puressh 0.2.2

use super::*;

fn trim_leading_zeros(b: &[u8]) -> &[u8] {
    let mut i = 0;
    while i < b.len() && b[i] == 0 {
        i += 1;
    }
    &b[i..]
}

// Generated with:
//   ssh-keygen -t ed25519 -f /tmp/k -N "" -C "test@puressh"
const ED25519_PUB_LINE: &str =
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILlxF+s0ktFl1xHsUrt7F0Z0wRAWTiAD1wnH+b5NKoSI test@puressh";

const ED25519_PEM_UNENCRYPTED: &str = "-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACC5cRfrNJLRZdcR7FK7exdGdMEQFk4gA9cJx/m+TSqEiAAAAJAkzSrIJM0q
yAAAAAtzc2gtZWQyNTUxOQAAACC5cRfrNJLRZdcR7FK7exdGdMEQFk4gA9cJx/m+TSqEiA
AAAEBVcog7R273wnkgguPcJpFC6gHsOZ5UKX/tvSh8D1ifa7lxF+s0ktFl1xHsUrt7F0Z0
wRAWTiAD1wnH+b5NKoSIAAAADHRlc3RAcHVyZXNzaAE=
-----END OPENSSH PRIVATE KEY-----
";

// Generated with:
//   ssh-keygen -t ed25519 -f /tmp/k_enc -N "secret123" -C "encrypted@puressh" -a 16
const ED25519_PEM_ENCRYPTED: &str = "-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCmejsun4
79mcsCr4laGrbLAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAINVyomq59MFud+Ra
S/SLBR4tkpasJEJNgQTo4ulQxZBRAAAAoPDTnnisOJrALbSVB2woz+E8pP7xy29z5aY84a
bj3/L8ZPCgICAbv8m7m8qsCxu2g2ObLl7Qn4tEMONia+/hrB4dKKsWbFbpdidGABK2N7Ba
tP2kFwhS0ODzclNDY3jEZmcXiBJUL5Z9DcQF/IS4kBqMaW70xs4ClLd8Ggl0vRnAXehL/x
j+T0eEOle+/gVye0ZXtvgoNvRrUdZbNryH9p8=
-----END OPENSSH PRIVATE KEY-----
";

const ED25519_PEM_ENC_PUB: &str = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINVyomq59MFud+RaS/SLBR4tkpasJEJNgQTo4ulQxZBR encrypted@puressh";

const RSA_PUB_LINE: &str = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDD/7KO4oupLNNoKTzuRocimPgb47nlbGy7DBpbPTuKWWakkSAWfIhQ/a4e1Zye6YafK+UKz3lv1kTH/XkPI1K3KZTBJRQeHABmT+O513/rzqABWR0/gRLC7CfI3IyAxZn8VcEukV2+UoSQ1huuFQxVCH8AjDxCVDYftXjTidD+IQBHUNuXvKWpLDrFD7305VgHkfzPPFHAtZ+9w2JypRe6GCdXT0F6bqBfjBYOGHkNAWXl5/nC042GITRE98FNBlnWt9S1oSTS85Ri/0cPvk/DmDIZoWH+fz2fQGMYW4D2TuaMLZSc70WTZF7cw6ROjTfLKyNuO1AlX/DIiO1z0tJ/ rsa@puressh";

const RSA_PEM_UNENCRYPTED: &str = "-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAw/+yjuKLqSzTaCk87kaHIpj4G+O55WxsuwwaWz07illmpJEgFnyI
UP2uHtWcnumGnyvlCs95b9ZEx/15DyNStymUwSUUHhwAZk/judd/686gAVkdP4ESwuwnyN
yMgMWZ/FXBLpFdvlKEkNYbrhUMVQh/AIw8QlQ2H7V404nQ/iEAR1Dbl7ylqSw6xQ+99OVY
B5H8zzxRwLWfvcNicqUXuhgnV09Bem6gX4wWDhh5DQFl5ef5wtONhiE0RPfBTQZZ1rfUta
Ek0vOUYv9HD75Pw5gyGaFh/n89n0BjGFuA9k7mjC2UnO9Fk2Re3MOkTo03yysjbjtQJV/w
yIjtc9LSfwAAA8Bg8yzGYPMsxgAAAAdzc2gtcnNhAAABAQDD/7KO4oupLNNoKTzuRocimP
gb47nlbGy7DBpbPTuKWWakkSAWfIhQ/a4e1Zye6YafK+UKz3lv1kTH/XkPI1K3KZTBJRQe
HABmT+O513/rzqABWR0/gRLC7CfI3IyAxZn8VcEukV2+UoSQ1huuFQxVCH8AjDxCVDYftX
jTidD+IQBHUNuXvKWpLDrFD7305VgHkfzPPFHAtZ+9w2JypRe6GCdXT0F6bqBfjBYOGHkN
AWXl5/nC042GITRE98FNBlnWt9S1oSTS85Ri/0cPvk/DmDIZoWH+fz2fQGMYW4D2TuaMLZ
Sc70WTZF7cw6ROjTfLKyNuO1AlX/DIiO1z0tJ/AAAAAwEAAQAAAP82yJcgPKQiM4HHYqL6
oZ+V0yv4LefH/9u5weEqSiwhYxSi6woNBhdM/dQfPAenf9d2bUBCqNe6atRdEgqLhf61M5
TSZ8OpimMD/Rep9ssgAb2bFKLfVhghRzZJYD+sojmEwDqUV9SGs2121X48f6WddFC2D2Ad
1MFMG6Yb7Gmanj0fcUsht1WA0fId0hrbIF23yy6e9IcXSHOMMQi2b4/wOHEtDLC7EJhcJb
Au10bjpU1za2WRpY1Ixb4M3GJ6Dmvp/28vRjpTOo2Nedlo50rKxO5jVAInvEju+4jCJioQ
wIMYvcAGQN9QfxpoivVtny+SNwL4PVDTjKzl9GHBh4EAAACALgcL6Pz77CAJH2yoR/U3Qu
jULAain7Eoz/Drn/ajEG7wED3CnZR2b1SUn5tf81yT9DlSbX4O3EYBm4pZ5Rri7APM95jo
FRtB3a2m3YCIfVNdB/jBk9mtbbSGw1jb/EtclT5DA+533/xK8Z8GhSKrwuol67qYQDM3YK
g+G17+DrYAAACBAPxkt+l7sSKKteP3YX4qsufBhxq9NPjQaLZbTbUb42AVM0ERVJx/d7Nd
JMxDfJEaBmP7JpKEirU/bVW+4V6Y9z2IbBOmpobTncRUcVaoFxf/WeXRiupB8g05TwI8+I
xERGcLAoUk3yd1HVoR/vP0WDKvfRYQ2Sz6gtXolaBl55oRAAAAgQDGzK6DIsStqdYfxpDW
A83eJatwfN3fIkUCPS2iJ1yPWVkz9ejWQ2SqsdWgEETLf5SOsIUg7KNxkRH8LUVTlRCquO
uAZ99NitHgV5gHeNX/nREtHDpqeq9kERw6CD8O9YVAcY3LiYqGOS54A6/luR++Drfkjiyk
61iG/LPjjjyTjwAAAAtyc2FAcHVyZXNzaAE=
-----END OPENSSH PRIVATE KEY-----
";

