package runtimeidentity

import (
	"context"
	"crypto/ed25519"
	"errors"
	"fmt"
	"slices"
	"sort"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"github.com/nexuscrm/backend/internal/runtimeapi"
	"github.com/nexuscrm/shared/pkg/models"
	"github.com/pingcap-inc/nexuscrm-api-host/runtimegrpc"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/delegationv1"
	semantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/identityv1"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionstatev1"
	"github.com/pingcap-inc/nexuscrm-contract/wire-go/envelope"
	runtimev1 "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1"
	"github.com/pingcap-inc/nexuscrm-contract/wire-go/mapping"
	"google.golang.org/grpc"
	"google.golang.org/grpc/metadata"
)

const (
	testIdentityCapability = "runtime.records.read-selected-root.v1"
	testIdentityWorkload   = "spiffe://runtime.test/workload"
)

type issuerFixture struct {
	now      time.Time
	private  ed25519.PrivateKey
	snapshot SigningKeySnapshot
	issuer   *Issuer
}

func issuerTestPublicSession(sessionID, principalID, connectedAppID string) PublicSession {
	return PublicSession{
		SessionID: sessionID,
		State: *issuerTestRuntimeSession(
			principalID, connectedAppID, "api", 7, 2,
		),
	}
}

func issuerTestRuntimeSession(
	principalID string,
	connectedAppID string,
	scope string,
	authEpoch uint64,
	revision uint64,
) *runtimeapi.RuntimeSessionState {
	subject := issuerTestSubject(principalID)
	return &runtimeapi.RuntimeSessionState{
		User: models.UserSession{
			ID: principalID, ProfileID: subject.ProfileID(),
			ConnectedAppId: connectedAppID, Scope: scope,
		},
		AuthEpoch: authEpoch, Subject: subject,
		PermissionFloor: issuerTestPermissionFloor(revision),
	}
}

func issuerTestSubject(principalID string) permissionstatev1.Subject {
	return issuerTestSubjectWithProfile(principalID, "profile-"+principalID)
}

func issuerTestSubjectWithProfile(
	principalID string,
	profileID string,
) permissionstatev1.Subject {
	subject, err := permissionstatev1.NewSubject(principalID, profileID)
	if err != nil {
		panic(err)
	}
	return subject
}

func issuerTestPermissionFloor(revision uint64) permissionstatev1.Version {
	lineage, err := permissionstatev1.LineageFromBytes(
		[]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
	)
	if err != nil {
		panic(err)
	}
	version, err := permissionstatev1.NewVersion(lineage, revision)
	if err != nil {
		panic(err)
	}
	return version
}

func newIssuerFixture(t *testing.T) issuerFixture {
	t.Helper()
	now := time.Date(2026, 7, 13, 20, 0, 0, 0, time.UTC)
	private := ed25519.NewKeyFromSeed(make([]byte, ed25519.SeedSize))
	snapshot := SigningKeySnapshot{Active: ActiveSigningKey{SigningKeyID: "key-current", PrivateKey: private}}
	issuer, err := NewIssuer(IssuerConfig{
		Bindings: func(ctx context.Context, caller runtimegrpc.VerifiedCaller) (runtimeapi.RuntimeCallerBinding, bool, error) {
			assertBearerFree(t, ctx)
			return runtimeapi.RuntimeCallerBinding{CallerWorkloadID: testIdentityWorkload}, caller == "workload-handle", nil
		},
		PublicSessions: func(ctx context.Context, bearer string) (PublicSession, error) {
			assertBearerFree(t, ctx)
			if bearer != "user-bearer" {
				return PublicSession{}, unauthorizedTestError{}
			}
			return issuerTestPublicSession("session-1", "user-1", "connected-app-1"), nil
		},
		SessionCapabilities: func(ctx context.Context, _ runtimeapi.RuntimeSessionState) ([]string, error) {
			assertBearerFree(t, ctx)
			return []string{testIdentityCapability}, nil
		},
		Security: func(ctx context.Context, installation, workload string) (IssuanceSecurityState, error) {
			assertBearerFree(t, ctx)
			return IssuanceSecurityState{
				StateFound: true, BindingFound: installation == "installation-1" && workload == testIdentityWorkload,
				BindingActive: true, OrgID: "org-1", RuntimeAudience: "runtime-1",
				Capabilities: []string{testIdentityCapability}, SecurityEpoch: 11,
				LeaseFound: true, LeaseSecurityEpoch: 11, LeaseExpiresAt: now.Add(time.Minute),
			}, nil
		},
		SigningKeys: func(ctx context.Context, _ time.Time) (SigningKeySnapshot, error) {
			assertBearerFree(t, ctx)
			return snapshot, nil
		},
		DelegationIDs: func() (string, error) { return "delegation-1", nil },
		Now:           func() time.Time { return now },
	})
	if err != nil {
		t.Fatal(err)
	}
	return issuerFixture{now: now, private: private, snapshot: snapshot, issuer: issuer}
}

