package tdesx_test

import (
	"bytes"
	"errors"
	"testing"

	"code.yun.ink/pkg/encryptx/cipherx"
	"code.yun.ink/pkg/encryptx/tdesx"
)

func TestGenerateKey(t *testing.T) {
	key, err := tdesx.GenerateKey()
	if err != nil {
		t.Fatalf("GenerateKey 失败: %v", err)
	}
	if len(key) != tdesx.KeySize {
		t.Fatalf("密钥长度 = %d, 期望 %d", len(key), tdesx.KeySize)
	}

	other, _ := tdesx.GenerateKey()
	if bytes.Equal(key, other) {
		t.Error("两次 GenerateKey 产生了相同密钥")
	}

	hexKey, err := tdesx.GenerateKeyHex()
	if err != nil {
		t.Fatalf("GenerateKeyHex 失败: %v", err)
	}
	if len(hexKey) != tdesx.KeySize*2 {
		t.Errorf("GenerateKeyHex 长度 = %d, 期望 %d", len(hexKey), tdesx.KeySize*2)
	}
}

func TestKeySizeValidation(t *testing.T) {
	plaintext := []byte("hello")
	for _, wrongLen := range []int{0, 8, 16, 23, 25, 32} {
		key := bytes.Repeat([]byte{0x01}, wrongLen)
		if _, err := tdesx.EncryptCBC(plaintext, key); !errors.Is(err, cipherx.ErrInvalidKeySize) {
			t.Errorf("密钥长度 %d: 期望 ErrInvalidKeySize, 得到 %v", wrongLen, err)
		}
	}
}

func TestAllModesRoundTrip(t *testing.T) {
	key, err := tdesx.GenerateKey()
	if err != nil {
		t.Fatalf("GenerateKey 失败: %v", err)
	}

	encryptors := map[string]func([]byte, []byte) ([]byte, error){
		"ECB": tdesx.EncryptECB, "CBC": tdesx.EncryptCBC, "CFB": tdesx.EncryptCFB,
		"OFB": tdesx.EncryptOFB, "CTR": tdesx.EncryptCTR,
	}
	decryptors := map[string]func([]byte, []byte) ([]byte, error){
		"ECB": tdesx.DecryptECB, "CBC": tdesx.DecryptCBC, "CFB": tdesx.DecryptCFB,
		"OFB": tdesx.DecryptOFB, "CTR": tdesx.DecryptCTR,
	}
	plaintexts := [][]byte{
		{}, []byte("a"), []byte("1234567"), []byte("12345678"), []byte("123456789"),
		bytes.Repeat([]byte("3DES"), 200),
	}

	for name, encrypt := range encryptors {
		for i, plaintext := range plaintexts {
			ciphertext, err := encrypt(plaintext, key)
			if err != nil {
				t.Fatalf("%s 明文#%d 加密失败: %v", name, i, err)
			}
			decrypted, err := decryptors[name](ciphertext, key)
			if err != nil {
				t.Fatalf("%s 明文#%d 解密失败: %v", name, i, err)
			}
			if !bytes.Equal(decrypted, plaintext) {
				t.Errorf("%s 明文#%d 往返不一致", name, i)
			}
		}
	}
}

func TestHexAPIRoundTrip(t *testing.T) {
	key, _ := tdesx.GenerateKey()
	plaintext := []byte("十六进制往返")