const ECDSA_P256_PUB_LINE: &str = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBL8cARH4L1jr2e/bFvNdOIcoOnEAkYez3CC0R9XPLBuU/q5uk4gD8MtRkQMS59jNX42ZDXq9DNM1MODm7iwGfO8= ecdsa@puressh";

const ECDSA_P256_PEM_UNENCRYPTED: &str = "-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQS/HAER+C9Y69nv2xbzXTiHKDpxAJGH
s9wgtEfVzywblP6ubpOIA/DLUZEDEufYzV+NmQ16vQzTNTDg5u4sBnzvAAAAqHmPW3N5j1
tzAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBL8cARH4L1jr2e/b
FvNdOIcoOnEAkYez3CC0R9XPLBuU/q5uk4gD8MtRkQMS59jNX42ZDXq9DNM1MODm7iwGfO
8AAAAhAK3hEtZjg/CUD9kdq/RntzqG10/PQWWiQxP+pRbja/uqAAAADWVjZHNhQHB1cmVz
c2gBAg==
-----END OPENSSH PRIVATE KEY-----
";

#[test]
fn parse_ed25519_authorized_keys_line() {
    let pk = PublicKey::parse_authorized_keys_line(ED25519_PUB_LINE).unwrap();
    match &pk {
        PublicKey::Ed25519 { raw, comment } => {
            assert_eq!(raw.len(), 32);
            assert_eq!(comment, "test@puressh");
        }
        _ => panic!("expected ed25519"),
    }
    assert_eq!(pk.algorithm(), "ssh-ed25519");
    assert_eq!(pk.to_authorized_keys_line(), ED25519_PUB_LINE);
}

#[test]
fn parse_rsa_authorized_keys_line() {
    let pk = PublicKey::parse_authorized_keys_line(RSA_PUB_LINE).unwrap();
    match &pk {
        PublicKey::Rsa { e, n, comment } => {
            assert_eq!(e, &[0x01, 0x00, 0x01]);
            assert!(n.len() >= 256);
            assert_eq!(comment, "rsa@puressh");
        }
        _ => panic!("expected rsa"),
    }
    assert_eq!(pk.to_authorized_keys_line(), RSA_PUB_LINE);
}

#[test]
fn parse_ecdsa_p256_authorized_keys_line() {
    let pk = PublicKey::parse_authorized_keys_line(ECDSA_P256_PUB_LINE).unwrap();
    match &pk {
        PublicKey::EcdsaP256 { point, comment } => {
            assert_eq!(point.len(), 65);
            assert_eq!(point[0], 0x04);
            assert_eq!(comment, "ecdsa@puressh");
        }
        _ => panic!("expected ecdsa-p256"),
    }
    assert_eq!(pk.to_authorized_keys_line(), ECDSA_P256_PUB_LINE);
}

#[test]
fn parse_unencrypted_ed25519_pem() {
    let sk = PrivateKey::parse_openssh_pem(ED25519_PEM_UNENCRYPTED, None).unwrap();
    match &sk {
        PrivateKey::Ed25519 {
            seed,
            public,
            comment,
        } => {
            assert_eq!(comment, "test@puressh");
            assert_eq!(seed.len(), 32);
            assert_eq!(public.len(), 32);
        }
        _ => panic!("expected ed25519"),
    }
    let derived_pub = sk.public_key();
    let pub_from_line = PublicKey::parse_authorized_keys_line(ED25519_PUB_LINE).unwrap();
    match (&derived_pub, &pub_from_line) {
        (PublicKey::Ed25519 { raw: a, .. }, PublicKey::Ed25519 { raw: b, .. }) => {
            assert_eq!(a, b);
        }
        _ => unreachable!(),
    }
}

#[test]
fn parse_unencrypted_rsa_pem() {
    let sk = PrivateKey::parse_openssh_pem(RSA_PEM_UNENCRYPTED, None).unwrap();
    match &sk {
        PrivateKey::Rsa {
            n,
            e,
            d,
            p,
            q,
            iqmp,
            comment,
        } => {
            assert_eq!(comment, "rsa@puressh");
            assert!(n.len() >= 256);
            assert_eq!(e, &[0x01, 0x00, 0x01]);
            assert!(!d.is_empty());
            assert!(!p.is_empty());
            assert!(!q.is_empty());
            assert!(!iqmp.is_empty());
        }
        _ => panic!("expected rsa"),
    }
    // Derived public key should match the .pub line.
    let derived_pub_blob = sk.public_key().wire_blob();
    let from_line = PublicKey::parse_authorized_keys_line(RSA_PUB_LINE).unwrap();
    assert_eq!(derived_pub_blob, from_line.wire_blob());
}

