package delegationv1

import (
	"crypto/ed25519"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"math"
	"os"
	"path/filepath"
	"reflect"
	"strings"
	"sync"
	"testing"
	"time"
)

const selectedRootCapability = "runtime.records.read-selected-root.v1"

type compatibilityVector struct {
	Schema            string `json:"schema"`
	JWSStandard       string `json:"jws_standard"`
	JWTBCP            string `json:"jwt_bcp"`
	EdDSAStandard     string `json:"eddsa_standard"`
	KeyID             string `json:"key_id"`
	PrivateSeedBase64 string `json:"private_seed_base64url"`
	PublicKeyBase64   string `json:"public_key_base64url"`
	ProtectedJSON     string `json:"protected_json"`
	ClaimsJSON        string `json:"claims_json"`
	SigningInput      string `json:"signing_input"`
	SignatureBase64   string `json:"signature_base64url"`
	CompactJWS        string `json:"compact_jws"`
}

func TestDelegationCompatibilityVector(t *testing.T) {
	vector := readCompatibilityVector(t)
	if vector.Schema != "runtime-delegation-jws-v1" || vector.JWSStandard != "RFC 7515" ||
		vector.JWTBCP != "RFC 8725" || vector.EdDSAStandard != "RFC 8037" {
		t.Fatalf("unexpected compatibility vector identity: %#v", vector)
	}
	claims := compatibilityClaims()
	header, err := canonicalProtectedHeader(vector.KeyID)
	if err != nil {
		t.Fatal(err)
	}
	payload, err := canonicalClaims(claims)
	if err != nil {
		t.Fatal(err)
	}
	privateKey := compatibilityPrivateKey(t, vector)
	publicKey := privateKey.Public().(ed25519.PublicKey)
	compact, err := Sign(vector.KeyID, privateKey, claims)
	if err != nil {
		t.Fatal(err)
	}
	parts := strings.Split(compact, ".")
	checks := map[string]string{
		"public key":     base64.RawURLEncoding.EncodeToString(publicKey),
		"protected JSON": string(header),
		"claims JSON":    string(payload),
		"signing input":  strings.Join(parts[:2], "."),
		"signature":      parts[2],
		"compact JWS":    compact,
	}
	wants := map[string]string{
		"public key":     vector.PublicKeyBase64,
		"protected JSON": vector.ProtectedJSON,
		"claims JSON":    vector.ClaimsJSON,
		"signing input":  vector.SigningInput,
		"signature":      vector.SignatureBase64,
		"compact JWS":    vector.CompactJWS,
	}
	for _, name := range []string{"public key", "protected JSON", "claims JSON", "signing input", "signature", "compact JWS"} {
		if checks[name] != wants[name] {
			t.Fatalf("%s = %q, want %q", name, checks[name], wants[name])
		}
	}
	verifier := mustVerifier(t, vector.KeyID, publicKey, KeyStateCurrent, 0)
	parsed, err := verifier.Verify(compact, time.Unix(claims.IssuedAt+1, 0), expectedBindings())
	if err != nil {
		t.Fatalf("Verify: %v", err)
	}
	if !reflect.DeepEqual(parsed, claims) {
		t.Fatalf("parsed claims = %#v, want %#v", parsed, claims)
	}
}

func TestClaimsInventoryIsExactlyTheP6aContract(t *testing.T) {
	want := []struct {
		name string
		tag  string
	}{
		{"DelegationID", "jti"},
		{"OrgID", "org_id"},
		{"PrincipalID", "sub"},
		{"SessionID", "session_id"},
		{"CallerWorkloadID", "caller_workload_id"},
		{"AppInstallationID", "app_installation_id"},
		{"RuntimeAudience", "aud"},
		{"Capabilities", "capabilities"},
		{"AuthEpoch", "auth_epoch"},
		{"SecurityEpoch", "security_epoch"},
		{"IssuedAt", "iat"},
		{"ExpiresAt", "exp"},
	}
	typeOfClaims := reflect.TypeOf(Claims{})
	if typeOfClaims.NumField() != len(want) {
		t.Fatalf("Claims fields = %d, want %d", typeOfClaims.NumField(), len(want))
	}
	for i, expected := range want {
		field := typeOfClaims.Field(i)
		if field.Name != expected.name || field.Tag.Get("json") != expected.tag {
			t.Fatalf("Claims field %d = %s/%q, want %s/%q", i, field.Name, field.Tag.Get("json"), expected.name, expected.tag)
		}
	}
}

