// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#include "testing/pem.h"

#include <string>

#include "absl/status/status.h"
#include "absl/status/status_macros.h"  // IWYU pragma: keep
#include "absl/status/status_matchers.h"
#include "absl/strings/string_view.h"
#include "gmock/gmock.h"
#include "gtest/gtest.h"
#include "tink/signature/signature_pem_keyset_reader.h"

namespace credentio {
namespace {

using ::absl_testing::IsOk;
using ::absl_testing::StatusIs;
using ::crypto::tink::PemAlgorithm;
using ::crypto::tink::PemKeyType;
using ::google::crypto::tink::HashType;
using ::testing::HasSubstr;

constexpr absl::string_view kPemKeyP224 = R"(-----BEGIN PRIVATE KEY-----
MHgCAQAwEAYHKoZIzj0CAQYFK4EEACEEYTBfAgEBBBxaHY9SBldD/sUFJQyS4bOU
2Hf8wXBCEzfEdZ6DoTwDOgAEF3QCwJRkgQxaYZ0cqZTb0FAYQ2alOv3lWlmlNLS1
80rBbqgzt26PS8ysBhJy8zpTdmkKxdv2SpQ=
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyP256 = R"(-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgYUrTw5gDocgm/uqt
9Y0uHuYZ+qUORlv4tsVvsC+RafyhRANCAARhNXddv5HV8eddKtCGlJ2rFUjyDZWK
iVqaBIXOc3nsxuyQuprla45ifAN/nO9vsAWP6OjOVYcgS/MLvjpQHOrm
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyP384 = R"(-----BEGIN PRIVATE KEY-----
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDcgueympOc5A87sQYu
QQqtX50rK0OMz9aowmNXDnEXm4U62eevBJVSUATFyxkZ0qChZANiAASe9I/03xH0
SB3lclDxJpnHk8tsq1aqZbBl0G5giE3h/KpRd1303+spJAv1UZZhbduuWzycEo1s
EtjDR7qk4+cSrE2ii9ltavHCQJQUsfYkmcesZJh9KpHi8LIhyY50e40=
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyP521 = R"(-----BEGIN PRIVATE KEY-----
MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAr8855XdpHWs9YBRm
oiy+QZeG5KB14Kl2Rr4DRLgt3258xfm8fuDRHluuJEHZQibrn86u50KkMNVT1qgD
zlqLkwChgYkDgYYABAG/tAXbStwpjnpW6Mla6JboL4VPNfAM+YlgtwTj63j5TN0N
n6krb6JG1yM3fxzEf0BL58wbV/quMxozEQfGxtmyzQEYlJmaWOaXangUvVuY3QAf
v9PLp4egCYvH2iooca4rv64wEhVErXSF8Zre976ITX5p4LUX4Q3DECdnbom2yU2q
qQ==
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyEd25519 = R"(-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIKdWv26hzGxk0up0J6859Q+ELEu/FBMg/PAn7dlxACK8
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyRsa1024 = R"(-----BEGIN PRIVATE KEY-----
MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALFa2Jbkosxnt8JT
bry40Mk0kUY/VdFI4Y2RzyzwT6Zx8xY4BqAF8fpjmYjwqezvnA3VwgLDso0TuyVE
OLWcF3rdrxnHSLnuao4CrizKgJJyVOJRpkBtwpGoz4tMzl2lyLv7TI0wL5t5oH8A
7iggeJC0ElTOITVBwcpAlvsZ9pbzAgMBAAECgYABK6DPSh367FpNmYBbFXsnQMYO
