package main

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// The interception ca is added to the system roots and never substituted for
// them: the one feature that reaches the internet directly is oidc, and it
// verifies a real provider against the roots the image ships.
func TestCABundle(t *testing.T) {
	dir := t.TempDir()
	sys := filepath.Join(dir, "ca-certificates.crt")
	cf := filepath.Join(dir, "cloudflare.crt")
	out := filepath.Join(dir, "ca-bundle.crt")
	if err := os.WriteFile(sys, []byte("the system roots\n"), 0600); err != nil {
		t.Fatal(err)
	}

	// No interception certificate, which is what a bare docker run gets.
	if err := caBundle(sys, cf, out); err != nil {
		t.Fatalf("with no interception ca: %v", err)
	}
	if got, err := os.ReadFile(out); err != nil || string(got) != "the system roots\n" {
		t.Errorf("the bundle is %q: %v, want the system roots alone", got, err)
	}

	if err := os.WriteFile(cf, []byte("the interception ca\n"), 0600); err != nil {
		t.Fatal(err)
	}
	if err := caBundle(sys, cf, out); err != nil {
		t.Fatalf("with one: %v", err)
	}
	got, err := os.ReadFile(out)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(got), "the system roots") {
		t.Errorf("the system roots were replaced rather than added to: %q", got)
	}
	if !strings.Contains(string(got), "the interception ca") {
		t.Errorf("the interception ca is not in the bundle: %q", got)
	}

	// A system store that is not there is a bundle that cannot be trusted, not
	// an empty one.
	if err := caBundle(filepath.Join(dir, "absent"), cf, out); err == nil {
		t.Error("a missing system store was accepted")
	}
}