func TestClaimProtocolBoundaries(t *testing.T) {
	valid := compatibilityClaims()
	tests := []struct {
		name      string
		mutate    func(*Claims)
		wantError bool
	}{
		{name: "identifier exact", mutate: func(c *Claims) { c.OrgID = strings.Repeat("o", MaxIdentifierBytes) }},
		{name: "identifier one over", mutate: func(c *Claims) { c.OrgID = strings.Repeat("o", MaxIdentifierBytes+1) }, wantError: true},
		{name: "workload exact", mutate: func(c *Claims) { c.CallerWorkloadID = strings.Repeat("w", MaxWorkloadIdentifierBytes) }},
		{name: "workload one over", mutate: func(c *Claims) { c.CallerWorkloadID = strings.Repeat("w", MaxWorkloadIdentifierBytes+1) }, wantError: true},
		{name: "capability length exact", mutate: func(c *Claims) { c.Capabilities = []string{capabilityOfLength(MaxCapabilityBytes)} }},
		{name: "capability length one over", mutate: func(c *Claims) { c.Capabilities = []string{capabilityOfLength(MaxCapabilityBytes + 1)} }, wantError: true},
		{name: "capability count exact", mutate: func(c *Claims) { c.Capabilities = capabilitySet(MaxCapabilities) }},
		{name: "capability count one over", mutate: func(c *Claims) { c.Capabilities = capabilitySet(MaxCapabilities + 1) }, wantError: true},
		{name: "lifetime exact", mutate: func(c *Claims) { c.ExpiresAt = c.IssuedAt + int64(MaxLifetime/time.Second) }},
		{name: "lifetime one over", mutate: func(c *Claims) { c.ExpiresAt = c.IssuedAt + int64(MaxLifetime/time.Second) + 1 }, wantError: true},
	}
	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			claims := cloneClaims(valid)
			tc.mutate(&claims)
			err := claims.Validate()
			if (err != nil) != tc.wantError {
				t.Fatalf("Validate error = %v, wantError %v", err, tc.wantError)
			}
		})
	}
	if _, err := canonicalProtectedHeader(strings.Repeat("k", MaxSigningKeyIDBytes)); err != nil {
		t.Fatalf("SigningKeyID exact limit: %v", err)
	}
	if _, err := canonicalProtectedHeader(strings.Repeat("k", MaxSigningKeyIDBytes+1)); err == nil {
		t.Fatal("SigningKeyID one-over limit was accepted")
	}

	maximumShape := compatibilityClaims()
	maximumShape.DelegationID = strings.Repeat(`"`, MaxIdentifierBytes)
	maximumShape.OrgID = strings.Repeat(`"`, MaxIdentifierBytes)
	maximumShape.PrincipalID = strings.Repeat(`"`, MaxIdentifierBytes)
	maximumShape.SessionID = strings.Repeat(`"`, MaxIdentifierBytes)
	maximumShape.CallerWorkloadID = strings.Repeat(`"`, MaxWorkloadIdentifierBytes)
	maximumShape.AppInstallationID = strings.Repeat(`"`, MaxIdentifierBytes)
	maximumShape.RuntimeAudience = strings.Repeat(`"`, MaxIdentifierBytes)
	maximumShape.Capabilities = capabilitySet(MaxCapabilities)
	maximumShape.AuthEpoch = math.MaxUint64
	maximumShape.SecurityEpoch = math.MaxUint64
	maximumShape.ExpiresAt = math.MaxInt64
	maximumShape.IssuedAt = maximumShape.ExpiresAt - int64(MaxLifetime/time.Second)
	compact, err := Sign(strings.Repeat("k", MaxSigningKeyIDBytes), compatibilityPrivateKey(t, readCompatibilityVector(t)), maximumShape)
	if err != nil {
		t.Fatalf("maximum semantic shape must fit the outer envelope: %v", err)
	}
	if len(compact) > MaxCompactTokenBytes {
		t.Fatalf("maximum semantic token bytes = %d, outer max = %d", len(compact), MaxCompactTokenBytes)
	}
	t.Logf("maximum semantic compact JWS = %d bytes; outer maximum = %d bytes", len(compact), MaxCompactTokenBytes)
	if err := validateCompactSize(strings.Repeat("x", MaxCompactTokenBytes)); err != nil {
		t.Fatalf("exact outer envelope: %v", err)
	}
	if err := validateCompactSize(strings.Repeat("x", MaxCompactTokenBytes+1)); err == nil {
		t.Fatal("one-over outer envelope was accepted")
	}
}