#[test]
fn parse_unencrypted_ecdsa_p256_pem() {
    let sk = PrivateKey::parse_openssh_pem(ECDSA_P256_PEM_UNENCRYPTED, None).unwrap();
    match &sk {
        PrivateKey::EcdsaP256 { d, point, comment } => {
            assert_eq!(comment, "ecdsa@puressh");
            assert_eq!(point.len(), 65);
            assert!(!d.is_empty());
        }
        _ => panic!("expected ecdsa-p256"),
    }
    let from_line = PublicKey::parse_authorized_keys_line(ECDSA_P256_PUB_LINE).unwrap();
    assert_eq!(sk.public_key().wire_blob(), from_line.wire_blob());
}

#[test]
fn parse_encrypted_ed25519_pem_with_passphrase() {
    let sk = PrivateKey::parse_openssh_pem(ED25519_PEM_ENCRYPTED, Some(b"secret123")).unwrap();
    match &sk {
        PrivateKey::Ed25519 { comment, .. } => {
            assert_eq!(comment, "encrypted@puressh");
        }
        _ => panic!("expected ed25519"),
    }
    let from_line = PublicKey::parse_authorized_keys_line(ED25519_PEM_ENC_PUB).unwrap();
    assert_eq!(sk.public_key().wire_blob(), from_line.wire_blob());
}

#[test]
fn encrypted_pem_wrong_passphrase_fails() {
    let err = PrivateKey::parse_openssh_pem(ED25519_PEM_ENCRYPTED, Some(b"wrong"))
        .expect_err("should reject wrong passphrase");
    match err {
        Error::Crypto(msg) => assert!(msg.contains("passphrase"), "{}", msg),
        other => panic!("unexpected error: {other:?}"),
    }
}

#[test]
fn encrypted_pem_missing_passphrase_fails() {
    let err = PrivateKey::parse_openssh_pem(ED25519_PEM_ENCRYPTED, None)
        .expect_err("should require passphrase");
    assert!(matches!(err, Error::Crypto(_)));
}

#[test]
fn rejects_bad_pem_marker() {
    let bad = "no markers here";
    assert!(PrivateKey::parse_openssh_pem(bad, None).is_err());
}

#[test]
fn authorized_keys_line_roundtrip_no_comment() {
    let pk = PublicKey::Ed25519 {
        raw: [7u8; 32],
        comment: String::new(),
    };
    let line = pk.to_authorized_keys_line();
    assert!(!line.ends_with(' '));
    let parsed = PublicKey::parse_authorized_keys_line(&line).unwrap();
    assert_eq!(parsed, pk);
}

#[test]
fn into_host_key_ed25519_signs_and_verifies() {
    let priv_key = PrivateKey::parse_openssh_pem(ED25519_PEM_UNENCRYPTED, None).unwrap();
    let hk = priv_key.into_host_key().unwrap();
    assert_eq!(hk.algorithm(), "ssh-ed25519");
    let sig = hk.sign(b"into_host_key test").unwrap();
    let verifier =
        crate::hostkey::host_key_verify_by_name("ssh-ed25519", &hk.public_blob()).unwrap();
    verifier.verify(b"into_host_key test", &sig).unwrap();
}

#[test]
fn into_host_key_ecdsa_p256_signs_and_verifies() {
    let priv_key = PrivateKey::parse_openssh_pem(ECDSA_P256_PEM_UNENCRYPTED, None).unwrap();
    let hk = priv_key.into_host_key().unwrap();
    assert_eq!(hk.algorithm(), "ecdsa-sha2-nistp256");
    let sig = hk.sign(b"ecdsa msg").unwrap();
    let verifier =
        crate::hostkey::host_key_verify_by_name("ecdsa-sha2-nistp256", &hk.public_blob()).unwrap();
    verifier.verify(b"ecdsa msg", &sig).unwrap();
}

#[test]
fn into_host_key_rsa_uses_sha512() {
    let priv_key = PrivateKey::parse_openssh_pem(RSA_PEM_UNENCRYPTED, None).unwrap();
    let hk = priv_key.into_host_key().unwrap();
    assert_eq!(hk.algorithm(), "rsa-sha2-512");
    let sig = hk.sign(b"rsa msg").unwrap();
    let verifier =
        crate::hostkey::host_key_verify_by_name("rsa-sha2-512", &hk.public_blob()).unwrap();
    verifier.verify(b"rsa msg", &sig).unwrap();
}

#[test]
fn roundtrip_unencrypted_ed25519() {
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_ed25519(&mut rng, "rt-ed25519@test".to_string());
    let pem = sk.to_openssh_pem(None).unwrap();
    let parsed = PrivateKey::parse_openssh_pem(&pem, None).unwrap();
    match (&sk, &parsed) {
        (
            PrivateKey::Ed25519 {
                seed: s1,
                public: p1,
                comment: c1,
            },
            PrivateKey::Ed25519 {
                seed: s2,
                public: p2,
                comment: c2,
            },
        ) => {
            assert_eq!(s1, s2);
            assert_eq!(p1, p2);
            assert_eq!(c1, c2);
        }
        _ => panic!("wrong variant"),
    }
}

#[test]
fn roundtrip_unencrypted_ecdsa_p256() {
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_ecdsa(
        &mut rng,
        crate::key::EcdsaCurve::P256,
        "rt-ecdsa@test".to_string(),
    );
    let pem = sk.to_openssh_pem(None).unwrap();
    let parsed = PrivateKey::parse_openssh_pem(&pem, None).unwrap();
    match (&sk, &parsed) {
        (
            PrivateKey::EcdsaP256 {
                d: d1,
                point: p1,
                comment: c1,
            },
            PrivateKey::EcdsaP256 {
                d: d2,
                point: p2,
                comment: c2,
            },
        ) => {
            assert_eq!(trim_leading_zeros(d1), trim_leading_zeros(d2));
            assert_eq!(p1, p2);
            assert_eq!(c1, c2);
        }
        _ => panic!("wrong variant"),
    }
}