qR9XXLxEU2iDGujjp8/bXy5IAxIIPX0HZtMwQZqNitIXc5QrkyxCgDNBm5CaF6bR
CVJW/TlJ4W+l1g5cG5SnahNfVBlEDf0hlIkf3sFZ5XwL77tq7Ft6JQ7caqWTgaw7
plfL1GpAywUuuStCkQJBAOggRSVjxeLWAPaX3J/PuqxrtjgyjtkkEK8upoz41k+5
24SCSbBtDcMBLfR2GrcpVKWi/S5rMONVXc9giVQqa0MCQQDDmHxbPBNg8k53zCne
N/8rkGOaUWt05XEjiz+CJ5BJM3w7og+Ky+6fmM3rnVuJ3mKtz+2goX55AqUagz+M
ZHKRAkACrmS+EtH1Vc17C7QDsI2SckgPjB30SiNbMqm/1Rv8ncP4WtzpCclv6DKU
sUyLsxGEPEa6Y4iUB6dmvtG3RCorAkALfw7wHdvVuug5ylo7oXbyDI6OJ3L1b/by
a+DTuZeVdd07dA8NzWa9IrIXwyv6MoQCS1JgOp3AZxNlN4moqs7BAkBdYa/HFdWv
rbAP9L4Sm0BdSH3ZC6Vvn/u3uXAe7teLoAE4lZsbePmOBAGZW2vmlMEK3cnLk/mt
nBJ6QgwSnpno
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyRsa2048 = R"(-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC4KLDzI35zPSEW
Tbt2ZdmlKbvghqmJHWchoiptOPzfkCGdn4gzX5VZZHS+knS5fY/iI6a+o1qXdPkp
40/p+yPyyQHbFpfid+wiRgCClZHYtPik6XI8OgVunBGQGBF9EACgEwqIB1Hw4yop
VS9EZigeEXHM7GGuwhG/BpAsRMBbdxKjwtnR0iz8KDeb0Mz6UNi90CtxkBS3wqBv
en6/nQZYJ2WfNt+uArQw8x8uSnuBHqhjTbOi4BLbi+OgfPRfXR0u6kWQWYOqu43D
Kbv3s1N0mjqITFavoYvNLRe6krbbA7s08H1OZ0vZXIdy00loYqwcUNLWzSY1P3pj
D5+OjifnAgMBAAECggEAJmCoe4rei7JmBkldsy9He4Fme0Rk6UOc3ef3EnrpS8e0
Ea6Qyi/1pkLmh15q/8rYZMaMNbdCJkUEtcN+wGKLW8mi3t7m+RWHup6+9XepBLG2
DVvu5/kpb6MLj+1MG7Vtg+5j5/QqkdotS57KcmUdoCJ/hjaOpsYfv6DlA6yyL30W
iepLSeEJrwmIeSVZZ2U21jfBPfl8bWR21KhSpu2H6uCbbn3mLNJR2Vd0RFvuNxYe
HvbaGgRqmhnrv9XzW31UrF4yfVVMeRoeerzjiFHSUzLCAq002L8C9udeyVNqab6U
6kSwBVAKpowmhQ7yWkzPN9kmAlsOuhxSX0xr1gTZMQKBgQDwOlH26CaVkHuUknVu
Le3PmHSG8zVCTGBXeovje+c9OYPXC4KbtcbdRGCtMUTkglCHuZ381N1K7uXC7eJ4
OaCFMrN+ChQnWcoN3QqXGDuzFwPjoIESVHbiZ2X5VkwpYlQ4qnV2JvqghmKu87Wz
wDBfLmwE0/gTCMy+s2Cra9isMQKBgQDEP/tT6zXng3TwI0YynRCQ3+FuO+SE7tIj
JbOoyKaFdF2KkFe9mN9QiLJkkiqW8rpGBMZT6/bBF394b1EujBYYNgriCadP/mHo
U3M8NKTfViwfAHnlzS5vSrk5w5iJHqgrJgcu0R/pf0qJ3qfhrd96gyz7dNylYp5E
XgcfzS9HlwKBgQCbEQpXlwNRCDK9dMzYkk0v8/lEIzn90c9eqHwkG5bornesGIH2
gSAdNEYzhdoypuvUsLyKt90gwZUOfv/xG0HCuTej5F2eCRekW0q6vanLsM+R38lx
S5RyEMyCZnJDRHWZHm80FXUyqYyJ4kcoAKc4yX5wn2NC5itD7gY4oST8AQKBgGvk
OQoz39i93sY+vlMJIphjXQ47gzDKE2EbUyBR36qzBNIu9O3ZY7xkyp6b9Sozm9Du
wxJUQb56aqwNlvYeMe9xlp4abI9/7NfLOSk6UAIw3+TTYDDEkujAjgCB1hRcdFv0
djJ46jB2uMX/URCzhI9YGpzL7JpIE3bGsuf66ClVAoGAfIfimDz5JdUyqDNN3Sqi
MUBPmZywDxymF9gl6iSB2scenRYmFz9b0mGrs1+45lPDKxlTmd4E/YrTwDh1VSCs
cQLS9rLBwTyXY+j17DUfYfRUczaF0aZrrpjcT9jkF0AKVTBRaw3+jtd3GV6OtopW
uPwS26qT7r9KF5Df73qDGkI=
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyRsa3072 = R"(-----BEGIN PRIVATE KEY-----
MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCIlb4z+JN2A114
bbXyS0R/EtvnmQUtf0nfU2aGB2Ej3SJfNIIAAMophWHeI3tqRYntboU+jKn31/JO
O17NhGBbzc4F5T8wQ6JbIxf3XJGqQLbTQiSjpdRQife6gt3fXrgCqUdYpCz+HAAB
0RbjS0as04sveDrTDZ4EwjZHFYsc/fk4cR6jKYk98hqe39fNeQjkA4/MlDOR7yBa
IomPXh7QlnjEHNfsXWW5pQQTyyY6wOSqCdzMTd7sk6R5Vr/iGtVENxypdtTpA3ld
qC2zNolb/0+5eAw96nGpXuvUFGTnFChSpG3NQ/0GvBz5KcrC+/s6ImOkRF052leK
FYxxGacS8VeJ0O0xvQwKBjH6Z0KS+OR2vZOeOMSWbea/EP6SGzr7Ntlwjx9oyZG7
Wf7EUpSSbknF36j+cn2YBPl8MWEjQZQ7OQnfcryWNzri4/kbkpgk4mwgB7MkgTI4
qO6FoJsMz55F++U88uq0MDz7Qec8WKinryhEQUZCxnSa4MQznI8CAwEAAQKCAYAf
/Ron5975c75Pdzp2vcQUEuGn80GwLzCo+kp3t4C7uo3TSGPuBkFSyidqtFqyQAkW
r5zLUnx4TH42blc8wPUkayYGYXOUJTMAL07soySGgFORVNtp7Gu2VSnM59t49iEY
lnbcPs8+0GX8BvFaWIX78iuV+Y2lYnoQ2T+HFHeZWa4l1vB6/D5lYK91aC2NtPwt
Etx56HfPhPbJxW78QenrpmIwZCT5+cHaYdh7nkec2RJ09Ixe2RoNxGJv/K5CEVBr
64m8p9PZ57c0P+n96ovxYpiyXj6jhmxLAktjoA+giiq6C+mtdMQLaDrSR6XLjG8L
F6aYxjGHCCQdzEbDuBKfraovXJeQNNBh19tu93N8VINh2ANQXwJHSpktCvefjTDy
vxt5xSOnbhYVD1bBPDyd1i2rRl25VmHjHHFkk7d9NvTecXCbdZlfyFA+BUKjc8zN
j6AyyJFo8+SIXl707/d3mB86JKDeJfvD5iaBzlXwr5CsHthRUZ4lrrMVt978Y8EC
gcEAu6ew8PA+jjOVO7ddFsUCueL1XQ0btx/lqOiQ+1mnjns6iisvSQIvSGHMir7o
h1c0MEbDM2/iJbk8rU8O3o6yz65oqLNt2mH8xKKEqBslBeUqZeiVVXB85PXZ0Pvt
ZCuCEDjDO3OWvccDL/n3AAy0ELwlBJCHSmiBOVCtH0GV3Z2Gp7Jf1ZwHtJwMDc9z
T7JV6pABq7kgWQIorBF9S2Q9a4gMNFoGdp+bgGR5bPIPXYytv1/60chOTFmswFF1
ST8vAoHBALpUc3CU2xM30FGn/faMjDA4XyX6zyPJMu5KHdZrmG0h1tAm20GNSGDl
4IJkAslO1uQei+b8GqfkAjqnF4yob6wD1xhgC9ylFhChhEdCDPnnrvOr0+5P6paV
x9pqc1MMpsGHUI0gg4E8AY7FQYPggcET+MymZOgGQ0MyHQMalxo8U82hEMwKfxYd
m/i7DC5Fwq4yoWMIIuw7Nsb346d/qD2huLEuq73sAOXxDO0EAoRj6pFSWxgCQlgd
Nf4JM1MgoQKBwQCXtt7GHOXmX+viSL/5HbSzhruqzGNA7YfmxIgavoRKHHTaqklj
dGG32mHdNrWWXjlyYnOEzYr/xsA4ufcilioY4D/7TH2fFqOecmpf4vpOxtU9aQn6
9qPzFJVScaue1dIkvU+SbEROEG0SR7ybjKmz8fjXtOW8kbsQFJqy73pzntz0DbGP
aMOOEK9qJvNqVptBtcW0CUsOy0EIxGcRIezKWEbNuI8LLsUwy4qkOxuTHZ6HX9jP
7GrpLYMORY1Wd78CgcEAmMUHBSY23HHljh2jftLLWfnOIVCbJucep/sCrbv39HpL
KszA9eUFk9TGF4IyOqU2UUCuSgsnO8IZBcfb6gprzOg1IhoVf6mnBqm2z8na48bO
TaDzGTBS0XYqruyac1wrGP99zsf6qintyQX36k1XdVuPoRNIJmiEG4LqAJJ7kxol
R7IoGHL+sb5DFFMf8IxnyvVeFtkj8PW3urih4cIryaRfzn3Kd+QY9G6Hv4iLG8rk
FpQkdfHcPWxtyUP33c8hAoHAbS7AWBzBcjj2t4fDdT4WlNl9i0BWRkGRMaRzEZx3
E/S4aCbLw+HMf+mE2YrTAdEqWw2ax8UBXScb3pgpYoNYsQQ6+2FQJNQF/ijHQP4l
sAsuTISiAHYwhZoDG67uwpsdmVNhXJOp2Et+1xDuzVek1iaW+mtjJhwj208C9Lmj
YDghz5pVeMk3WBJFGiXQn1QhjZzTVog6rSoLj0kEgT9whx9C65ZxbEc1GKSAYun/
dVMvgoGxsF6YKmXFRRLcNcRS
-----END PRIVATE KEY-----)";

