//! Client seam round-trips: [`TlsClientConfig::new`] per credentials cell
//! → `into_rustls_config()` (and `for_noq()` under the `noq` feature);
//! `enable_early_data == true` pinned (the client half of the 0-RTT
//! invariant, ADR-001); the config carries a single-value ALPN list.

use alktls::{
    ConnectionCredentials, Ed25519SecretKey, RemoteIdentity, TlsClientConfig, TlsIdentity,
};

fn pinned_credentials() -> ConnectionCredentials {
    ConnectionCredentials::new()
        .with_local_identity(TlsIdentity::RawKey(Ed25519SecretKey::generate()))
        .with_remote_identity(RemoteIdentity {
            fingerprint: "ed25519:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
                .to_string(),
        })
}

fn ca_credentials() -> ConnectionCredentials {
    ConnectionCredentials::new()
        .with_local_identity(TlsIdentity::RawKey(Ed25519SecretKey::generate()))
}

fn assert_client_seam(config: rustls::ClientConfig, alpn: &[u8]) {
    assert!(
        config.enable_early_data,
        "enable_early_data must be true on every client config (the client half of the 0-RTT \
         invariant, ADR-001)"
    );
    assert_eq!(
        config.alpn_protocols,
        vec![alpn.to_vec()],
        "the client config carries a single-value ALPN list"
    );
}

#[test]
fn pinned_cell_into_rustls_config_round_trip() {
    let config = TlsClientConfig::new(&pinned_credentials(), b"alk/call")
        .expect("pinned cell must construct");
    assert_client_seam(config.into_rustls_config(), b"alk/call");
}

#[test]
fn ca_cell_into_rustls_config_round_trip() {
    let config =
        TlsClientConfig::new(&ca_credentials(), b"alk/call").expect("CA cell must construct");
    assert_client_seam(config.into_rustls_config(), b"alk/call");
}

#[test]
fn empty_credentials_cell_into_rustls_config_round_trip() {
    let config = TlsClientConfig::new(&ConnectionCredentials::new(), b"alk/call")
        .expect("empty cell (no local identity, no pin) must construct — the public-X.509 state");
    assert_client_seam(config.into_rustls_config(), b"alk/call");
}

#[cfg(feature = "noq")]
#[test]
fn pinned_cell_for_noq_round_trip() {
    let config = TlsClientConfig::new(&pinned_credentials(), b"alk/call")
        .expect("pinned cell must construct");
    let noq_config = config
        .for_noq()
        .expect("for_noq must wrap the rustls config for QUIC");
    let _ = noq_config;
}

#[cfg(feature = "noq")]
#[test]
fn ca_cell_for_noq_round_trip() {
    let config =
        TlsClientConfig::new(&ca_credentials(), b"alk/call").expect("CA cell must construct");
    let noq_config = config.for_noq().expect("for_noq must wrap for QUIC");
    let _ = noq_config;
}