#[test]
fn roundtrip_unencrypted_rsa_2048() {
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_rsa(&mut rng, 2048, "rt-rsa@test".to_string()).unwrap();
    let pem = sk.to_openssh_pem(None).unwrap();
    let parsed = PrivateKey::parse_openssh_pem(&pem, None).unwrap();
    assert_eq!(sk.public_key().wire_blob(), parsed.public_key().wire_blob());
    match (&sk, &parsed) {
        (
            PrivateKey::Rsa {
                n: n1,
                d: d1,
                p: p1,
                q: q1,
                ..
            },
            PrivateKey::Rsa {
                n: n2,
                d: d2,
                p: p2,
                q: q2,
                ..
            },
        ) => {
            assert_eq!(trim_leading_zeros(n1), trim_leading_zeros(n2));
            assert_eq!(trim_leading_zeros(d1), trim_leading_zeros(d2));
            assert_eq!(trim_leading_zeros(p1), trim_leading_zeros(p2));
            assert_eq!(trim_leading_zeros(q1), trim_leading_zeros(q2));
        }
        _ => panic!("wrong variant"),
    }
}

#[test]
fn roundtrip_encrypted_ed25519() {
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_ed25519(&mut rng, "enc-ed25519@test".to_string());
    let pem = sk.to_openssh_pem(Some(b"test-passphrase")).unwrap();
    let parsed = PrivateKey::parse_openssh_pem(&pem, Some(b"test-passphrase")).unwrap();
    assert_eq!(sk.public_key().wire_blob(), parsed.public_key().wire_blob());
    match (&sk, &parsed) {
        (PrivateKey::Ed25519 { seed: s1, .. }, PrivateKey::Ed25519 { seed: s2, .. }) => {
            assert_eq!(s1, s2)
        }
        _ => panic!("wrong variant"),
    }
}

#[test]
fn encrypted_wrong_passphrase_rejected() {
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_ed25519(&mut rng, "wp@test".to_string());
    let pem = sk.to_openssh_pem(Some(b"right")).unwrap();
    let err = PrivateKey::parse_openssh_pem(&pem, Some(b"wrong")).expect_err("should fail");
    match err {
        Error::Crypto(msg) => assert!(msg.contains("passphrase"), "{msg}"),
        other => panic!("unexpected: {other:?}"),
    }
}

#[test]
fn fingerprint_matches_openssh_cli() {
    use std::io::Write;
    use std::process::Command;
    use std::time::{Duration, Instant};

    // We need the system OpenSSH `ssh-keygen` here, not our own — they share a
    // name and on Windows CI cargo puts our test build directory on PATH, so
    // `Command::new("ssh-keygen")` would otherwise pick up our binary, which
    // doesn't understand the combined `-lf` flag. Probe `-V`: real OpenSSH
    // prints something like "OpenSSH_X.Y..." on stderr, ours prints
    // "puressh ssh-keygen <version>" on stdout. Skip the test unless the
    // OpenSSH signature is present.
    {
        let out = match Command::new("ssh-keygen").arg("-V").output() {
            Ok(o) => o,
            Err(_) => return,
        };
        let probe = format!(
            "{}{}",
            String::from_utf8_lossy(&out.stdout),
            String::from_utf8_lossy(&out.stderr)
        );
        if !probe.to_ascii_lowercase().contains("openssh") {
            return;
        }
    }

    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_ed25519(&mut rng, "fp@test".to_string());
    let pub_line = sk.public_key().to_authorized_keys_line();
    let expected = sk.public_key().sha256_fingerprint();

    let tmp_dir = std::env::temp_dir();
    let pid = std::process::id();
    let path = tmp_dir.join(format!("puressh_fp_test_{pid}.pub"));
    {
        let mut f = std::fs::File::create(&path).expect("create temp .pub");
        f.write_all(pub_line.as_bytes()).unwrap();
        f.write_all(b"\n").unwrap();
    }

    let deadline = Instant::now() + Duration::from_secs(10);
    let mut child = Command::new("ssh-keygen")
        .arg("-lf")
        .arg(&path)
        .stdout(std::process::Stdio::piped())
        .stderr(std::process::Stdio::piped())
        .spawn()
        .expect("spawn ssh-keygen");
    let mut waited = false;
    let mut guard = 0usize;
    while Instant::now() < deadline {
        guard += 1;
        if guard > 200 {
            break;
        }
        match child.try_wait().expect("try_wait") {
            Some(_) => {
                waited = true;
                break;
            }
            None => std::thread::sleep(Duration::from_millis(50)),
        }
    }
    if !waited {
        let _ = child.kill();
        let _ = std::fs::remove_file(&path);
        panic!("ssh-keygen -lf did not finish in 10s");
    }
    let out = child.wait_with_output().expect("wait_with_output");
    let _ = std::fs::remove_file(&path);
    assert!(out.status.success(), "ssh-keygen -lf failed: {out:?}");
    let s = String::from_utf8_lossy(&out.stdout);
    assert!(
        s.contains(&expected),
        "openssh fingerprint output {s:?} does not contain {expected}"
    );
}

#[test]
fn generated_key_signs_and_verifies() {
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_ed25519(&mut rng, "sv@test".to_string());
    let pub_blob = sk.public_key().wire_blob();
    let hk = sk.into_host_key().unwrap();
    let sig = hk.sign(b"chain through into_host_key").unwrap();
    let verifier = crate::hostkey::host_key_verify_by_name("ssh-ed25519", &pub_blob).unwrap();
    verifier
        .verify(b"chain through into_host_key", &sig)
        .unwrap();
}

#[test]
fn fingerprint_no_padding() {
    let pk = PublicKey::Ed25519 {
        raw: [0xab; 32],
        comment: String::new(),
    };
    let fp = pk.sha256_fingerprint();
    assert!(fp.starts_with("SHA256:"));
    assert!(!fp.ends_with('='));
}

