// Real-world conformance: drives CBOR-Web-Token (RFC 8392) and COSE
// (RFC 8152) sample structures. These are the canonical CBOR payloads
// used by IoT auth, OAuth 2.0 PoP, and EAT (RFC 9711). They exercise
// canonical encoding, signed/MAC/COSE_Sign1 structures, and standard
// claim-set integer keys.
module main

import encoding.cbor
import encoding.hex

fn h_(s string) []u8 {
    return hex.decode(s) or { panic('bad hex ${s}') }
}

fn b_eq(a []u8, b []u8) bool {
    if a.len != b.len {
        return false
    }
    for i in 0 .. a.len {
        if a[i] != b[i] {
            return false
        }
    }
    return true
}

// --------------------------------------------------------------------
// RFC 8392 §A.1 — Example CWT Claims Set
//
//   {
//     1: "coap://as.example.com",  // iss
//     2: "erikw",                   // sub
//     3: "coap://light.example.com",// aud
//     4: 1444064944,                // exp
//     5: 1443944944,                // nbf
//     6: 1443944944,                // iat
//     7: h'0b71'                    // cti
//   }
const a1_claims_hex = 'a70175636f61703a2f2f61732e6578616d706c652e636f6d02656572696b77' +
    '037818636f61703a2f2f6c696768742e6578616d706c652e636f6d041a5612ae' +
    'b0051a5610d9f0061a5610d9f007420b71'

fn test_rfc8392_a1_cwt_claims_set() {
    v := cbor.decode[cbor.Value](h_(a1_claims_hex), cbor.DecodeOpts{}) or {
        panic('decode CWT claims: ${err}')
    }
    if v !is cbor.Map {
        assert false, 'CWT claim set must decode to a Map'
        return
    }
    m := v as cbor.Map
    assert m.pairs.len == 7

    // Helper: find pair by integer key.
    mut by_key := map[u64]cbor.Value{}
    for pair in m.pairs {
        key := pair.key
        if key !is cbor.IntNum {
            assert false, 'CWT claim key must be an integer (got ${key.type_name()})'
            return
        }
        k := key as cbor.IntNum
        assert !k.negative
        by_key[k.magnitude] = pair.value
    }

    // iss / sub / aud / exp / nbf / iat / cti
    iss := by_key[1] or {
        assert false, 'missing iss'
        return
    }
    assert (iss as cbor.Text).value == 'coap://as.example.com'
    sub := by_key[2] or {
        assert false, 'missing sub'
        return
    }
    assert (sub as cbor.Text).value == 'erikw'
    aud := by_key[3] or {
        assert false, 'missing aud'
        return
    }
    assert (aud as cbor.Text).value == 'coap://light.example.com'
    exp := by_key[4] or {
        assert false, 'missing exp'
        return
    }
    exp_int := exp as cbor.IntNum
    assert !exp_int.negative && exp_int.magnitude == 1444064944
    nbf := by_key[5] or {
        assert false, 'missing nbf'
        return
    }
    nbf_int := nbf as cbor.IntNum
    assert !nbf_int.negative && nbf_int.magnitude == 1443944944
    iat := by_key[6] or {
        assert false, 'missing iat'
        return
    }
    iat_int := iat as cbor.IntNum
    assert !iat_int.negative && iat_int.magnitude == 1443944944
    cti := by_key[7] or {
        assert false, 'missing cti'
        return
    }
    cti_bs := cti as cbor.Bytes
    assert b_eq(cti_bs.data, [u8(0x0b), 0x71])

    // Re-encode through the Value tree: must be byte-identical (RFC 8392
    // claim sets are already in canonical form per §7).
    out := cbor.encode_value(v, cbor.EncodeOpts{})!
    assert b_eq(out, h_(a1_claims_hex)), 'CWT round-trip mismatch'
}

// --------------------------------------------------------------------
// RFC 8392 §A.3 — COSE_Mac0-tagged CWT (tag 17 = CBOR_Tag_COSE_Mac0)
// The outer is `61(...)` = tag 61 (CWT) wrapping a COSE_Mac0 (tag 17).
// We don't validate the MAC — only the CBOR structure parses cleanly,
// the protected header is a bstr, the claim payload is a bstr containing
// the §A.1 claims, and the tag is correctly identified.
// Tag 61 (CWT) → tag 17 (COSE_Mac0) → [protected={1:5}, {}, payload, mac_tag]
// Constructed from §A.1 claims + §A.3 example MAC.
const a3_mac_hex = 'd83d' + // CWT tag
 'd1' + // COSE_Mac0 tag
 '84' + // array(4)
 '43a10105' + // bstr(3): {1:5} (HMAC 256/64)
 'a0' + // {}
 '5850' + a1_claims_hex + // bstr(80): claims
 '48093101ef6d789200' // bstr(8): MAC

fn test_rfc8392_a3_cose_mac0_cwt() {
    v := cbor.decode[cbor.Value](h_(a3_mac_hex), cbor.DecodeOpts{}) or {
        panic('decode CWT-Mac0: ${err}')
    }
    // Outer is tag 61 (CWT).
    if v !is cbor.Tag {
        assert false, 'expected tag 61'
        return
    }
    cwt_tag := v as cbor.Tag
    assert cwt_tag.number == 61, 'outer tag = ${cwt_tag.number}, want 61'

    // Inner is tag 17 (COSE_Mac0).
    inner := cwt_tag.content()
    if inner !is cbor.Tag {
        assert false, 'expected tag 17 inside CWT'
        return
    }
    mac0 := inner as cbor.Tag
    assert mac0.number == 17, 'inner tag = ${mac0.number}, want 17'