func TestClaimsValidationFailsClosed(t *testing.T) {
	valid := compatibilityClaims()
	tests := []struct {
		name   string
		mutate func(*Claims)
	}{
		{name: "empty delegation", mutate: func(c *Claims) { c.DelegationID = "" }},
		{name: "padded org", mutate: func(c *Claims) { c.OrgID = " org-1" }},
		{name: "control in session", mutate: func(c *Claims) { c.SessionID = "session\n1" }},
		{name: "no capabilities", mutate: func(c *Claims) { c.Capabilities = nil }},
		{name: "unsorted capabilities", mutate: func(c *Claims) { c.Capabilities = []string{"runtime.z.v1", "runtime.a.v1"} }},
		{name: "duplicate capability", mutate: func(c *Claims) { c.Capabilities = []string{"runtime.a.v1", "runtime.a.v1"} }},
		{name: "uppercase capability", mutate: func(c *Claims) { c.Capabilities = []string{"runtime.Records.v1"} }},
		{name: "zero auth epoch", mutate: func(c *Claims) { c.AuthEpoch = 0 }},
		{name: "zero security epoch", mutate: func(c *Claims) { c.SecurityEpoch = 0 }},
		{name: "zero issued at", mutate: func(c *Claims) { c.IssuedAt = 0 }},
		{name: "expiry equal issued", mutate: func(c *Claims) { c.ExpiresAt = c.IssuedAt }},
	}
	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			claims := cloneClaims(valid)
			tc.mutate(&claims)
			if err := claims.Validate(); err == nil {
				t.Fatal("Validate succeeded")
			}
		})
	}
}

func TestCanonicalParsersRejectAlternateOrExtendedGrammar(t *testing.T) {
	claims := compatibilityClaims()
	payload, _ := canonicalClaims(claims)
	header, _ := canonicalProtectedHeader("p6b-test-key-1")
	tests := []struct {
		name  string
		parse func([]byte) error
		data  []byte
	}{
		{name: "claims whitespace", data: append([]byte(" "), payload...), parse: parseClaimsError},
		{name: "claims unknown field", data: append(payload[:len(payload)-1], []byte(`,"future":true}`)...), parse: parseClaimsError},
		{name: "claims duplicate field", data: []byte(strings.Replace(string(payload), `"jti":"delegation-1"`, `"jti":"delegation-1","jti":"delegation-1"`, 1)), parse: parseClaimsError},
		{name: "header whitespace", data: append([]byte(" "), header...), parse: parseHeaderError},
		{name: "header unknown field", data: append(header[:len(header)-1], []byte(`,"future":true}`)...), parse: parseHeaderError},
		{name: "algorithm substitution", data: []byte(strings.Replace(string(header), `"EdDSA"`, `"none"`, 1)), parse: parseHeaderError},
		{name: "unknown version", data: []byte(strings.Replace(string(header), `"nexuscrm_version":1`, `"nexuscrm_version":2`, 1)), parse: parseHeaderError},
		{name: "wrong domain", data: []byte(strings.Replace(string(header), SignatureDomain, "nexuscrm.runtime.other.v1", 1)), parse: parseHeaderError},
	}
	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			if err := tc.parse(tc.data); err == nil {
				t.Fatal("non-canonical input was accepted")
			}
		})
	}
}

