at-container-registry/pkg/atproto/did/cmd_test.go

package did

import (
	"context"
	"strings"
	"testing"

	"github.com/bluesky-social/indigo/atproto/atcrypto"
)

// TestAddRotationKey_AppendNew confirms a fresh key is appended at the lowest priority
// when Prepend is false.
func TestAddRotationKey_AppendNew(t *testing.T) {
	ctx := context.Background()

	serverRot := generateK256(t)
	signing := generateK256(t)
	fake := newFakePLC(t, []*atcrypto.PrivateKeyK256{serverRot}, serverRot, signing)
	defer fake.Close()

	newKey := generateK256(t)
	res, err := AddRotationKey(ctx, AddRotationKeyOptions{
		DID:                 fake.did,
		PLCDirectoryURL:     fake.URL(),
		RotationKey:         serverRot,
		SigningKey:          signing,
		VerificationKeyName: "atproto",
		NewKey:              newKey,
		Prepend:             false,
	})
	if err != nil {
		t.Fatalf("AddRotationKey: %v", err)
	}
	if res.AlreadyPresent {
		t.Fatal("AlreadyPresent should be false")
	}
	if res.Generated {
		t.Error("Generated should be false when NewKey provided")
	}
	if res.TotalKeys != 2 {
		t.Errorf("TotalKeys: got %d want 2", res.TotalKeys)
	}
	if res.InsertedAt != 1 {
		t.Errorf("InsertedAt: got %d want 1 (appended)", res.InsertedAt)
	}

	if len(fake.submitted) != 1 {
		t.Fatalf("expected one update submission, got %d", len(fake.submitted))
	}
	got := fake.submitted[0]
	newPub, _ := newKey.PublicKey()
	if got.RotationKeys[len(got.RotationKeys)-1] != newPub.DIDKey() {
		t.Errorf("appended key not at last position: %v", got.RotationKeys)
	}
}

// TestAddRotationKey_Prepend confirms Prepend=true puts the new key at index 0
// (highest priority position).
func TestAddRotationKey_Prepend(t *testing.T) {
	ctx := context.Background()

	serverRot := generateK256(t)
	signing := generateK256(t)
	fake := newFakePLC(t, []*atcrypto.PrivateKeyK256{serverRot}, serverRot, signing)
	defer fake.Close()

	newKey := generateK256(t)
	res, err := AddRotationKey(ctx, AddRotationKeyOptions{
		DID:                 fake.did,
		PLCDirectoryURL:     fake.URL(),
		RotationKey:         serverRot,
		SigningKey:          signing,
		VerificationKeyName: "atproto",
		NewKey:              newKey,
		Prepend:             true,
	})
	if err != nil {
		t.Fatalf("AddRotationKey: %v", err)
	}
	if res.InsertedAt != 0 {
		t.Errorf("InsertedAt: got %d want 0", res.InsertedAt)
	}
	if len(fake.submitted) != 1 {
		t.Fatalf("expected one update, got %d", len(fake.submitted))
	}
	newPub, _ := newKey.PublicKey()
	if fake.submitted[0].RotationKeys[0] != newPub.DIDKey() {
		t.Errorf("prepended key not at first position: %v", fake.submitted[0].RotationKeys)
	}
}

// TestAddRotationKey_GeneratesWhenNil confirms the helper generates a fresh key
// and reports it via Result.
func TestAddRotationKey_GeneratesWhenNil(t *testing.T) {
	ctx := context.Background()

	serverRot := generateK256(t)
	signing := generateK256(t)
	fake := newFakePLC(t, []*atcrypto.PrivateKeyK256{serverRot}, serverRot, signing)
	defer fake.Close()

	res, err := AddRotationKey(ctx, AddRotationKeyOptions{
		DID:                 fake.did,
		PLCDirectoryURL:     fake.URL(),
		RotationKey:         serverRot,
		SigningKey:          signing,
		VerificationKeyName: "atproto",
		NewKey:              nil,
	})
	if err != nil {
		t.Fatalf("AddRotationKey: %v", err)
	}
	if !res.Generated {
		t.Error("Generated should be true when NewKey is nil")
	}
	if res.NewKey == nil {
		t.Fatal("NewKey on result should not be nil")
	}
	if res.NewKeyDIDKey == "" {
		t.Error("NewKeyDIDKey should be populated")
	}
}

// TestAddRotationKey_AlreadyPresent confirms a no-op when the key is already in the list.
func TestAddRotationKey_AlreadyPresent(t *testing.T) {
	ctx := context.Background()

	serverRot := generateK256(t)
	signing := generateK256(t)
	fake := newFakePLC(t, []*atcrypto.PrivateKeyK256{serverRot}, serverRot, signing)
	defer fake.Close()

	res, err := AddRotationKey(ctx, AddRotationKeyOptions{
		DID:                 fake.did,
		PLCDirectoryURL:     fake.URL(),
		RotationKey:         serverRot,
		SigningKey:          signing,
		VerificationKeyName: "atproto",
		NewKey:              serverRot,
	})
	if err != nil {
		t.Fatalf("AddRotationKey: %v", err)
	}
	if !res.AlreadyPresent {
		t.Error("AlreadyPresent should be true")
	}
	if res.ExistingAt != 0 {
		t.Errorf("ExistingAt: got %d want 0", res.ExistingAt)
	}
	if len(fake.submitted) != 0 {
		t.Errorf("no submission expected when key already present, got %d", len(fake.submitted))
	}
}

