<?php

namespace Tests\Unit\Support;

use App\Support\SshHostKeyVerifier;
use phpseclib3\Net\SSH2;
use RuntimeException;
use Tests\TestCase;

class SshHostKeyVerifierTest extends TestCase
{
    public function test_missing_known_hosts_is_rejected_while_tls_verification_is_on(): void
    {
        config(['vmware.tls_verify' => true, 'vmware.ssh_known_hosts' => null]);

        $this->expectException(RuntimeException::class);

        SshHostKeyVerifier::verify($this->createMock(SSH2::class), '10.0.0.1');
    }

    public function test_missing_known_hosts_is_allowed_when_tls_verification_is_off(): void
    {
        config(['vmware.tls_verify' => false, 'vmware.ssh_known_hosts' => null]);

        SshHostKeyVerifier::verify($this->createMock(SSH2::class), '10.0.0.1');

        $this->addToAssertionCount(1);
    }

    public function test_host_key_must_match_known_hosts_entry(): void
    {
        $knownHosts = tempnam(sys_get_temp_dir(), 'kh');
        file_put_contents($knownHosts, "10.0.0.1 ssh-ed25519 AAAAexpected\n");
        config(['vmware.tls_verify' => true, 'vmware.ssh_known_hosts' => $knownHosts]);

        $matching = $this->createMock(SSH2::class);
        $matching->method('getServerPublicHostKey')->willReturn('ssh-ed25519 AAAAexpected');
        SshHostKeyVerifier::verify($matching, '10.0.0.1');

        $spoofed = $this->createMock(SSH2::class);
        $spoofed->method('getServerPublicHostKey')->willReturn('ssh-ed25519 AAAAattacker');
        $this->expectException(RuntimeException::class);
        try {
            SshHostKeyVerifier::verify($spoofed, '10.0.0.1');
        } finally {
            unlink($knownHosts);
        }
    }
}