func TestVerifyRejectsEveryClaimAndKeyIDTamper(t *testing.T) {
	vector := readCompatibilityVector(t)
	privateKey := compatibilityPrivateKey(t, vector)
	claims := compatibilityClaims()
	compact, _ := Sign(vector.KeyID, privateKey, claims)
	parts := strings.Split(compact, ".")
	mutations := []struct {
		name   string
		mutate func(*Claims)
	}{
		{"delegation", func(c *Claims) { c.DelegationID += "x" }},
		{"org", func(c *Claims) { c.OrgID += "x" }},
		{"principal", func(c *Claims) { c.PrincipalID += "x" }},
		{"session", func(c *Claims) { c.SessionID += "x" }},
		{"workload", func(c *Claims) { c.CallerWorkloadID += "x" }},
		{"installation", func(c *Claims) { c.AppInstallationID += "x" }},
		{"audience", func(c *Claims) { c.RuntimeAudience += "x" }},
		{"capabilities", func(c *Claims) { c.Capabilities = []string{"runtime.records.other.v1"} }},
		{"auth epoch", func(c *Claims) { c.AuthEpoch++ }},
		{"security epoch", func(c *Claims) { c.SecurityEpoch++ }},
		{"issued at", func(c *Claims) { c.IssuedAt++ }},
		{"expires at", func(c *Claims) { c.ExpiresAt++ }},
	}
	verifier := mustVerifier(t, vector.KeyID, privateKey.Public().(ed25519.PublicKey), KeyStateCurrent, 0)
	for _, tc := range mutations {
		t.Run(tc.name, func(t *testing.T) {
			mutated := cloneClaims(claims)
			tc.mutate(&mutated)
			payload, err := canonicalClaims(mutated)
			if err != nil {
				t.Fatal(err)
			}
			tampered := parts[0] + "." + base64.RawURLEncoding.EncodeToString(payload) + "." + parts[2]
			assertVerifyFails(t, verifier, tampered, time.Unix(claims.IssuedAt+1, 0), expectedBindings())
		})
	}
	tamperedHeader, _ := canonicalProtectedHeader(vector.KeyID + "x")
	tamperedKid := base64.RawURLEncoding.EncodeToString(tamperedHeader) + "." + parts[1] + "." + parts[2]
	assertVerifyFails(t, verifier, tamperedKid, time.Unix(claims.IssuedAt+1, 0), expectedBindings())
}

func TestVerifyTemporalAndBindingRules(t *testing.T) {
	vector := readCompatibilityVector(t)
	privateKey := compatibilityPrivateKey(t, vector)
	claims := compatibilityClaims()
	compact, _ := Sign(vector.KeyID, privateKey, claims)
	verifier := mustVerifier(t, vector.KeyID, privateKey.Public().(ed25519.PublicKey), KeyStateCurrent, MaxClockSkew)

	// Exact skew boundaries are accepted; one second beyond fails closed.
	if _, err := verifier.Verify(compact, time.Unix(claims.IssuedAt-int64(MaxClockSkew/time.Second), 0), expectedBindings()); err != nil {
		t.Fatalf("iat exact skew: %v", err)
	}
	assertVerifyFails(t, verifier, compact, time.Unix(claims.IssuedAt-int64(MaxClockSkew/time.Second)-1, 0), expectedBindings())
	if _, err := verifier.Verify(compact, time.Unix(claims.ExpiresAt+int64(MaxClockSkew/time.Second)-1, 0), expectedBindings()); err != nil {
		t.Fatalf("expiry last accepted second: %v", err)
	}
	assertVerifyFails(t, verifier, compact, time.Unix(claims.ExpiresAt+int64(MaxClockSkew/time.Second), 0), expectedBindings())

	maxTimeClaims := cloneClaims(claims)
	maxTimeClaims.ExpiresAt = math.MaxInt64
	maxTimeClaims.IssuedAt = maxTimeClaims.ExpiresAt - int64(MaxLifetime/time.Second)
	maxTimeToken, err := Sign(vector.KeyID, privateKey, maxTimeClaims)
	if err != nil {
		t.Fatal(err)
	}
	zeroSkewVerifier := mustVerifier(t, vector.KeyID, privateKey.Public().(ed25519.PublicKey), KeyStateCurrent, 0)
	if _, err := zeroSkewVerifier.Verify(maxTimeToken, time.Unix(math.MaxInt64-1, 0), expectedBindings()); err != nil {
		t.Fatalf("int64 timestamp ceiling before expiry: %v", err)
	}
	assertVerifyFails(t, zeroSkewVerifier, maxTimeToken, time.Unix(math.MaxInt64, 0), expectedBindings())

