// Copyright The OpenTelemetry Authors
// SPDX-License-Identifier: Apache-2.0

package tls

import (
	"crypto/tls"
	"testing"

	"github.com/stretchr/testify/require"

	"go.opentelemetry.io/contrib/otelconf/internal/testtls"
)

func TestCreateConfig(t *testing.T) {
	material := testtls.Write(t)

	tests := []struct {
		name            string
		caCertFile      *string
		clientCertFile  *string
		clientKeyFile   *string
		wantErrContains string
		want            func(*tls.Config, *testing.T)
	}{
		{
			name: "no-input",
			want: func(result *tls.Config, t *testing.T) {
				require.Nil(t, result.Certificates)
				require.Nil(t, result.RootCAs)
			},
		},
		{
			name:       "only-cacert-provided",
			caCertFile: ptr(material.CACertPath),
			want: func(result *tls.Config, t *testing.T) {
				require.Nil(t, result.Certificates)
				require.NotNil(t, result.RootCAs)
			},
		},
		{
			name:            "nonexistent-cacert-file",
			caCertFile:      ptr("nowhere.crt"),
			wantErrContains: "open nowhere.crt:",
		},
		{
			name:            "nonexistent-clientcert-file",
			clientCertFile:  ptr("nowhere.crt"),
			clientKeyFile:   ptr("nowhere.crt"),
			wantErrContains: "could not use client certificate: open nowhere.crt:",
		},
		{
			name:            "clientkey-without-clientcert",
			clientKeyFile:   ptr("nowhere.key"),
			wantErrContains: "client key was provided but no client certificate was provided",
		},
		{
			name:            "bad-cacert-file",
			caCertFile:      ptr(material.BadCertPath),
			wantErrContains: "could not create certificate authority chain from certificate",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got, err := CreateConfig(tt.caCertFile, tt.clientCertFile, tt.clientKeyFile)

			if tt.wantErrContains != "" {
				require.Contains(t, err.Error(), tt.wantErrContains)
			} else {
				require.NoError(t, err)
				tt.want(got, t)
			}
		})
	}
}

func ptr[T any](v T) *T {
	return &v
}
