package blobgen_test

import (
	"bytes"
	"io"
	"testing"

	"filippo.io/age"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"sneak.berlin/go/vaultik/internal/blobgen"
)

// TestMultipleRecipients verifies that data written for several recipients can
// be read back by each recipient's identity. Moved from internal/crypto, which
// held the only multi-recipient test; blobgen is now the sole encryption path.
func TestMultipleRecipients(t *testing.T) {
	t.Parallel()

	identities := make([]*age.X25519Identity, 3)
	recipients := make([]string, 3)

	for i := range identities {
		identity, err := age.GenerateX25519Identity()
		require.NoError(t, err)

		identities[i] = identity
		recipients[i] = identity.Recipient().String()
	}

	plaintext := []byte("Secret message for multiple recipients")

	var encrypted bytes.Buffer

	writer, err := blobgen.NewWriter(&encrypted, 3, recipients)
	require.NoError(t, err)
	_, err = writer.Write(plaintext)
	require.NoError(t, err)
	require.NoError(t, writer.Close())

	// Every recipient's identity must recover the original plaintext.
	for i, identity := range identities {
		reader, err := blobgen.NewReader(
			bytes.NewReader(encrypted.Bytes()), identity)
		require.NoError(t, err, "recipient %d should open the reader", i+1)

		got, err := io.ReadAll(reader)
		require.NoError(t, err, "recipient %d should read the plaintext", i+1)
		require.NoError(t, reader.Close())

		assert.Equal(t, plaintext, got,
			"recipient %d should recover the original plaintext", i+1)
	}
}