	bindings := expectedBindings()
	mutations := []struct {
		name   string
		mutate func(*ExpectedBindings)
	}{
		{"org", func(e *ExpectedBindings) { e.OrgID = "other-org" }},
		{"workload", func(e *ExpectedBindings) { e.CallerWorkloadID = "spiffe://other/workload" }},
		{"installation", func(e *ExpectedBindings) { e.AppInstallationID = "other-installation" }},
		{"audience", func(e *ExpectedBindings) { e.RuntimeAudience = "other-runtime" }},
		{"capability", func(e *ExpectedBindings) { e.RequiredCapability = "runtime.records.other.v1" }},
	}
	for _, tc := range mutations {
		t.Run(tc.name, func(t *testing.T) {
			expected := bindings
			tc.mutate(&expected)
			assertVerifyFails(t, verifier, compact, time.Unix(claims.IssuedAt+1, 0), expected)
		})
	}
	unauthenticated := bindings
	unauthenticated.RuntimeAudience = "other-runtime"
	assertFailureCategory(t, verifier, compact, time.Unix(claims.IssuedAt+1, 0), unauthenticated, FailureUnauthenticated)
	forbidden := bindings
	forbidden.OrgID = "other-org"
	assertFailureCategory(t, verifier, compact, time.Unix(claims.IssuedAt+1, 0), forbidden, FailureForbidden)
}

func TestVerifyCallerBoundSupportsMultipleInstallationsWithoutWeakeningFullBinding(t *testing.T) {
	vector := readCompatibilityVector(t)
	privateKey := compatibilityPrivateKey(t, vector)
	verifier := mustVerifier(t, vector.KeyID, privateKey.Public().(ed25519.PublicKey), KeyStateCurrent, 0)
	now := time.Unix(compatibilityClaims().IssuedAt+1, 0)
	expectedCaller := expectedCallerBindings()

	first := compatibilityClaims()
	second := cloneClaims(first)
	second.DelegationID = "delegation-2"
	second.OrgID = "org-2"
	second.AppInstallationID = "installation-2"

	for _, claims := range []Claims{first, second} {
		compact, err := Sign(vector.KeyID, privateKey, claims)
		if err != nil {
			t.Fatal(err)
		}
		got, err := verifier.VerifyCallerBound(compact, now, expectedCaller)
		if err != nil {
			t.Fatalf("caller-bound verify for %s/%s: %v", claims.OrgID, claims.AppInstallationID, err)
		}
		if got.OrgID != claims.OrgID || got.AppInstallationID != claims.AppInstallationID {
			t.Fatalf("authenticated selectors = %s/%s, want %s/%s", got.OrgID, got.AppInstallationID, claims.OrgID, claims.AppInstallationID)
		}

		wrongInstallation := expectedBindings()
		if claims.OrgID != wrongInstallation.OrgID || claims.AppInstallationID != wrongInstallation.AppInstallationID {
			assertFailureCategory(t, verifier, compact, now, wrongInstallation, FailureForbidden)
		}
	}
}

func TestVerifyCallerBoundFailureCategories(t *testing.T) {
	vector := readCompatibilityVector(t)
	privateKey := compatibilityPrivateKey(t, vector)
	verifier := mustVerifier(t, vector.KeyID, privateKey.Public().(ed25519.PublicKey), KeyStateCurrent, 0)
	claims := compatibilityClaims()
	compact, err := Sign(vector.KeyID, privateKey, claims)
	if err != nil {
		t.Fatal(err)
	}
	now := time.Unix(claims.IssuedAt+1, 0)

	wrongAudience := expectedCallerBindings()
	wrongAudience.RuntimeAudience = "other-runtime"
	assertCallerBoundFailureCategory(t, verifier, compact, now, wrongAudience, FailureUnauthenticated)

	wrongWorkload := expectedCallerBindings()
	wrongWorkload.CallerWorkloadID = "spiffe://other/workload"
	assertCallerBoundFailureCategory(t, verifier, compact, now, wrongWorkload, FailureForbidden)

	invalidExpected := expectedCallerBindings()
	invalidExpected.CallerWorkloadID = ""
	assertCallerBoundFailureCategory(t, verifier, compact, now, invalidExpected, FailureUnauthenticated)

	if got, err := verifier.VerifyCallerBound(compact+"tampered", now, expectedCallerBindings()); err == nil || !reflect.DeepEqual(got, Claims{}) {
		t.Fatalf("tampered caller-bound verification returned claims=%+v err=%v", got, err)
	}
}

func TestVerifierRejectsMalformedAndAuthenticatedInvalidGrammar(t *testing.T) {
	vector := readCompatibilityVector(t)
	privateKey := compatibilityPrivateKey(t, vector)
	publicKey := privateKey.Public().(ed25519.PublicKey)
	verifier := mustVerifier(t, vector.KeyID, publicKey, KeyStateCurrent, 0)
	now := time.Unix(compatibilityClaims().IssuedAt+1, 0)
	valid, _ := Sign(vector.KeyID, privateKey, compatibilityClaims())
	parts := strings.Split(valid, ".")