#[test]
fn wire_blob_ed25519_matches_known_layout() {
    let pk = PublicKey::Ed25519 {
        raw: [0xab; 32],
        comment: String::new(),
    };
    let blob = pk.wire_blob();
    // string "ssh-ed25519" (4 + 11) + string raw32 (4 + 32) = 51 bytes
    assert_eq!(blob.len(), 51);
    assert_eq!(&blob[0..4], &[0, 0, 0, 11]);
    assert_eq!(&blob[4..15], b"ssh-ed25519");
    assert_eq!(&blob[15..19], &[0, 0, 0, 32]);
    assert_eq!(&blob[19..], &[0xab; 32]);
}

#[test]
fn empty_passphrase_on_encrypted_key_is_rejected_loudly() {
    // Round-tripping with a real passphrase and then trying to decrypt with
    // Some(b"") must fail with the same "passphrase required" error as None,
    // not with a wrong-passphrase / format error after bcrypt churn.
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_ed25519(&mut rng, "empty-pass@test".to_string());
    let pem = sk.to_openssh_pem(Some(b"actual-secret")).unwrap();
    let err = PrivateKey::parse_openssh_pem(&pem, Some(b"")).expect_err("empty passphrase");
    match err {
        Error::Crypto(msg) => assert!(
            msg.contains("passphrase"),
            "expected 'passphrase required', got {msg:?}"
        ),
        other => panic!("expected Crypto(passphrase required), got {other:?}"),
    }
    let err2 = PrivateKey::parse_openssh_pem(&pem, None).expect_err("None passphrase");
    match err2 {
        Error::Crypto(msg) => assert!(msg.contains("passphrase"), "{msg}"),
        other => panic!("expected Crypto for None, got {other:?}"),
    }
}

#[test]
fn bcrypt_rounds_cap_rejects_oversize_kdfoptions() {
    // Hand-build an openssh-key-v1 blob whose kdfoptions claim rounds=65.
    // Parser must refuse before running bcrypt — no need for a valid
    // ciphertext or salt; the rounds check fires first.
    use crate::format::Writer;
    const MAGIC: &[u8] = b"openssh-key-v1\0";

    let mut opts = Writer::new();
    opts.write_string(&[0u8; 16]); // salt
    opts.write_u32(10_001); // > MAX_BCRYPT_ROUNDS (10000)
    let kdfopts = opts.into_vec();

    let mut pubw = Writer::new();
    pubw.write_string(b"ssh-ed25519");
    pubw.write_string(&[0u8; 32]);
    let pub_blob = pubw.into_vec();

    let mut w = Writer::new();
    w.write_raw(MAGIC);
    w.write_string(b"aes256-ctr");
    w.write_string(b"bcrypt");
    w.write_string(&kdfopts);
    w.write_u32(1);
    w.write_string(&pub_blob);
    w.write_string(&alloc::vec![0u8; 16]);
    let pem = alloc::format!(
        "-----BEGIN OPENSSH PRIVATE KEY-----\n{}\n-----END OPENSSH PRIVATE KEY-----\n",
        base64::encode(&w.into_vec())
    );
    let err = PrivateKey::parse_openssh_pem(&pem, Some(b"anything")).expect_err("rounds cap");
    match err {
        Error::Format(msg) => assert!(
            msg.contains("rounds") || msg.contains("64"),
            "expected rounds cap message, got {msg:?}"
        ),
        other => panic!("expected Format(rounds cap), got {other:?}"),
    }
}

#[test]
fn bcrypt_zero_rounds_is_rejected() {
    use crate::format::Writer;
    const MAGIC: &[u8] = b"openssh-key-v1\0";
    let mut opts = Writer::new();
    opts.write_string(&[0u8; 16]);
    opts.write_u32(0);
    let kdfopts = opts.into_vec();
    let mut pubw = Writer::new();
    pubw.write_string(b"ssh-ed25519");
    pubw.write_string(&[0u8; 32]);
    let pub_blob = pubw.into_vec();
    let mut w = Writer::new();
    w.write_raw(MAGIC);
    w.write_string(b"aes256-ctr");
    w.write_string(b"bcrypt");
    w.write_string(&kdfopts);
    w.write_u32(1);
    w.write_string(&pub_blob);
    w.write_string(&alloc::vec![0u8; 16]);
    let pem = alloc::format!(
        "-----BEGIN OPENSSH PRIVATE KEY-----\n{}\n-----END OPENSSH PRIVATE KEY-----\n",
        base64::encode(&w.into_vec())
    );
    let err = PrivateKey::parse_openssh_pem(&pem, Some(b"x")).expect_err("zero rounds");
    match err {
        Error::Format(msg) => assert!(msg.contains("rounds"), "{msg}"),
        other => panic!("expected Format, got {other:?}"),
    }
}

#[test]
fn authorized_keys_line_with_options_is_refused() {
    // The most dangerous outcome would be to silently strip the options
    // and treat the key as a bare entry — that drops `command=`,
    // `from=`, `no-pty`, etc. and grants broader access than intended.
    let line = alloc::format!(r#"command="/bin/echo hi",no-pty {ED25519_PUB_LINE}"#);
    let err = PublicKey::parse_authorized_keys_line(&line).expect_err("must reject options prefix");
    match err {
        Error::Format(msg) => assert!(
            msg.contains("options") || msg.contains("unknown") || msg.contains("tag"),
            "expected explicit options rejection, got {msg:?}"
        ),
        other => panic!("expected Format, got {other:?}"),
    }
}

#[test]
fn authorized_keys_line_handles_tabs_and_runs_of_spaces() {
    // sshd accepts tabs between fields, and a copy/paste may collapse
    // multiple spaces — split_whitespace handles both.
    let line = alloc::format!(
        "ssh-ed25519\t{}\ttabbed comment",
        ED25519_PUB_LINE.split_whitespace().nth(1).unwrap()
    );
    let pk = PublicKey::parse_authorized_keys_line(&line).unwrap();
    assert_eq!(pk.comment(), "tabbed comment");

    let line2 = alloc::format!(
        "ssh-ed25519   {}   spaced   comment",
        ED25519_PUB_LINE.split_whitespace().nth(1).unwrap()
    );
    let pk2 = PublicKey::parse_authorized_keys_line(&line2).unwrap();
    assert_eq!(pk2.comment(), "spaced comment");
}

