Store roundtrip via the InMemory store (same import/summary code
// path as the keychain store, minus the entitlement — the keychain variant is
// covered by on-device/simulator tests, mirroring KeychainHostStoreLiveTests).

@Test("save → loadIdentity roundtrips and hasInstalledIdentity flips")
func storeRoundtrip() throws {
    // Arrange
    let store = InMemoryClientIdentityStore()
    #expect(store.hasInstalledIdentity() == false)
    #expect(try store.loadIdentity() == nil)

    // Act
    try store.save(
        p12Data: ClientTLSFixtures.deviceP12Data, passphrase: ClientTLSFixtures.passphrase
    )

    // Assert
    #expect(store.hasInstalledIdentity() == true)
    let identity = try #require(try store.loadIdentity())
    #expect(identity.summary()?.subjectCommonName == ClientTLSFixtures.leafCommonName)
    let summary = try #require(try store.loadSummary())
    #expect(summary.issuerCommonName == ClientTLSFixtures.issuerCommonName)
}

@Test("save validates the passphrase and leaves prior state untouched on failure")
func storeSaveValidatesBeforePersisting() {
    // Arrange
    let store = InMemoryClientIdentityStore()

    // Act / Assert — a wrong passphrase must surface, not persist.
    #expect(throws: PKCS12ImportError.wrongPassphrase) {
        try store.save(p12Data: ClientTLSFixtures.deviceP12Data, passphrase: "wrong")
    }
    #expect(store.hasInstalledIdentity() == false)
}

@Test("remove clears the stored identity")
func storeRemove() throws {
    // Arrange
    let store = InMemoryClientIdentityStore()
    try store.save(
        p12Data: ClientTLSFixtures.deviceP12Data, passphrase: ClientTLSFixtures.passphrase
    )
    #expect(store.hasInstalledIdentity() == true)

    // Act
    try store.remove()

    // Assert
    #expect(store.hasInstalledIdentity() == false)
    #expect(try store.loadIdentity() == nil)
}

@Test("loadedIdentityOrNil returns nil (not a throw) when nothing is installed")
func loadedIdentityOrNilEmpty() {
    let store = InMemoryClientIdentityStore()
    #expect(store.loadedIdentityOrNil() == nil)
}