func TestIssuerMintsP6DelegationAcceptedByExistingVerifier(t *testing.T) {
	fixture := newIssuerFixture(t)
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	response, err := invokeExchange(t, ctx, fixture.issuer, "user-bearer")
	if err != nil {
		t.Fatal(err)
	}
	if response.ExpiresAtUnixSecond-fixture.now.Unix() != int64(ProductionDelegationLifetime/time.Second) {
		t.Fatalf("expiry = %d", response.ExpiresAtUnixSecond)
	}
	verifier, err := fixture.snapshot.Verifier(fixture.now, []string{testIdentityCapability})
	if err != nil {
		t.Fatal(err)
	}
	claims, err := verifier.Verify(response.OpaqueDelegation, fixture.now, delegationv1.ExpectedBindings{
		OrgID: "org-1", CallerWorkloadID: testIdentityWorkload, AppInstallationID: "installation-1",
		RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
	})
	if err != nil {
		t.Fatal(err)
	}
	if claims.DelegationID != "delegation-1" || claims.PrincipalID != "user-1" || claims.SessionID != "session-1" ||
		claims.AuthEpoch != 7 || claims.SecurityEpoch != 11 || !slices.Equal(claims.Capabilities, []string{testIdentityCapability}) {
		t.Fatalf("claims = %#v", claims)
	}
}

func TestIssuerIntersectsBoundedAuthoritySetsLargerThanTokenLimit(t *testing.T) {
	fixture := newIssuerFixture(t)
	authorityCapabilities := []string{testIdentityCapability}
	for index := 0; index < delegationv1.MaxCapabilities; index++ {
		authorityCapabilities = append(
			authorityCapabilities,
			fmt.Sprintf("runtime.test.capability%04d.v1", index),
		)
	}
	sort.Strings(authorityCapabilities)
	fixture.issuer.sessionCapabilities = func(ctx context.Context, _ runtimeapi.RuntimeSessionState) ([]string, error) {
		assertBearerFree(t, ctx)
		return authorityCapabilities, nil
	}
	fixture.issuer.security = func(ctx context.Context, installation, workload string) (IssuanceSecurityState, error) {
		assertBearerFree(t, ctx)
		return IssuanceSecurityState{
			StateFound: true, BindingFound: installation == "installation-1" && workload == testIdentityWorkload,
			BindingActive: true, OrgID: "org-1", RuntimeAudience: "runtime-1",
			Capabilities: authorityCapabilities, SecurityEpoch: 11,
			LeaseFound: true, LeaseSecurityEpoch: 11, LeaseExpiresAt: fixture.now.Add(time.Minute),
		}, nil
	}