#[test]
fn authorized_keys_blank_and_comment_lines_are_rejected_cleanly() {
    match PublicKey::parse_authorized_keys_line("") {
        Err(Error::Format(_)) => {}
        other => panic!("blank: got {other:?}"),
    }
    match PublicKey::parse_authorized_keys_line("   \t  ") {
        Err(Error::Format(_)) => {}
        other => panic!("whitespace-only: got {other:?}"),
    }
    match PublicKey::parse_authorized_keys_line("# this is a comment") {
        Err(Error::Format(_)) => {}
        other => panic!("comment: got {other:?}"),
    }
}

#[test]
fn parse_wire_blob_rejects_off_curve_ecdsa_p256() {
    // Build an otherwise well-formed ecdsa-sha2-nistp256 public blob whose
    // SEC1 point is the right shape (0x04 || 32-byte X || 32-byte Y) but
    // whose coordinates are not on P-256. parse_wire_blob must refuse it.
    let mut w = crate::format::Writer::new();
    w.write_string(b"ecdsa-sha2-nistp256");
    w.write_string(b"nistp256");
    let mut bogus_point = alloc::vec![0u8; 65];
    bogus_point[0] = 0x04;
    for (i, b) in bogus_point.iter_mut().enumerate().skip(1) {
        *b = (i as u8).wrapping_mul(17).wrapping_add(3);
    }
    w.write_string(&bogus_point);
    let blob = w.into_vec();
    match PublicKey::parse_wire_blob(&blob) {
        Err(crate::error::Error::Format(msg)) => assert!(
            msg.contains("SEC1") || msg.contains("ecdsa"),
            "expected ecdsa SEC1 rejection, got {msg:?}"
        ),
        Err(other) => panic!("expected Format, got {other:?}"),
        Ok(_) => panic!("expected off-curve point to be rejected"),
    }
}

#[test]
fn options_parser_plain_key_no_options() {
    let (blob, opts) =
        PublicKey::parse_authorized_keys_line_with_options(ED25519_PUB_LINE).unwrap();
    assert!(!opts.cert_authority);
    assert!(opts.principals.is_empty());
    // Same blob as the plain parser yields.
    let plain = PublicKey::parse_authorized_keys_line(ED25519_PUB_LINE).unwrap();
    assert_eq!(blob, plain.wire_blob());
}

#[test]
fn options_parser_cert_authority_flag() {
    let line = format!("cert-authority {ED25519_PUB_LINE}");
    let (_blob, opts) = PublicKey::parse_authorized_keys_line_with_options(&line).unwrap();
    assert!(opts.cert_authority);
}

#[test]
fn options_parser_principals_quoted() {
    let line = format!("cert-authority,principals=\"alice,bob\" {ED25519_PUB_LINE}");
    let (_blob, opts) = PublicKey::parse_authorized_keys_line_with_options(&line).unwrap();
    assert!(opts.cert_authority);
    assert_eq!(opts.principals, vec!["alice", "bob"]);
}

#[test]
fn options_parser_rejects_unknown_option() {
    let line = format!("frobnicate=\"10.0.0.0/8\" {ED25519_PUB_LINE}");
    assert!(PublicKey::parse_authorized_keys_line_with_options(&line).is_err());
}

#[test]
fn options_parser_rejects_unquoted_principals() {
    let line = format!("principals=alice {ED25519_PUB_LINE}");
    assert!(PublicKey::parse_authorized_keys_line_with_options(&line).is_err());
}

// ---------------------------------------------------------------------------
// A6: `PrivateKey`'s Debug output must never render secret material.
// ---------------------------------------------------------------------------
#[test]
fn private_key_debug_is_redacted() {
    let sk = PrivateKey::parse_openssh_pem(RSA_PEM_UNENCRYPTED, None).unwrap();
    let PrivateKey::Rsa { d, p, q, iqmp, .. } = &sk else {
        panic!("not RSA");
    };
    let s = format!("{sk:?}");
    assert!(s.contains("ssh-rsa"), "{s}");
    assert!(s.contains("rsa@puressh"), "{s}");
    assert!(s.contains("<redacted>"), "{s}");
    for secret in [d, p, q, iqmp] {
        let rendered = format!("{:?}", trim_leading_zeros(secret));
        assert!(!s.contains(&rendered), "secret leaked into Debug: {s}");
    }
    let sk = PrivateKey::parse_openssh_pem(ED25519_PEM_UNENCRYPTED, None).unwrap();
    let PrivateKey::Ed25519 { seed, public, .. } = &sk else {
        panic!("not ed25519");
    };
    let s = format!("{sk:?}");
    assert!(!s.contains(&format!("{seed:?}")), "seed leaked: {s}");
    assert!(
        s.contains(&format!("{public:?}")),
        "public half missing: {s}"
    );
}

// ---------------------------------------------------------------------------
// A8: RSA host keys built from a key file keep the primes (base blinding on)
// and still round-trip against the verifier.
// ---------------------------------------------------------------------------
#[test]
fn rsa_host_key_with_primes_signs_and_verifies() {
    use crate::hostkey::HostKey;
    use purecrypto::bignum::BoxedUint;
    let sk = PrivateKey::parse_openssh_pem(RSA_PEM_UNENCRYPTED, None).unwrap();
    let PrivateKey::Rsa { n, e, d, p, q, .. } = &sk else {
        panic!("not RSA");
    };
    let u = |b: &[u8]| BoxedUint::from_be_bytes(trim_leading_zeros(b));
    let hk = crate::hostkey::RsaSha2_512HostKey::from_components_with_primes(
        u(n),
        u(e),
        u(d),
        u(p),
        u(q),
    )
    .unwrap();
    let sig = hk.sign(b"blinded rsa").unwrap();
    let verifier =
        crate::hostkey::host_key_verify_by_name("rsa-sha2-512", &hk.public_blob()).unwrap();
    verifier.verify(b"blinded rsa", &sig).unwrap();
    // Same key via the file path: `into_host_key` must produce signatures
    // the plain verifier accepts (and the same public blob).
    let pub_blob = sk.public_key().wire_blob();
    let hk2 = sk.into_host_key().unwrap();
    assert_eq!(hk2.public_blob(), pub_blob);
    let sig2 = hk2.sign(b"via into_host_key").unwrap();
    verifier.verify(b"via into_host_key", &sig2).unwrap();

