package main

import (
	"strings"
	"testing"
)

func TestSSHFingerprints(t *testing.T) {
	// A real, valid ed25519 public key (freshly generated for this test,
	// not used anywhere real).
	const validKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO+a8ua6dKn3LQLzMacuGeN8v7cH4HiuICxhULf5Xdxr test@example"

	fps := sshFingerprints([]string{validKey, "not a valid key", validKey})

	if len(fps) != 2 {
		t.Fatalf("expected 2 fingerprints (invalid key skipped), got %d: %+v", len(fps), fps)
	}
	for _, fp := range fps {
		if !strings.HasPrefix(fp, "SHA256:") {
			t.Errorf("expected fingerprint to start with %q, got %q", "SHA256:", fp)
		}
		if strings.Contains(fp, "AAAAC3NzaC1lZDI1NTE5") {
			t.Errorf("fingerprint must never contain the raw key material, got %q", fp)
		}
	}
	if fps[0] != fps[1] {
		t.Errorf("the same key should always produce the same fingerprint, got %q and %q", fps[0], fps[1])
	}
}

func TestSSHFingerprintsEmpty(t *testing.T) {
	if fps := sshFingerprints(nil); len(fps) != 0 {
		t.Errorf("expected no fingerprints for no keys, got %+v", fps)
	}
}