	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	response, err := invokeExchange(t, ctx, fixture.issuer, "user-bearer")
	if err != nil {
		t.Fatal(err)
	}
	verifier, err := fixture.snapshot.Verifier(fixture.now, authorityCapabilities)
	if err != nil {
		t.Fatal(err)
	}
	claims, err := verifier.Verify(response.OpaqueDelegation, fixture.now, delegationv1.ExpectedBindings{
		OrgID: "org-1", CallerWorkloadID: testIdentityWorkload, AppInstallationID: "installation-1",
		RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
	})
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(claims.Capabilities, []string{testIdentityCapability}) {
		t.Fatalf("delegated capabilities = %#v", claims.Capabilities)
	}
}

func TestIssuerPreservesOwnerValidLegacySessionThroughCapabilityPolicy(t *testing.T) {
	fixture := newIssuerFixture(t)
	fixture.issuer.publicSessions = func(ctx context.Context, bearer string) (PublicSession, error) {
		assertBearerFree(t, ctx)
		if bearer != "user-bearer" {
			return PublicSession{}, unauthorizedTestError{}
		}
		session := issuerTestPublicSession("session-1", "user-1", "")
		session.State = *issuerTestRuntimeSession("user-1", "", "", 7, 1)
		return session, nil
	}
	var capabilityCalls atomic.Int64
	fixture.issuer.sessionCapabilities = func(ctx context.Context, state runtimeapi.RuntimeSessionState) ([]string, error) {
		assertBearerFree(t, ctx)
		capabilityCalls.Add(1)
		if state.User.ConnectedAppId != "" || state.User.Scope != "" {
			t.Fatalf("legacy session was rewritten: %#v", state.User)
		}
		return []string{testIdentityCapability}, nil
	}
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	response, err := invokeExchange(t, ctx, fixture.issuer, "user-bearer")
	if err != nil || response.OpaqueDelegation == "" || capabilityCalls.Load() != 1 {
		t.Fatalf("legacy exchange response=%#v capability_calls=%d err=%v", response, capabilityCalls.Load(), err)
	}
}

func TestIssuerIntersectsBroadAuthorityBeforeMintingBoundedDelegation(t *testing.T) {
	fixture := newIssuerFixture(t)
	grants := []string{testIdentityCapability}
	for index := 0; index < delegationv1.MaxCapabilities; index++ {
		grants = append(grants, fmt.Sprintf("runtime.extra-%02d.v1", index))
	}
	slices.Sort(grants)
	security := fixture.issuer.security
	fixture.issuer.security = func(ctx context.Context, installation, workload string) (IssuanceSecurityState, error) {
		state, err := security(ctx, installation, workload)
		state.Capabilities = grants
		return state, err
	}
	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
	defer cancel()
	response, err := invokeExchange(t, ctx, fixture.issuer, "user-bearer")
	if err != nil {
		t.Fatalf("one requested capability from %d authority grants: %v", len(grants), err)
	}
	verifier, err := fixture.snapshot.Verifier(fixture.now, []string{testIdentityCapability})
	if err != nil {
		t.Fatal(err)
	}
	claims, err := verifier.Verify(response.OpaqueDelegation, fixture.now, delegationv1.ExpectedBindings{
		OrgID: "org-1", CallerWorkloadID: testIdentityWorkload, AppInstallationID: "installation-1",
		RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
	})
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(claims.Capabilities, []string{testIdentityCapability}) {
		t.Fatalf("delegation widened beyond the requested capability: %v", claims.Capabilities)
	}
}

