import com.zzc.core.util.EncryptionUtil;
import com.zzc.core.util.RsaUtils;
import com.zzc.core.util.RuntimeSecrets;
import cn.hutool.crypto.asymmetric.KeyType;
import cn.hutool.crypto.asymmetric.RSA;
import cn.hutool.crypto.SecureUtil;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

/** Offline checks; the caller supplies test keys in a private temporary file. */
public class SecretsCheck {
    private static void check(boolean result, String message) {
        if (!result) throw new AssertionError(message);
    }

    public static void main(String[] args) {
        if (args.length > 0 && args[0].equals("config")) {
            check(args[1].equals(RuntimeSecrets.required("SYLY_CONFIG_TEST")), "Configuration source/precedence");
            System.out.println("Private-file/environment configuration checks passed");
            return;
        }
        if (args.length > 0 && args[0].equals("missing")) {
            try {
                RuntimeSecrets.required("SYLY_MISSING_TEST_SECRET");
                throw new AssertionError("Missing secrets must fail");
            } catch (IllegalStateException expected) {
                check(!expected.getMessage().contains("test-secret-value"), "Value leaked");
            }
            check(RuntimeSecrets.optional("SYLY_MISSING_TEST_SECRET").isEmpty(), "Optional default");
            System.out.println("Missing-secret checks passed");
            return;
        }
        String plain = "offline-check-中文-2026";
        String encrypted = EncryptionUtil.encrypt(plain);
        check(!plain.equals(encrypted), "AES must encrypt");
        check(plain.equals(EncryptionUtil.decrypt(encrypted)), "AES round trip");
        String raw = SecureUtil.aes(Base64.getDecoder().decode(RuntimeSecrets.required("SYLY_AES_KEY"))).encryptBase64(plain);
        check(encrypted.substring(8).equals(raw), "AES format changed");
        check(plain.equals(EncryptionUtil.decrypt(raw)), "Legacy ciphertext without prefix");
        check(EncryptionUtil.encrypt(null) == null, "Null input");
        check("".equals(EncryptionUtil.decrypt("")), "Empty input");
        check(plain.equals(EncryptionUtil.decrypt(plain)), "Plaintext compatibility");
        String rsaCipher = RsaUtils.getInstance().encrypt(plain);
        check(plain.equals(RsaUtils.decrypt(rsaCipher)), "RSA round trip with retained public key");
        RSA independent = new RSA(RuntimeSecrets.required("SYLY_RSA_PRIVATE_KEY"), RsaUtils.getPublicKey());
        check(plain.equals(new String(independent.decrypt(Base64.getDecoder().decode(rsaCipher), KeyType.PrivateKey), StandardCharsets.UTF_8)), "RSA compatibility");
        System.out.println("AES/RSA offline compatibility checks passed");
    }
}