// file: crates/common/game-realtime-webtransport-lib/unit_tests/webtransport.rs
// version: 2

#[test]
fn certificate_hash_preserves_exact_sha256_bytes() {
    let bytes = [7_u8; super::CERTIFICATE_HASH_SIZE];
    let hash = super::WebTransportCertificateHash::from_sha256(bytes);
    assert_eq!(hash.as_bytes(), &bytes);
}

#[test]
fn client_config_accepts_https_and_rejects_non_secure_schemes() {
    let hash = super::WebTransportCertificateHash::from_sha256([1_u8; super::CERTIFICATE_HASH_SIZE]);
    let secure = super::WebTransportClientConfig::new("https://127.0.0.1:4433/game", hash.clone());
    assert!(secure.is_ok());
    let insecure_http = super::WebTransportClientConfig::new("http://127.0.0.1:4433/game", hash.clone());
    match insecure_http {
        Ok(_) => panic!("HTTP endpoint unexpectedly accepted"),
        Err(error) => assert_eq!(error.kind(), game_realtime_transport_lib::TransportErrorKind::InvalidConfiguration),
    }
    let websocket = super::WebTransportClientConfig::new("ws://127.0.0.1:4433/game", hash);
    match websocket {
        Ok(_) => panic!("WebSocket endpoint unexpectedly accepted"),
        Err(error) => assert_eq!(error.kind(), game_realtime_transport_lib::TransportErrorKind::InvalidConfiguration),
    }
}

#[test]
fn frame_header_is_big_endian_and_payload_bound_is_enforced() {
    let header = match super::frame_header(0x00_01_02_03) {
        Ok(value) => value,
        Err(error) => panic!("valid frame header rejected: {error}"),
    };
    assert_eq!(header, [0x00, 0x01, 0x02, 0x03]);
    let oversized = super::frame_header(super::PRIMARY_FRAME_MAX_PAYLOAD_SIZE + 1);
    match oversized {
        Ok(_) => panic!("oversized WebTransport frame unexpectedly accepted"),
        Err(error) => assert_eq!(error.kind(), game_realtime_transport_lib::TransportErrorKind::MessageTooLarge),
    }
}

#[test]
fn generated_loopback_identity_has_sha256_fingerprint() {
    let identity = match super::WebTransportServerIdentity::generate_loopback() {
        Ok(value) => value,
        Err(error) => panic!("loopback identity generation failed: {error}"),
    };
    assert_eq!(identity.certificate_hash().as_bytes().len(), super::CERTIFICATE_HASH_SIZE);
}

#[test]
fn injected_identity_rejects_empty_certificate_or_key() {
    let missing_certificate = super::WebTransportServerIdentity::from_pkcs8_der(Vec::new(), vec![1]);
    match missing_certificate {
        Ok(_) => panic!("empty certificate unexpectedly accepted"),
        Err(error) => assert_eq!(error.kind(), game_realtime_transport_lib::TransportErrorKind::InvalidConfiguration),
    }
    let missing_key = super::WebTransportServerIdentity::from_pkcs8_der(vec![1], Vec::new());
    match missing_key {
        Ok(_) => panic!("empty private key unexpectedly accepted"),
        Err(error) => assert_eq!(error.kind(), game_realtime_transport_lib::TransportErrorKind::InvalidConfiguration),
    }
}