func TestSessionCapabilityPolicyAcceptsBroadAuthorityWithoutExpandingDelegation(t *testing.T) {
	grants := []string{testIdentityCapability}
	for index := 0; index < delegationv1.MaxCapabilities; index++ {
		grants = append(grants, fmt.Sprintf("runtime.extra-%02d.v1", index))
	}
	slices.Sort(grants)
	policy, err := NewSessionCapabilityPolicy(map[string][]string{"api": grants})
	if err != nil {
		t.Fatal(err)
	}
	fixture := newIssuerFixture(t)
	fixture.issuer.sessionCapabilities = policy
	got, err := policy(t.Context(), *issuerTestRuntimeSession("user-1", "connected-app-1", "api", 7, 2))
	if err != nil || !slices.Equal(got, grants) {
		t.Fatalf("session grants = %v, error = %v", got, err)
	}
	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
	defer cancel()
	response, err := invokeExchange(t, ctx, fixture.issuer, "user-bearer")
	if err != nil {
		t.Fatal(err)
	}
	verifier, err := fixture.snapshot.Verifier(fixture.now, grants)
	if err != nil {
		t.Fatal(err)
	}
	claims, err := verifier.Verify(response.OpaqueDelegation, fixture.now, delegationv1.ExpectedBindings{
		OrgID: "org-1", CallerWorkloadID: testIdentityWorkload, AppInstallationID: "installation-1",
		RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
	})
	if err != nil || !slices.Equal(claims.Capabilities, []string{testIdentityCapability}) {
		t.Fatalf("delegation widened: capabilities=%v, error=%v", claims.Capabilities, err)
	}
}

