<?php

namespace Tests\Feature\Console;

use App\Http\Facade\SignRSA;
use Illuminate\Encryption\Encrypter;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\DB;
use Tests\TestCase;

class ReencryptSecretsTest extends TestCase
{
    use RefreshDatabase;

    protected function setUp(): void
    {
        parent::setUp();

        DB::table('infra_management')->delete();
    }

    public function test_rotating_keys_re_encrypts_rsa_and_app_key_columns(): void
    {
        [$oldRsa, $newRsa] = [$this->rsaConfig(), $this->rsaConfig()];
        [$oldAppKey, $newAppKey] = [$this->appKey(), $this->appKey()];

        $this->useKeys($oldRsa, $oldAppKey);
        $vcenterId = DB::table('module_vcenter')->insertGetId(['password' => SignRSA::EncryptFunc('vc-secret')]);
        $dnsServerId = DB::table('dns_manager_servers')->insertGetId([
            'name' => 'ns1', 'ip_address' => '10.0.0.1', 'username' => 'admin', 'password' => Crypt::encryptString('plesk-secret'),
        ]);
        DB::table('setting')->insert(['key' => 'smtp', 'value' => json_encode(['host' => 'smtp', 'password' => SignRSA::EncryptFunc('smtp-secret')])]);

        $this->useKeys($newRsa, $newAppKey, previousRsa: $oldRsa, previousAppKey: $oldAppKey);
        $this->artisan('secrets:reencrypt')->assertSuccessful();

        $this->useKeys($newRsa, $newAppKey);
        $this->assertSame('vc-secret', SignRSA::DecryptFunc(DB::table('module_vcenter')->where('id', $vcenterId)->value('password')));
        $this->assertSame('plesk-secret', Crypt::decryptString(DB::table('dns_manager_servers')->where('id', $dnsServerId)->value('password')));
        $smtp = json_decode(DB::table('setting')->where('key', 'smtp')->value('value'), true);
        $this->assertSame('smtp-secret', SignRSA::DecryptFunc($smtp['password']));
        $this->assertSame('smtp', $smtp['host']);
    }

    public function test_dry_run_changes_nothing_and_undecryptable_rows_fail_the_command(): void
    {
        $this->useKeys($this->rsaConfig(), $this->appKey());
        $id = DB::table('module_vcenter')->insertGetId(['password' => SignRSA::EncryptFunc('vc-secret')]);
        $original = DB::table('module_vcenter')->where('id', $id)->value('password');

        $this->artisan('secrets:reencrypt --dry-run')->assertSuccessful();
        $this->assertSame($original, DB::table('module_vcenter')->where('id', $id)->value('password'));

        $this->useKeys($this->rsaConfig(), $this->appKey());
        $this->artisan('secrets:reencrypt')->assertFailed();
        $this->assertSame($original, DB::table('module_vcenter')->where('id', $id)->value('password'));
    }

    private function useKeys(array $rsa, string $appKey, ?array $previousRsa = null, ?string $previousAppKey = null): void
    {
        config([
            'rsa.key' => $rsa['key'],
            'rsa.public' => $rsa['public'],
            'rsa.private' => $rsa['private'],
            'rsa.previous_key' => $previousRsa['key'] ?? null,
            'rsa.previous_public' => $previousRsa['public'] ?? null,
            'app.key' => $appKey,
            'app.previous_keys' => $previousAppKey ? [$previousAppKey] : [],
        ]);

        $this->app->forgetInstance('encrypter');
        $this->app->forgetInstance(\App\Http\Services\SignRSA::class);
        Crypt::clearResolvedInstance('encrypter');
        SignRSA::clearResolvedInstance(\App\Http\Services\SignRSA::class);
    }

    private function rsaConfig(): array
    {
        $pair = openssl_pkey_new(['private_key_bits' => 2048]);
        openssl_pkey_export($pair, $private);

        return [
            'key' => base64_encode(random_bytes(24)),
            'public' => openssl_pkey_get_details($pair)['key'],
            'private' => $private,
        ];
    }

    private function appKey(): string
    {
        return 'base64:' . base64_encode(Encrypter::generateKey('AES-256-CBC'));
    }
}