    // Mismatched primes are refused rather than fed to the CRT path.
    let sk = PrivateKey::parse_openssh_pem(RSA_PEM_UNENCRYPTED, None).unwrap();
    let PrivateKey::Rsa { n, e, d, p, q, .. } = &sk else {
        panic!("not RSA");
    };
    let mut bad_q = q.clone();
    let last = bad_q.len() - 1;
    bad_q[last] ^= 0x02;
    assert!(
        crate::hostkey::RsaSha2_512HostKey::from_components_with_primes(
            u(n),
            u(e),
            u(d),
            u(p),
            u(&bad_q),
        )
        .is_err()
    );
}

// ---------------------------------------------------------------------------
// A12: the parser derives the public key from the secret and rejects a file
// whose (consistent) public copies don't match it.
// ---------------------------------------------------------------------------

/// Re-encode `sk` as an unencrypted openssh-key-v1 PEM with the given
/// public-key blob substituted in *both* places the file carries it (the
/// outer cleartext blob and the inner private-section public field).
fn pem_with_swapped_public(sk: &PrivateKey, evil_pub: &PublicKey) -> String {
    let inner_pub = sk.public_key().wire_blob();
    let evil_blob = evil_pub.wire_blob();
    // Build the file the writer would, then patch the public copies.
    let pem = sk.to_openssh_pem(None).unwrap();
    let body: String = pem.lines().filter(|l| !l.starts_with("-----")).collect();
    let raw = base64::decode(body.as_bytes()).unwrap();
    // Outer blob: `string public_blob` right after nkeys.
    let mut r = Reader::new(&raw[MAGIC.len()..]);
    let _cipher = r.read_string().unwrap();
    let _kdf = r.read_string().unwrap();
    let _opts = r.read_string().unwrap();
    let _nkeys = r.read_u32().unwrap();
    let outer = r.read_string().unwrap().to_vec();
    assert_eq!(outer, inner_pub);
    let priv_section = r.read_string().unwrap().to_vec();
    // Patch the inner section: it contains the public field verbatim.
    let inner_field: Vec<u8> = match sk {
        PrivateKey::Ed25519 { public, .. } => public.to_vec(),
        PrivateKey::EcdsaP256 { point, .. }
        | PrivateKey::EcdsaP384 { point, .. }
        | PrivateKey::EcdsaP521 { point, .. } => point.clone(),
        PrivateKey::MlDsa44Ed25519 { public, .. } => public.clone(),
        PrivateKey::Rsa { .. } => panic!("RSA handled separately"),
    };
    let evil_field: Vec<u8> = match evil_pub {
        PublicKey::Ed25519 { raw, .. } => raw.to_vec(),
        PublicKey::EcdsaP256 { point, .. }
        | PublicKey::EcdsaP384 { point, .. }
        | PublicKey::EcdsaP521 { point, .. } => point.clone(),
        PublicKey::MlDsa44Ed25519 { raw, .. } => raw.clone(),
        PublicKey::Rsa { .. } => panic!("RSA handled separately"),
    };
    assert_eq!(inner_field.len(), evil_field.len());
    let pos = priv_section
        .windows(inner_field.len())
        .position(|w| w == inner_field.as_slice())
        .expect("inner public field present");
    let mut patched = priv_section.clone();
    patched[pos..pos + inner_field.len()].copy_from_slice(&evil_field);
    // For ed25519 the 64-byte secret field repeats the public key too.
    if matches!(sk, PrivateKey::Ed25519 { .. }) {
        let pos2 = pos
            + inner_field.len()
            + priv_section[pos + inner_field.len()..]
                .windows(inner_field.len())
                .position(|w| w == inner_field.as_slice())
                .expect("public repeated in secret field");
        patched[pos2..pos2 + inner_field.len()].copy_from_slice(&evil_field);
    }

    let mut w = Writer::new();
    w.write_raw(MAGIC);
    w.write_string(b"none");
    w.write_string(b"none");
    w.write_string(b"");
    w.write_u32(1);
    w.write_string(&evil_blob);
    w.write_string(&patched);
    let b64 = base64::encode(&w.into_vec());
    format!("-----BEGIN OPENSSH PRIVATE KEY-----\n{b64}\n-----END OPENSSH PRIVATE KEY-----\n")
}

#[test]
fn parse_rejects_public_key_not_derived_from_secret() {
    let mut rng = purecrypto::rng::OsRng;
    // ed25519: swap in another key's public half (consistently, in both
    // places) — only derivation from the seed can catch this.
    let sk = PrivateKey::generate_ed25519(&mut rng, "victim".to_string());
    let other = PrivateKey::generate_ed25519(&mut rng, "other".to_string()).public_key();
    let pem = pem_with_swapped_public(&sk, &other);
    let err = PrivateKey::parse_openssh_pem(&pem, None).unwrap_err();
    assert!(
        matches!(err, Error::Format(m) if m.contains("does not match")),
        "got {err:?}"
    );
    // ECDSA P-256 likewise.
    let sk = PrivateKey::generate_ecdsa(&mut rng, EcdsaCurve::P256, "victim".to_string());
    let other =
        PrivateKey::generate_ecdsa(&mut rng, EcdsaCurve::P256, "other".to_string()).public_key();
    let pem = pem_with_swapped_public(&sk, &other);
    let err = PrivateKey::parse_openssh_pem(&pem, None).unwrap_err();
    assert!(
        matches!(err, Error::Format(m) if m.contains("does not match")),
        "got {err:?}"
    );
    // The ML-DSA composite likewise.
    let sk = PrivateKey::generate_mldsa44_ed25519(&mut rng, "victim".to_string());
    let other = PrivateKey::generate_mldsa44_ed25519(&mut rng, "other".to_string()).public_key();
    let pem = pem_with_swapped_public(&sk, &other);
    let err = PrivateKey::parse_openssh_pem(&pem, None).unwrap_err();
    assert!(
        matches!(err, Error::Format(m) if m.contains("does not match")),
        "got {err:?}"
    );
    // The untouched keys still parse.
    PrivateKey::parse_openssh_pem(&sk.to_openssh_pem(None).unwrap(), None).unwrap();
}