func TestIssuerFailureMatrixFailsClosedBeforeSigning(t *testing.T) {
	tests := []struct {
		name       string
		mutate     func(*Issuer)
		bearer     string
		want       semantic.FailureCategory
		wantSigner int64
	}{
		{name: "missing user bearer", bearer: "", want: semantic.FailureUnauthenticated},
		{name: "malformed user bearer", bearer: "bad-user-bearer", want: semantic.FailureUnauthenticated, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				return PublicSession{}, bearerEchoError("bad-user-bearer")
			}
		}},
		{name: "revoked session", bearer: "user-bearer", want: semantic.FailureUnauthenticated, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				return PublicSession{}, unauthorizedTestError{}
			}
		}},
		{name: "inactive user", bearer: "user-bearer", want: semantic.FailureUnauthenticated, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				return PublicSession{}, unauthorizedTestError{}
			}
		}},
		{name: "disabled connected app", bearer: "user-bearer", want: semantic.FailureUnauthenticated, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				return PublicSession{}, unauthorizedTestError{}
			}
		}},
		{name: "workload binding absent", bearer: "user-bearer", want: semantic.FailureForbidden, mutate: func(issuer *Issuer) {
			issuer.bindings = func(context.Context, runtimegrpc.VerifiedCaller) (runtimeapi.RuntimeCallerBinding, bool, error) {
				return runtimeapi.RuntimeCallerBinding{}, false, nil
			}
		}},
		{name: "workload authority violates binding invariant", bearer: "user-bearer", want: semantic.FailureInternal, mutate: func(issuer *Issuer) {
			issuer.bindings = func(context.Context, runtimegrpc.VerifiedCaller) (runtimeapi.RuntimeCallerBinding, bool, error) {
				return runtimeapi.RuntimeCallerBinding{}, true, nil
			}
		}},
		{name: "public session authority violates identity invariant", bearer: "user-bearer", want: semantic.FailureInternal, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				return PublicSession{}, nil
			}
		}},
		{name: "installation absent masks cross org", bearer: "user-bearer", want: semantic.FailureForbidden, mutate: func(issuer *Issuer) {
			issuer.security = func(context.Context, string, string) (IssuanceSecurityState, error) {
				return IssuanceSecurityState{StateFound: true}, nil
			}
		}},
		{name: "capability not granted", bearer: "user-bearer", want: semantic.FailureForbidden, mutate: func(issuer *Issuer) {
			issuer.sessionCapabilities = func(context.Context, runtimeapi.RuntimeSessionState) ([]string, error) {
				return []string{"runtime.other.v1"}, nil
			}
		}},
		{name: "authority capability set violates grammar", bearer: "user-bearer", want: semantic.FailureInternal, mutate: func(issuer *Issuer) {
			issuer.sessionCapabilities = func(context.Context, runtimeapi.RuntimeSessionState) ([]string, error) {
				return []string{"NOT-A-CAPABILITY"}, nil
			}
		}},
		{name: "missing authoritative auth epoch", bearer: "user-bearer", want: semantic.FailureInternal, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				session := issuerTestPublicSession("session-1", "user-1", "connected-app-1")
				session.State.AuthEpoch = 0
				return session, nil
			}
		}},
		{name: "incoherent subject projection", bearer: "user-bearer", want: semantic.FailureUnavailable, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				session := issuerTestPublicSession("session-1", "user-1", "connected-app-1")
				session.State.Subject = issuerTestSubjectWithProfile("user-1", "profile-changed")
				return session, nil
			}
		}},
		{name: "invalid permission floor projection", bearer: "user-bearer", want: semantic.FailureUnavailable, mutate: func(issuer *Issuer) {
			issuer.publicSessions = func(context.Context, string) (PublicSession, error) {
				session := issuerTestPublicSession("session-1", "user-1", "connected-app-1")
				session.State.PermissionFloor = permissionstatev1.Version{}
				return session, nil
			}
		}},
		{name: "stale security epoch", bearer: "user-bearer", want: semantic.FailureStaleState, mutate: func(issuer *Issuer) {
			issuer.security = func(context.Context, string, string) (IssuanceSecurityState, error) {
				return IssuanceSecurityState{StateFound: true, BindingFound: true, BindingActive: true, SecurityEpoch: 11, LeaseFound: true, LeaseSecurityEpoch: 10, LeaseExpiresAt: time.Now().Add(time.Minute)}, nil
			}
		}},
		{name: "expired security lease", bearer: "user-bearer", want: semantic.FailureStaleState, mutate: func(issuer *Issuer) {
			issuer.security = func(context.Context, string, string) (IssuanceSecurityState, error) {
				return IssuanceSecurityState{StateFound: true, BindingFound: true, BindingActive: true, SecurityEpoch: 11, LeaseFound: true, LeaseSecurityEpoch: 11, LeaseExpiresAt: time.Unix(1, 0)}, nil
			}
		}},
		{name: "lease expired within current protocol second", bearer: "user-bearer", want: semantic.FailureStaleState, mutate: func(issuer *Issuer) {
			second := time.Date(2026, 7, 13, 20, 0, 0, 0, time.UTC)
			issuer.now = func() time.Time { return second.Add(900 * time.Millisecond) }
			issuer.security = func(context.Context, string, string) (IssuanceSecurityState, error) {
				return IssuanceSecurityState{
					StateFound: true, BindingFound: true, BindingActive: true,
					SecurityEpoch: 11, LeaseFound: true, LeaseSecurityEpoch: 11,
					LeaseExpiresAt: second.Add(500 * time.Millisecond),
				}, nil
			}
		}},
		{name: "security authority violates claims invariant", bearer: "user-bearer", want: semantic.FailureInternal, mutate: func(issuer *Issuer) {
			issuer.security = func(context.Context, string, string) (IssuanceSecurityState, error) {
				return IssuanceSecurityState{StateFound: true, BindingFound: true, BindingActive: true, OrgID: "", RuntimeAudience: "runtime-1", Capabilities: []string{testIdentityCapability}, SecurityEpoch: 11, LeaseFound: true, LeaseSecurityEpoch: 11, LeaseExpiresAt: time.Now().Add(time.Minute)}, nil
			}
		}},
		{name: "security owner unavailable", bearer: "user-bearer", want: semantic.FailureUnavailable, mutate: func(issuer *Issuer) {
			issuer.security = func(context.Context, string, string) (IssuanceSecurityState, error) {
				return IssuanceSecurityState{}, errors.New("authority unavailable")
			}
		}},
		{name: "signing provider unavailable", bearer: "user-bearer", want: semantic.FailureUnavailable, wantSigner: 1, mutate: func(issuer *Issuer) {
			issuer.signingKeys = func(context.Context, time.Time) (SigningKeySnapshot, error) {
				return SigningKeySnapshot{}, errors.New("provider unavailable")
			}
		}},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			fixture := newIssuerFixture(t)
			if test.mutate != nil {
				test.mutate(fixture.issuer)
			}
			var signingCalls atomic.Int64
			originalSigner := fixture.issuer.signingKeys
			fixture.issuer.signingKeys = func(ctx context.Context, now time.Time) (SigningKeySnapshot, error) {
				signingCalls.Add(1)
				return originalSigner(ctx, now)
			}
			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
			defer cancel()
			_, err := invokeExchange(t, ctx, fixture.issuer, test.bearer)
			var failure *semantic.Failure
			if !errors.As(err, &failure) {
				err = mapping.FromIdentityStatusError(err)
			}
			if !errors.As(err, &failure) || failure.Category != test.want {
				t.Fatalf("failure = %#v, err = %v; want %s", failure, err, test.want)
			}
			if signingCalls.Load() != test.wantSigner {
				t.Fatalf("signer calls = %d, want %d", signingCalls.Load(), test.wantSigner)
			}
			if strings.Contains(err.Error(), test.bearer) && test.bearer != "" {
				t.Fatalf("failure disclosed bearer: %v", err)
			}
		})
	}
}