	cases := []struct {
		name    string
		encrypt func([]byte, []byte) (string, error)
		decrypt func(string, []byte) ([]byte, error)
	}{
		{"ECB", tdesx.EncryptECBHex, tdesx.DecryptECBHex},
		{"CBC", tdesx.EncryptCBCHex, tdesx.DecryptCBCHex},
		{"CFB", tdesx.EncryptCFBHex, tdesx.DecryptCFBHex},
		{"OFB", tdesx.EncryptOFBHex, tdesx.DecryptOFBHex},
		{"CTR", tdesx.EncryptCTRHex, tdesx.DecryptCTRHex},
	}
	for _, c := range cases {
		hexStr, err := c.encrypt(plaintext, key)
		if err != nil {
			t.Fatalf("%s Hex 加密失败: %v", c.name, err)
		}
		if bytes.ContainsAny([]byte(hexStr), "\n\r \t") {
			t.Errorf("%s Hex 输出含空白字符", c.name)
		}
		decrypted, err := c.decrypt(hexStr, key)
		if err != nil {
			t.Fatalf("%s Hex 解密失败: %v", c.name, err)
		}
		if !bytes.Equal(decrypted, plaintext) {
			t.Errorf("%s Hex 往返不一致", c.name)
		}
	}
}

func TestWithIVRoundTrip(t *testing.T) {
	key, _ := tdesx.GenerateKey()
	iv := bytes.Repeat([]byte{0x5A}, tdesx.BlockSize)
	plaintext := []byte("fixed iv")

	cases := []struct {
		name    string
		encrypt func([]byte, []byte, []byte) ([]byte, error)
		decrypt func([]byte, []byte, []byte) ([]byte, error)
	}{
		{"CBC", tdesx.EncryptCBCWithIV, tdesx.DecryptCBCWithIV},
		{"CFB", tdesx.EncryptCFBWithIV, tdesx.DecryptCFBWithIV},
		{"OFB", tdesx.EncryptOFBWithIV, tdesx.DecryptOFBWithIV},
		{"CTR", tdesx.EncryptCTRWithIV, tdesx.DecryptCTRWithIV},
	}
	for _, c := range cases {
		ciphertext, err := c.encrypt(plaintext, key, iv)
		if err != nil {
			t.Fatalf("%s WithIV 加密失败: %v", c.name, err)
		}
		decrypted, err := c.decrypt(ciphertext, key, iv)
		if err != nil {
			t.Fatalf("%s WithIV 解密失败: %v", c.name, err)
		}
		if !bytes.Equal(decrypted, plaintext) {
			t.Errorf("%s WithIV 往返不一致", c.name)
		}
	}
}

// TestMalformedCiphertextNeverPanics 是 P0-3 在 3DES 上的回归测试。
func TestMalformedCiphertextNeverPanics(t *testing.T) {
	key, _ := tdesx.GenerateKey()
	decryptors := map[string]func([]byte, []byte) ([]byte, error){
		"ECB": tdesx.DecryptECB, "CBC": tdesx.DecryptCBC, "CFB": tdesx.DecryptCFB,
		"OFB": tdesx.DecryptOFB, "CTR": tdesx.DecryptCTR,
	}
	for _, decrypt := range decryptors {
		for n := 0; n <= 24; n++ {
			_, _ = decrypt(bytes.Repeat([]byte{0x7F}, n), key)
		}
	}

	nonAligned := bytes.Repeat([]byte{0xAB}, 12)
	if _, err := tdesx.DecryptECB(nonAligned, key); !errors.Is(err, cipherx.ErrNotBlockAligned) {
		t.Errorf("ECB 非对齐: 期望 ErrNotBlockAligned, 得到 %v", err)
	}
	if _, err := tdesx.DecryptCBC(nonAligned, key); !errors.Is(err, cipherx.ErrNotBlockAligned) {
		t.Errorf("CBC 非对齐: 期望 ErrNotBlockAligned, 得到 %v", err)
	}
}

func TestECBIsDeterministic(t *testing.T) {
	key, _ := tdesx.GenerateKey()
	plaintext := bytes.Repeat([]byte("12345678"), 3)

	a, _ := tdesx.EncryptECB(plaintext, key)
	b, _ := tdesx.EncryptECB(plaintext, key)
	if !bytes.Equal(a, b) {
		t.Error("ECB 应当是确定性的")
	}

	c, _ := tdesx.EncryptCBC(plaintext, key)
	d, _ := tdesx.EncryptCBC(plaintext, key)
	if bytes.Equal(c, d) {
		t.Error("CBC 使用了随机 IV，两次结果不应相同")
	}
}