using DodoSSH.Crypto;

namespace DodoSSH.Crypto.Tests;

/// <summary>
/// Pins the specification constants that are written into stored data.
/// </summary>
/// <remarks>
/// These are not busywork. The envelope magic and AAD version are persisted in every
/// ciphertext row, and only clients can re-encrypt: if one of these changes without a
/// deliberate migration path, existing vaults stop decrypting and the server cannot help.
/// </remarks>
public sealed class CryptoSpecTests
{
    [Fact]
    public void EnvelopeMagic_IsStable()
    {
        CryptoSpec.EnvelopeMagic.ShouldBe("DSH1");
    }

    [Fact]
    public void CurrentAadVersion_IsStable()
    {
        // Bumping this requires a lazy re-encrypt-on-write path in the client first.
        CryptoSpec.CurrentAadVersion.ShouldBe((short)1);
    }

    [Theory]
    [InlineData(CryptoSpec.AlgorithmId.XChaCha20Poly1305, 1)]
    [InlineData(CryptoSpec.AlgorithmId.Aes256Gcm, 2)]
    [InlineData(CryptoSpec.AlgorithmId.SealToX25519, 3)]
    public void AlgorithmId_HasStableWireValue(CryptoSpec.AlgorithmId algorithm, int expected)
    {
        ((int)algorithm).ShouldBe(expected);
    }

    [Fact]
    public void AlgorithmId_4_IsReservedForHybridPostQuantumSeal()
    {
        // Reserved for X25519 + ML-KEM-768. Claimed now so the identifier cannot be
        // reused: store-now-decrypt-later is a real threat for long-lived SSH keys.
        // AlgorithmId is byte-backed, matching the single alg_id byte in the envelope.
        Enum.IsDefined(typeof(CryptoSpec.AlgorithmId), (byte)4).ShouldBeFalse();
    }
}