func TestSigningKeySnapshotEnforcesPlannedAndCompromisedWindows(t *testing.T) {
	now := time.Date(2026, 7, 13, 20, 0, 0, 0, time.UTC)
	current := ed25519.NewKeyFromSeed(make([]byte, ed25519.SeedSize))
	oldSeed := make([]byte, ed25519.SeedSize)
	oldSeed[0] = 1
	old := ed25519.NewKeyFromSeed(oldSeed)
	claims := delegationv1.Claims{
		DelegationID: "delegation-old", OrgID: "org-1", PrincipalID: "user-1", SessionID: "session-1",
		CallerWorkloadID: testIdentityWorkload, AppInstallationID: "installation-1", RuntimeAudience: "runtime-1",
		Capabilities: []string{testIdentityCapability}, AuthEpoch: 1, SecurityEpoch: 1,
		IssuedAt: now.Add(-time.Second).Unix(), ExpiresAt: now.Add(time.Minute).Unix(),
	}
	oldToken, err := delegationv1.Sign("key-old", old, claims)
	if err != nil {
		t.Fatal(err)
	}
	snapshot := SigningKeySnapshot{
		Active: ActiveSigningKey{SigningKeyID: "key-current", PrivateKey: current},
		Overlap: []OverlapVerificationKey{{
			SigningKeyID: "key-old", PublicKey: old.Public().(ed25519.PublicKey),
			SigningStoppedAt: now, VerificationExpiresAt: now.Add(PlannedOldKeyOverlap),
		}},
	}
	verifier, err := snapshot.Verifier(now.Add(time.Second), []string{testIdentityCapability})
	if err != nil {
		t.Fatal(err)
	}
	if _, err := verifier.VerifyCallerBound(oldToken, now.Add(time.Second), delegationv1.ExpectedCallerBindings{
		CallerWorkloadID: testIdentityWorkload, RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
	}); err != nil {
		t.Fatalf("planned overlap rejected: %v", err)
	}
	retired, err := snapshot.Verifier(now.Add(PlannedOldKeyOverlap), []string{testIdentityCapability})
	if err != nil {
		t.Fatal(err)
	}
	if _, err := retired.VerifyCallerBound(oldToken, now.Add(PlannedOldKeyOverlap), delegationv1.ExpectedCallerBindings{
		CallerWorkloadID: testIdentityWorkload, RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
	}); err == nil {
		t.Fatal("retired overlap key remained accepted")
	}
	snapshot.Overlap[0].Compromised = true
	snapshot.Overlap[0].VerificationExpiresAt = snapshot.Overlap[0].SigningStoppedAt
	compromised, err := snapshot.Verifier(now, []string{testIdentityCapability})
	if err != nil {
		t.Fatal(err)
	}
	if _, err := compromised.VerifyCallerBound(oldToken, now, delegationv1.ExpectedCallerBindings{
		CallerWorkloadID: testIdentityWorkload, RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
	}); err == nil {
		t.Fatal("compromised key remained accepted")
	}
}