    // COSE_Mac0 = [protected, unprotected, payload, tag]
    body := mac0.content()
    if body !is cbor.Array {
        assert false, 'COSE_Mac0 must be array'
        return
    }
    arr := body as cbor.Array
    assert arr.elements.len == 4, 'COSE_Mac0 must have 4 elements, got ${arr.elements.len}'

    // protected is a bstr wrapping a CBOR-encoded map.
    protected_bs := arr.elements[0] as cbor.Bytes
    protected_map := cbor.decode[cbor.Value](protected_bs.data, cbor.DecodeOpts{}) or {
        panic('decode protected header: ${err}')
    }
    assert protected_map is cbor.Map

    // unprotected is an empty map.
    assert arr.elements[1] is cbor.Map
    assert (arr.elements[1] as cbor.Map).pairs.len == 0

    // payload is a bstr that decodes to the §A.1 claims set.
    payload_bs := arr.elements[2] as cbor.Bytes
    claims := cbor.decode[cbor.Value](payload_bs.data, cbor.DecodeOpts{}) or {
        panic('decode payload: ${err}')
    }
    assert claims is cbor.Map
    claims_map := claims as cbor.Map
    assert claims_map.pairs.len == 7, 'expected 7 claims, got ${claims_map.pairs.len}'

    // Round-trip: re-encode the entire structure and compare bytes.
    out := cbor.encode_value(v, cbor.EncodeOpts{})!
    assert b_eq(out, h_(a3_mac_hex)), 'CWT-Mac0 round-trip mismatch'
}

// --------------------------------------------------------------------
// RFC 8152 §C.2.1 — COSE_Sign1 single-signer ECDSA example
// 18([h'a201260300', {}, h'546869732069732074686520636f6e74656e742e',
//     h'6520bbaf2081d7e0ed0f95f76eb0733d667005f7467cec4b87b9381a6ba1ed' +
//       'e8e00df29f32a37230f39a842a54821fdd223092819d7728efb9d3a0080b75'])
//
// The fully-encoded form is published in the working group test
// vectors. We encode it from its components to validate that the
// pieces round-trip — that's the meaningful interop check (the actual
// signature isn't verified).
fn test_cose_sign1_structure() {
    mut p := cbor.new_packer(cbor.EncodeOpts{})
    p.pack_tag(18) // COSE_Sign1
    p.pack_array_header(4)
    // protected (bstr containing {1: -7})  −7 = ECDSA w/ SHA-256
    p.pack_bytes(h_('a10126'))
    // unprotected (empty map)
    p.pack_map_header(0)
    // payload
    p.pack_bytes('This is the content.'.bytes())
    // signature (truncated example)
    p.pack_bytes(h_('8eb33e4ca31d1c465ab05aac34cc6b23d58fef5c083106c4d25a91aef0b0117e2af9a291aa32e14ab834dc56ed2a223444547e01f11d3b0916e5a4c345cacb36'))

    out := p.bytes()

    // Decode back and validate the COSE_Sign1 shape.
    v := cbor.decode[cbor.Value](out, cbor.DecodeOpts{}) or { panic('decode Sign1: ${err}') }
    tag := v as cbor.Tag
    assert tag.number == 18, 'tag = ${tag.number}, want 18 (COSE_Sign1)'

    body := tag.content() as cbor.Array
    assert body.elements.len == 4

    protected := body.elements[0] as cbor.Bytes
    hdr := cbor.decode[cbor.Value](protected.data, cbor.DecodeOpts{}) or {
        panic('decode protected: ${err}')
    }
    hdr_map := hdr as cbor.Map
    assert hdr_map.pairs.len == 1
    // alg label = 1, value = -7
    alg_key := hdr_map.pairs[0].key as cbor.IntNum
    assert !alg_key.negative && alg_key.magnitude == 1
    alg_val := hdr_map.pairs[0].value as cbor.IntNum
    assert alg_val.negative && alg_val.magnitude == 6 // -7 = -1 - 6

    payload := body.elements[2] as cbor.Bytes
    assert payload.data.bytestr() == 'This is the content.'

    // Roundtrip the whole thing through Value tree.
    rt := cbor.encode_value(v, cbor.EncodeOpts{})!
    assert b_eq(rt, out), 'COSE_Sign1 round-trip mismatch'
}

// --------------------------------------------------------------------
// RFC 8152 §3 — Sig_structure used as Signature Input
// Sig_structure = [context, body_protected, external_aad, payload]
// This covers canonical encoding requirements (§4.4): when computing
// the to-be-signed bytes, the structure MUST be deterministically encoded.
fn test_sig_structure_canonical() {
    mut p := cbor.new_packer(cbor.EncodeOpts{ canonical: true })
    p.pack_array_header(4)
    p.pack_text('Signature1')
    p.pack_bytes(h_('a10126'))
    p.pack_bytes([]u8{}) // external_aad
    p.pack_bytes('payload bytes'.bytes())
    encoded := p.bytes()

    // Re-encode in canonical mode through the Value tree must be identical.
    v := cbor.decode[cbor.Value](encoded, cbor.DecodeOpts{}) or { panic(err) }
    mut p2 := cbor.new_packer(cbor.EncodeOpts{ canonical: true })
    p2.pack_value(v)!
    rt := p2.bytes()
    assert b_eq(rt, encoded), 'Sig_structure canonical round-trip differs'
}