constexpr absl::string_view kPemKeyRsa4096 = R"(-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQC2NVmEcVNKJcLB
K9A/JNzQDqIJoxbWmF1gi6QK9bD208oE5PzGeCp/MCpr1rlE+WNfMfnEHUkWB7R2
Hp+ZsHlXYpfpgXQFNCa6cxj2R2D4eZrot9neoaqq4TWKQpqLc+rL7uSqY3lLspKl
F7I11vHP1JFOh+PTtmSrFq46fALZBzl08VznEk4nq3XXr+H0T4++KukXg+yifCrU
/kZjtm99ibGvxqi+bADGTvgjfa9eissC5U3Um/Dpwbgjw09hEQ1KMi8mhL2EC0K8
5mN43Un+M8DkFU/kTJofkUH42FSJPrjlMjaLtU47TgIYmSvqJNj4V157Bl4gDmWW
1BOc4sZE1qC4WmKxk7exooSC0XwQnEFcMkHhvJjuemTKh3qPWuu8J3wu7+wR+Dmf
QRO+9zk3cbjkTaDNNkCtYrVQrQiVZ8tcmrmOxac7dKEKpQTzCutjv7bmqR2XYSTR
nUyJXSEFgsufaHB5YPBbPoupO5YbBPmf4iJthvbgwm+KX8sfECLkbDMaVjs2ftpE
m3m+uStsFSX2IWKmkq8dZPtjqZRz1G3FukTzqeSxvqE1En6EpwjU06T2u5bRXC/b
eURu6AxnIToOkPKTELqRNX2Y9Dovbqh2oPYSd0QW/IL4liaOHL9bZ+t1PVXP3OlS
jKxfelege/2GdFgIkwoSL7BYhpwSsQIDAQABAoICAAeB4LeWhMBCGIllgP3NCsUO
yUnc3KDIY9aJwl9KOrmcxc7YUXrq8hNN/H13eig3n0rJkBkuvLdp51tTjS9jqEg7
sXcnRIy/VpYpjl59V+c8+W87vgAQiKvkPhS9hEkZJFQ1Oloz4YhHKggf1xGlUs7F
mxwReMddFT5AX7rcp7Bh/hHNrQ5/QFWdmKwjnMt4aLuE4Jg9sQcL1ybx+Bv9JRBW
10mfBY5c/FYvZEVwFQTv8ofiw0duimlTOD9O+YsODQ5gzXUIlJdncF9AndoZwgX1
g23SW/mT12jUDxQN88O44BzfagRtGrVSVD9Htlm+HWt0DBpFC6VF+pURlWJKLLGR
Gd7GrYf+2S0Lxbg7XAJBT4z8Zd5iaKttmW4zguTUYW/Wf8B+kvZ2hb+S+qQ/5yhv
HHJ9kZjXN6XQLGH4ML20GoXk/TkL7B+fUlhFIbixKI0i/8n4OBo8lTycMtMQyflL
+vYYC/ly4fLuN9PjfT/9DxmEl5fokw6eNq0aT01ijOJ2pFzg6aBcEnFUwKAY5Moi
jQ1/7ab7C0f6w3fOh+Dz9PV3Q1yq4G17MvtbpriWMdTlzjtlKiIK0B6EO5BDBvuz
gGHgWBFCTi2lYX6vygiHZxxdOFPQCRlvNWrUbrqcH0L+g6mXdwFaAq7zWHu50W0T
BDPKflh/02rwnvdjsM59AoIBAQDdJICtBjj9lxbohJToMtue9GE2bjjs/mlfBOld
Z/CjkjG1qAp3mxJ0SS0sBoU54DF4Cu34THL/TzzdomK9Gd21+Ed5zrC5yHCaVSRY
PbJFsQo5KujFso5zYt2ZieDvYzUyYHiocOz4LQ80skOzEQ/ti0B8ebYT4B9C9oTH