func TestIssuerCancellationStopsEverySubsequentOwner(t *testing.T) {
	owners := []string{"binding", "public-session", "session-capability", "security", "id", "signing-key"}
	for _, cancelAt := range owners {
		t.Run(cancelAt, func(t *testing.T) {
			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
			defer cancel()
			var mu sync.Mutex
			called := []string{}
			mark := func(name string) {
				mu.Lock()
				called = append(called, name)
				mu.Unlock()
				if name == cancelAt {
					cancel()
				}
			}
			now := time.Now().UTC()
			private := ed25519.NewKeyFromSeed(make([]byte, ed25519.SeedSize))
			issuer, err := NewIssuer(IssuerConfig{
				Bindings: func(context.Context, runtimegrpc.VerifiedCaller) (runtimeapi.RuntimeCallerBinding, bool, error) {
					mark("binding")
					return runtimeapi.RuntimeCallerBinding{CallerWorkloadID: testIdentityWorkload}, true, nil
				},
				PublicSessions: func(context.Context, string) (PublicSession, error) {
					mark("public-session")
					return issuerTestPublicSession("session", "user", "app"), nil
				},
				SessionCapabilities: func(context.Context, runtimeapi.RuntimeSessionState) ([]string, error) {
					mark("session-capability")
					return []string{testIdentityCapability}, nil
				},
				Security: func(context.Context, string, string) (IssuanceSecurityState, error) {
					mark("security")
					return IssuanceSecurityState{StateFound: true, BindingFound: true, BindingActive: true, OrgID: "org", RuntimeAudience: "runtime", Capabilities: []string{testIdentityCapability}, SecurityEpoch: 1, LeaseFound: true, LeaseSecurityEpoch: 1, LeaseExpiresAt: now.Add(time.Minute)}, nil
				},
				SigningKeys: func(context.Context, time.Time) (SigningKeySnapshot, error) {
					mark("signing-key")
					return SigningKeySnapshot{Active: ActiveSigningKey{SigningKeyID: "key", PrivateKey: private}}, nil
				},
				DelegationIDs: func() (string, error) { mark("id"); return "delegation", nil }, Now: func() time.Time { return now },
			})
			if err != nil {
				t.Fatal(err)
			}
			if _, err := invokeExchange(t, ctx, issuer, "user-bearer"); !errors.Is(err, context.Canceled) {
				t.Fatalf("error = %v", err)
			}
			index := slices.Index(owners, cancelAt)
			if !slices.Equal(called, owners[:index+1]) {
				t.Fatalf("called = %v", called)
			}
		})
	}
}