#[test]
fn mldsa44_ed25519_key_roundtrip_and_signatures() {
    let mut rng = purecrypto::rng::OsRng;
    let sk = PrivateKey::generate_mldsa44_ed25519(&mut rng, "pq".to_string());
    let pem = sk.to_openssh_pem(None).unwrap();
    let back = PrivateKey::parse_openssh_pem(&pem, None).unwrap();
    assert_eq!(back.public_key(), sk.public_key());
    let line = sk.public_key().to_authorized_keys_line();
    assert!(line.starts_with("ssh-mldsa44-ed25519@openssh.com "));
    let pk = PublicKey::parse_authorized_keys_line(&line).unwrap();
    assert_eq!(pk.comment(), "pq");
    let signer = back.into_host_key().unwrap();
    let sig = signer.sign(b"data").unwrap();
    crate::hostkey::verify_signature(
        "ssh-mldsa44-ed25519@openssh.com",
        &pk.wire_blob(),
        b"data",
        &sig,
    )
    .unwrap();
}

#[test]
fn parse_rejects_rsa_with_inconsistent_private_components() {
    // Corrupt `d` (keeping n, e, p, q intact): the file's public copies
    // still agree with each other, so only the e*d ≡ 1 check catches it.
    let sk = PrivateKey::parse_openssh_pem(RSA_PEM_UNENCRYPTED, None).unwrap();
    let PrivateKey::Rsa {
        n,
        e,
        d,
        p,
        q,
        iqmp,
        comment,
    } = sk
    else {
        panic!("not RSA");
    };
    let mut bad_d = d.clone();
    let last = bad_d.len() - 1;
    bad_d[last] ^= 0x01;
    let bad = PrivateKey::Rsa {
        n: n.clone(),
        e: e.clone(),
        d: bad_d,
        p: p.clone(),
        q: q.clone(),
        iqmp: iqmp.clone(),
        comment: comment.clone(),
    };
    assert!(bad.check_consistency().is_err());
    let pem = bad.to_openssh_pem(None).unwrap();
    assert!(matches!(
        PrivateKey::parse_openssh_pem(&pem, None),
        Err(Error::Format(_))
    ));
    // Corrupt `q`: p * q != n.
    let mut bad_q = q.clone();
    let last = bad_q.len() - 1;
    bad_q[last] ^= 0x02;
    let bad = PrivateKey::Rsa {
        n,
        e,
        d,
        p,
        q: bad_q,
        iqmp,
        comment,
    };
    assert!(bad.check_consistency().is_err());
    let pem = bad.to_openssh_pem(None).unwrap();
    assert!(matches!(
        PrivateKey::parse_openssh_pem(&pem, None),
        Err(Error::Format(_))
    ));
}

#[test]
fn authorized_keys_options_full_set() {
    let key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDqLCQkO+7NDJTeuHvKqEGRpz+o1cEdQqN8hHRPPSVt c";
    let line = format!(
        "restrict,pty,command=\"borg serve --restrict-to-path \\\"/b k\\\"\",from=\"10.0.0.0/8,!10.1.2.3\",\
         permitopen=\"db:5432\",permitopen=\"*:80\",expiry-time=\"20300101\",No-X11-Forwarding {key}"
    );
    let (_blob, o) = PublicKey::parse_authorized_keys_line_with_options(&line).unwrap();
    assert_eq!(
        o.command.as_deref(),
        Some("borg serve --restrict-to-path \"/b k\"")
    );
    assert_eq!(o.from.as_deref(), Some("10.0.0.0/8,!10.1.2.3"));
    assert_eq!(
        o.permit_open,
        vec!["db:5432".to_string(), "*:80".to_string()]
    );
    assert_eq!(o.expiry_time.as_deref(), Some("20300101"));
    assert!(o.restrict && o.allows_pty());
    assert!(!o.allows_port_forwarding() && !o.allows_agent_forwarding());
    assert!(!o.allows_x11_forwarding());
    assert!(!o.is_unrestricted());

    let (_, plain) = PublicKey::parse_authorized_keys_line_with_options(key).unwrap();
    assert!(plain.is_unrestricted());

    for bad in [
        format!("bogus-option {key}"),
        format!("command=unquoted {key}"),
        format!("no-pty=\"x\" {key}"),
        format!("command=\"open {key}"),
    ] {
        assert!(
            PublicKey::parse_authorized_keys_line_with_options(&bad).is_err(),
            "{bad}"
        );
    }
}

#[test]
fn encrypted_pem_and_pkcs8_roundtrip() {
    let mut rng = purecrypto::rng::OsRng;
    let pass = b"correct horse";
    let ed = PrivateKey::generate_ed25519(&mut rng, String::new());
    let ec = PrivateKey::generate_ecdsa(&mut rng, EcdsaCurve::P256, String::new());
    assert!(ed.to_traditional_pem_encrypted(&mut rng, pass).is_err());
    let cases = [
        (&ed, ed.to_pkcs8_pem_encrypted(&mut rng, pass).unwrap()),
        (&ec, ec.to_pkcs8_pem_encrypted(&mut rng, pass).unwrap()),
        (
            &ec,
            ec.to_traditional_pem_encrypted(&mut rng, pass).unwrap(),
        ),
    ];
    for (key, pem) in &cases {
        let back = PrivateKey::parse_pem(pem, Some(pass)).unwrap();
        assert_eq!(back.public_key().wire_blob(), key.public_key().wire_blob());
        assert!(matches!(
            PrivateKey::parse_pem(pem, Some(b"wrong")),
            Err(Error::Crypto(_))
        ));
    }
}