zBp+AvyRswBodRosHxbddWaOVweiPdYJzKe6CRWQP5ceeIEqAhiUKM7P1kOZhlQN
0wISoMkE4/jlUgc4IQ1hp62gJ7OYVnrsKCvoEe3Wsdk0PBqcUfKgtjDLKDlCK9KC
p4kQtVIQoOKFNDT1C2Npy2x1KS0B2NRsPVMXdmRgX1lxDUx9AoIBAQDS7ch3FE6l
bBqNv120K/jgNrJR2nVsaFv7ptA5KV1kfNvprb8jikf46OxQJIzDBWt8sGTUB4td
jdG2hTpwU8p1Dlw1UDYtsy1opp7LcKQFILleo/sLHH4FM3D/tq/0exX6KwIPLbIb
sf0q74wi/jUh5hr58ub6l/tgBEMNlp4xuo6FHs38nEyPhURVwhbYGTH0v+AZj/vj
gLLPN1MY05zJelrcIVFE/RINdFKzppTQbSgqUv9dGprimkfoiJXmAbC3N65nq3Z1
Vs0slS6HEHedlr6/1ZnSg33x0OZVVVkzleNYUb6gR0Kv7ZSwQ7Tq2742o5BtlMvL
FGBrtTSWW1lFAoIBACKahqQMeDh+PvBtZpua8bDCzr9kqfWzratXqmiaThZaVvr0
64ZhtpaJqM7dylUPFs6Q70HOPKRkssJ/mXG7rWy/B/gwdojrq2sK7Z/9L3smQ9JE
O55L3WyCyOgwogjzfix+2gKJgRsoedumFV/cyKBEDPgtV2dux5WD260j6/VR5FGs
L+EoicrjpoFK0JxvU9t4T5jC9G/w4fXrbWswMg3vvAbbB9mPzo4kbdyn6wgdLrdc
MOM5XbXTvjNMuKd57ulkhuGTO6OZwpy4waMh0IwraorpV2NCzQrkrpERRCpgJRJD
Co8LZ0n82TaBxVvj8I38bujtA6aFORm3cdh120UCggEAcm0eoEL6+1CvAxC6o8Br
Di9+A1uw8fOXWui+8xOWn6oAnz9rfrtImia59Cwv1Kh/DDChMkk5eLIz/4E9F6zN
Gz2EFkQCcD5QtwIVCSZ9RG7hQQ9SZE+7qdSjS4Xu5IFVhdaJEnTmt5GSVxWG/4DK
kC5Fmi0E0xNaAletjJSWE0IyiNMSSiT8f6t7S860F91rNWxWBWgP7PZninRn9wLt
fnuLCPpmHTfw8C2Xo/ANsRhWfsdx0y9YsO+jbOmT8CgglvR0/7aL19IUEkiH6iur
yGj76BPXk9VToLiEC+z2LD73C3WlJUwjSE9pp0nDvtkg0oFfG6Np/yx5tlSiR6Mc
xQKCAQAJn4pRIayA2JIOob4OblB7rPijcKdvbYgeCx6op/v2mXOdziPzRrOVUvYZ
WStKzZzYxwat0DjCc96xThMVSaBGl8m16l6lFl2wDJI6ir7nLq+uQcMHrSi24zuS
6gIjbZCoOGqeQXAbAGsFVsme0GdVZGt96sooTOycy8JQ3x7JkQdv1VASQdothWHS
sRPe6OLdCHZBpB9glp4TLXZ1/U4JEQhueiiTxRLAOSITpAKt1kgRmJnjX1tSOq2k
D0478tD3di3bxvGxzM/I5XHRiIikPzsemA4nGDhkSqumceRtdJPCiH68puUiBorf
C4Yc1VEuRRkvHG4duH9NL6soWRHT
-----END PRIVATE KEY-----)";