func TestIssuerConcurrentExchangesDoNotShareDelegationState(t *testing.T) {
	fixture := newIssuerFixture(t)
	var sequence atomic.Uint64
	fixture.issuer.delegationIDs = func() (string, error) { return fmt.Sprintf("delegation-%d", sequence.Add(1)), nil }
	fixture.issuer.publicSessions = func(_ context.Context, bearer string) (PublicSession, error) {
		index := strings.TrimPrefix(bearer, "user-bearer-")
		if index == bearer || index == "" {
			return PublicSession{}, unauthorizedTestError{}
		}
		return issuerTestPublicSession("session-"+index, "user-"+index, "connected-app-1"), nil
	}
	const count = 64
	type issued struct {
		index int
		token string
	}
	tokens := make(chan issued, count)
	errs := make(chan error, count)
	var wait sync.WaitGroup
	for index := range count {
		wait.Add(1)
		go func(index int) {
			defer wait.Done()
			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
			defer cancel()
			response, err := invokeExchange(t, ctx, fixture.issuer, fmt.Sprintf("user-bearer-%d", index))
			if err != nil {
				errs <- err
				return
			}
			tokens <- issued{index: index, token: response.OpaqueDelegation}
		}(index)
	}
	wait.Wait()
	close(tokens)
	close(errs)
	for err := range errs {
		t.Fatal(err)
	}
	unique := map[string]struct{}{}
	verifier, err := fixture.snapshot.Verifier(fixture.now, []string{testIdentityCapability})
	if err != nil {
		t.Fatal(err)
	}
	for result := range tokens {
		unique[result.token] = struct{}{}
		claims, err := verifier.Verify(result.token, fixture.now, delegationv1.ExpectedBindings{
			OrgID: "org-1", CallerWorkloadID: testIdentityWorkload, AppInstallationID: "installation-1",
			RuntimeAudience: "runtime-1", RequiredCapability: testIdentityCapability,
		})
		if err != nil {
			t.Fatal(err)
		}
		if claims.PrincipalID != fmt.Sprintf("user-%d", result.index) || claims.SessionID != fmt.Sprintf("session-%d", result.index) {
			t.Fatalf("exchange %d received claims %#v", result.index, claims)
		}
	}
	if len(unique) != count {
		t.Fatalf("unique tokens = %d, want %d", len(unique), count)
	}
}

func invokeExchange(t *testing.T, ctx context.Context, issuer *Issuer, bearer string) (semantic.Response, error) {
	t.Helper()
	policy, err := runtimegrpc.NewPolicyWithIdentity(runtimegrpc.Config{
		Authority:      func(context.Context, string) (runtimegrpc.VerifiedCaller, error) { return "workload-handle", nil },
		AdmissionLimit: 128,
		AttemptCap:     time.Second,
	}, time.Second)
	if err != nil {
		t.Fatal(err)
	}
	ctx = metadata.NewIncomingContext(ctx, metadata.Pairs(
		envelope.ProtocolMajorMetadataKey, "1", envelope.ProtocolMinorMetadataKey, "0",
		envelope.CapabilityMetadataKey, semantic.CapabilityName,
		runtimegrpc.EndUserAuthorizationMetadataKey, "Bearer "+bearer,
	))
	result, err := policy.UnaryServerInterceptor()(ctx, nil, &grpc.UnaryServerInfo{FullMethod: runtimev1.IdentityContextService_Exchange_FullMethodName}, func(ctx context.Context, _ any) (any, error) {
		return issuer.Exchange(ctx, semantic.Request{AppInstallationID: "installation-1", RequestedCapabilities: []string{testIdentityCapability}})
	})
	if err != nil {
		return semantic.Response{}, err
	}
	return result.(semantic.Response), nil
}

func assertBearerFree(t *testing.T, ctx context.Context) {
	t.Helper()
	if bearer, ok := runtimegrpc.EndUserBearer(ctx); ok || bearer != "" {
		t.Fatalf("raw bearer reached downstream owner: %q", bearer)
	}
	if values, _ := metadata.FromIncomingContext(ctx); len(values.Get(runtimegrpc.EndUserAuthorizationMetadataKey)) != 0 {
		t.Fatal("authorization metadata reached downstream owner")
	}
}

type unauthorizedTestError struct{}

func (unauthorizedTestError) Error() string   { return "unauthorized" }
func (unauthorizedTestError) HTTPStatus() int { return 401 }

type bearerEchoError string

func (e bearerEchoError) Error() string { return "invalid credential: " + string(e) }
func (bearerEchoError) HTTPStatus() int { return 401 }