// TestAddRotationKey_ValidationErrors covers the early-return guard clauses in AddRotationKey.
func TestAddRotationKey_ValidationErrors(t *testing.T) {
	ctx := context.Background()
	signing := generateK256(t)
	rot := generateK256(t)

	cases := []struct {
		name    string
		opt     AddRotationKeyOptions
		wantSub string
	}{
		{
			name:    "missing DID",
			opt:     AddRotationKeyOptions{RotationKey: rot, SigningKey: signing, VerificationKeyName: "atproto"},
			wantSub: "DID is required",
		},
		{
			name:    "missing rotation key",
			opt:     AddRotationKeyOptions{DID: "did:plc:abc", SigningKey: signing, VerificationKeyName: "atproto"},
			wantSub: "rotation key is required",
		},
		{
			name:    "missing signing key",
			opt:     AddRotationKeyOptions{DID: "did:plc:abc", RotationKey: rot, VerificationKeyName: "atproto"},
			wantSub: "signing key is required",
		},
		{
			name:    "missing verification key name",
			opt:     AddRotationKeyOptions{DID: "did:plc:abc", RotationKey: rot, SigningKey: signing},
			wantSub: "VerificationKeyName is required",
		},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			_, err := AddRotationKey(ctx, tc.opt)
			if err == nil {
				t.Fatal("expected error, got nil")
			}
			if !strings.Contains(err.Error(), tc.wantSub) {
				t.Errorf("error: got %q want substring %q", err.Error(), tc.wantSub)
			}
		})
	}
}

// TestListRotationKeys returns the priority-ordered keys from the latest op.
func TestListRotationKeys(t *testing.T) {
	ctx := context.Background()

	rot1 := generateK256(t)
	rot2 := generateK256(t)
	signing := generateK256(t)
	fake := newFakePLC(t, []*atcrypto.PrivateKeyK256{rot1, rot2}, rot1, signing)
	defer fake.Close()

	res, err := ListRotationKeys(ctx, ListRotationKeysOptions{
		DID:             fake.did,
		PLCDirectoryURL: fake.URL(),
	})
	if err != nil {
		t.Fatalf("ListRotationKeys: %v", err)
	}
	if res.DID != fake.did {
		t.Errorf("DID: got %s want %s", res.DID, fake.did)
	}
	if res.Directory != fake.URL() {
		t.Errorf("Directory: got %s want %s", res.Directory, fake.URL())
	}
	if len(res.Keys) != 2 {
		t.Fatalf("Keys length: got %d want 2", len(res.Keys))
	}
	pub1, _ := rot1.PublicKey()
	pub2, _ := rot2.PublicKey()
	if res.Keys[0] != pub1.DIDKey() {
		t.Errorf("Keys[0]: got %s want %s", res.Keys[0], pub1.DIDKey())
	}
	if res.Keys[1] != pub2.DIDKey() {
		t.Errorf("Keys[1]: got %s want %s", res.Keys[1], pub2.DIDKey())
	}
	if res.LocalDIDKey != "" {
		t.Errorf("LocalDIDKey should be empty when no LocalRotationKey provided, got %s", res.LocalDIDKey)
	}
	if res.LocalPresent {
		t.Error("LocalPresent should be false when no LocalRotationKey provided")
	}
}

// TestListRotationKeys_LocalPresent confirms LocalPresent flips to true when the local
// key matches one in the published list.
func TestListRotationKeys_LocalPresent(t *testing.T) {
	ctx := context.Background()

	serverRot := generateK256(t)
	signing := generateK256(t)
	fake := newFakePLC(t, []*atcrypto.PrivateKeyK256{serverRot}, serverRot, signing)
	defer fake.Close()

	res, err := ListRotationKeys(ctx, ListRotationKeysOptions{
		DID:              fake.did,
		PLCDirectoryURL:  fake.URL(),
		LocalRotationKey: serverRot,
	})
	if err != nil {
		t.Fatalf("ListRotationKeys: %v", err)
	}
	if !res.LocalPresent {
		t.Error("LocalPresent should be true")
	}
	pub, _ := serverRot.PublicKey()
	if res.LocalDIDKey != pub.DIDKey() {
		t.Errorf("LocalDIDKey: got %s want %s", res.LocalDIDKey, pub.DIDKey())
	}
}

// TestListRotationKeys_LocalNotPresent flags a rotated-out local key.
func TestListRotationKeys_LocalNotPresent(t *testing.T) {
	ctx := context.Background()

	serverRot := generateK256(t)
	signing := generateK256(t)
	fake := newFakePLC(t, []*atcrypto.PrivateKeyK256{serverRot}, serverRot, signing)
	defer fake.Close()

	stranger := generateK256(t)
	res, err := ListRotationKeys(ctx, ListRotationKeysOptions{
		DID:              fake.did,
		PLCDirectoryURL:  fake.URL(),
		LocalRotationKey: stranger,
	})
	if err != nil {
		t.Fatalf("ListRotationKeys: %v", err)
	}
	if res.LocalPresent {
		t.Error("LocalPresent should be false for a stranger key")
	}
	if res.LocalDIDKey == "" {
		t.Error("LocalDIDKey should still be populated even when not present")
	}
}

// TestListRotationKeys_MissingDID surfaces the early-return validation.
func TestListRotationKeys_MissingDID(t *testing.T) {
	_, err := ListRotationKeys(context.Background(), ListRotationKeysOptions{})
	if err == nil {
		t.Fatal("expected error for missing DID")
	}
	if !strings.Contains(err.Error(), "DID is required") {
		t.Errorf("error: got %q", err.Error())
	}
}