TEST(LoadTestKeyFromPemTest, FailsOnInvalidPem) {
  EXPECT_THAT(
      LoadTestKeyFromPem("not pem data", {.key_type = PemKeyType::PEM_EC,
                                          .algorithm = PemAlgorithm::ECDSA_IEEE,
                                          .key_size_in_bits = 256,
                                          .hash_type = HashType::SHA256}),
      StatusIs(absl::StatusCode::kInvalidArgument));
}

TEST(LoadTestKeyFromPemTest, FailsOnP224) {
  // P224 is not supported by Tink.
  EXPECT_THAT(
      LoadTestKeyFromPem(kPemKeyP224, {.key_type = PemKeyType::PEM_EC,
                                       .algorithm = PemAlgorithm::ECDSA_IEEE,
                                       .key_size_in_bits = 224,
                                       .hash_type = HashType::SHA256}),
      StatusIs(absl::StatusCode::kInvalidArgument));
}

TEST(LoadTestKeyFromPemTest, P256) {
  auto signer =
      LoadTestKeyFromPem(kPemKeyP256, {.key_type = PemKeyType::PEM_EC,
                                       .algorithm = PemAlgorithm::ECDSA_IEEE,
                                       .key_size_in_bits = 256,
                                       .hash_type = HashType::SHA256});
  ABSL_ASSERT_OK(signer);
  EXPECT_THAT((*signer)->Sign("data to sign"), IsOk());
}

TEST(LoadTestKeyFromPemTest, P384) {
  auto signer =
      LoadTestKeyFromPem(kPemKeyP384, {.key_type = PemKeyType::PEM_EC,
                                       .algorithm = PemAlgorithm::ECDSA_IEEE,
                                       .key_size_in_bits = 384,
                                       .hash_type = HashType::SHA384});
  ABSL_ASSERT_OK(signer);
  EXPECT_THAT((*signer)->Sign("data to sign"), IsOk());
}

TEST(LoadTestKeyFromPemTest, P521) {
  auto signer =
      LoadTestKeyFromPem(kPemKeyP521, {.key_type = PemKeyType::PEM_EC,
                                       .algorithm = PemAlgorithm::ECDSA_IEEE,
                                       .key_size_in_bits = 521,
                                       .hash_type = HashType::SHA512});
  ABSL_ASSERT_OK(signer);
  EXPECT_THAT((*signer)->Sign("data to sign"), IsOk());
}

TEST(LoadTestKeyFromPemTest, FailsOnRSA1024) {
  // RSA1024 not supported by Tink.
  EXPECT_THAT(LoadTestKeyFromPem(kPemKeyRsa1024,
                                 {
                                     .key_type = PemKeyType::PEM_RSA,
                                     .algorithm = PemAlgorithm::RSASSA_PSS,
                                     .key_size_in_bits = 1024,
                                     .hash_type = HashType::SHA256,
                                 }),
              StatusIs(absl::StatusCode::kInvalidArgument));
}

TEST(LoadTestKeyFromPemTest, RSA2048) {
  auto signer = LoadTestKeyFromPem(kPemKeyRsa2048,
                                   {
                                       .key_type = PemKeyType::PEM_RSA,
                                       .algorithm = PemAlgorithm::RSASSA_PSS,
                                       .key_size_in_bits = 2048,
                                       .hash_type = HashType::SHA256,
                                   });
  ABSL_ASSERT_OK(signer);
  EXPECT_THAT((*signer)->Sign("data to sign"), IsOk());
}

TEST(LoadTestKeyFromPemTest, RSA3072) {
  auto signer = LoadTestKeyFromPem(kPemKeyRsa3072,
                                   {
                                       .key_type = PemKeyType::PEM_RSA,
                                       .algorithm = PemAlgorithm::RSASSA_PSS,
                                       .key_size_in_bits = 3072,
                                       .hash_type = HashType::SHA256,
                                   });
  ABSL_ASSERT_OK(signer);
  EXPECT_THAT((*signer)->Sign("data to sign"), IsOk());
}

TEST(LoadTestKeyFromPemTest, RSA4096) {
  auto signer = LoadTestKeyFromPem(kPemKeyRsa4096,
                                   {
                                       .key_type = PemKeyType::PEM_RSA,
                                       .algorithm = PemAlgorithm::RSASSA_PSS,
                                       .key_size_in_bits = 4096,
                                       .hash_type = HashType::SHA256,
                                   });
  ABSL_ASSERT_OK(signer);
  EXPECT_THAT((*signer)->Sign("data to sign"), IsOk());
}

TEST(LoadTestKeyFromPemTest, WrongKeySize_Fails) {
  EXPECT_THAT(LoadTestKeyFromPem(kPemKeyRsa4096,
                                 {
                                     .key_type = PemKeyType::PEM_RSA,
                                     .algorithm = PemAlgorithm::RSASSA_PSS,
                                     .key_size_in_bits = 3072,
                                     .hash_type = HashType::SHA256,
                                 }),
              StatusIs(absl::StatusCode::kInvalidArgument));
}

TEST(LoadOcspResponseFromPemTest, FailsOnInvalidPem) {
  EXPECT_THAT(LoadOcspResponseFromPem("not pem data"),
              StatusIs(absl::StatusCode::kInvalidArgument));
}

TEST(LoadOcspResponseFromPemTest, Succeeds) {
  constexpr absl::string_view kPemOcsp = R"(-----BEGIN OCSP RESPONSE-----
ZmFrZSBvY3NwIHJlc3BvbnNl
-----END OCSP RESPONSE-----)";
  auto der = LoadOcspResponseFromPem(kPemOcsp);
  ABSL_ASSERT_OK(der);
  EXPECT_EQ(*der, "fake ocsp response");
}

TEST(LoadOcspResponseFromPemTest, FailsOnMultipleBlocks) {
  constexpr absl::string_view kPemOcspMultiple =
      R"(-----BEGIN OCSP RESPONSE-----
ZmFrZSBvY3NwIHJlc3BvbnNlIDE=
-----END OCSP RESPONSE-----
-----BEGIN OCSP RESPONSE-----
ZmFrZSBvY3NwIHJlc3BvbnNlIDI=
-----END OCSP RESPONSE-----)";
  EXPECT_THAT(LoadOcspResponseFromPem(kPemOcspMultiple),
              StatusIs(absl::StatusCode::kInvalidArgument,
                       HasSubstr("Multiple OCSP RESPONSE blocks found")));
}

}  // namespace
}  // namespace credentio