	malformed := []string{"", "a", "a.b", "a.b.c.d", ".b.c", "a..c", "a.b.", valid[:len(valid)-1], valid + "=", strings.Repeat("x", MaxCompactTokenBytes+1)}
	for i, compact := range malformed {
		t.Run(fmt.Sprintf("malformed-%d", i), func(t *testing.T) {
			assertVerifyFails(t, verifier, compact, now, expectedBindings())
		})
	}

	invalidClaims := []string{
		strings.Replace(string(mustCanonicalClaims(t)), `"capabilities":["`+selectedRootCapability+`"]`, `"capabilities":[]`, 1),
		strings.Replace(string(mustCanonicalClaims(t)), `"capabilities":["`+selectedRootCapability+`"]`, `"capabilities":["runtime.z.v1","runtime.a.v1"]`, 1),
		strings.Replace(string(mustCanonicalClaims(t)), `"capabilities":["`+selectedRootCapability+`"]`, `"capabilities":["runtime.a.v1","runtime.a.v1"]`, 1),
		strings.Replace(string(mustCanonicalClaims(t)), `"jti":"delegation-1"`, `"jti":"delegation-1","jti":"delegation-1"`, 1),
		strings.Replace(string(mustCanonicalClaims(t)), `"capabilities":["`+selectedRootCapability+`"]`, `"capabilities":[`+quotedCapabilities(MaxCapabilities+1)+`]`, 1),
	}
	for i, payload := range invalidClaims {
		compact := signRaw(t, parts[0], []byte(payload), privateKey)
		t.Run(fmt.Sprintf("authenticated-invalid-claims-%d", i), func(t *testing.T) {
			assertVerifyFails(t, verifier, compact, now, expectedBindings())
		})
	}

	unknownClaims := compatibilityClaims()
	unknownClaims.Capabilities = []string{"runtime.records.unknown.v1"}
	unknown, _ := Sign(vector.KeyID, privateKey, unknownClaims)
	assertVerifyFails(t, verifier, unknown, now, ExpectedBindings{
		OrgID: unknownClaims.OrgID, CallerWorkloadID: unknownClaims.CallerWorkloadID,
		AppInstallationID: unknownClaims.AppInstallationID, RuntimeAudience: unknownClaims.RuntimeAudience,
		RequiredCapability: unknownClaims.Capabilities[0],
	})

	otherHeader, _ := canonicalJSON(protectedHeader{Algorithm: JWSAlgorithm, KeyID: vector.KeyID, Type: JWSType, Version: 2, Domain: SignatureDomain})
	unknownVersion := signRaw(t, base64.RawURLEncoding.EncodeToString(otherHeader), mustCanonicalClaims(t), privateKey)
	assertVerifyFails(t, verifier, unknownVersion, now, expectedBindings())
}

func TestVerifierKeyRotationAndSnapshotIsolation(t *testing.T) {
	vector := readCompatibilityVector(t)
	privateKey := compatibilityPrivateKey(t, vector)
	publicKey := privateKey.Public().(ed25519.PublicKey)
	compact, _ := Sign(vector.KeyID, privateKey, compatibilityClaims())
	now := time.Unix(compatibilityClaims().IssuedAt+1, 0)

	for _, state := range []KeyState{KeyStateCurrent, KeyStateOverlap} {
		verifier := mustVerifier(t, vector.KeyID, publicKey, state, 0)
		if _, err := verifier.Verify(compact, now, expectedBindings()); err != nil {
			t.Fatalf("state %v: %v", state, err)
		}
	}
	retired := mustVerifier(t, vector.KeyID, publicKey, KeyStateRetired, 0)
	assertVerifyFails(t, retired, compact, now, expectedBindings())
	unknown := mustVerifier(t, "other-key", publicKey, KeyStateCurrent, 0)
	assertVerifyFails(t, unknown, compact, now, expectedBindings())

	overlapSeed := sha256.Sum256([]byte("nexuscrm-p6b-overlap-test-key"))
	overlapPrivateKey := ed25519.NewKeyFromSeed(overlapSeed[:])
	overlapToken, _ := Sign("overlap-key", overlapPrivateKey, compatibilityClaims())
	rotationVerifier, err := NewVerifier(VerifierConfig{
		Keys: []VerificationKey{
			{SigningKeyID: vector.KeyID, PublicKey: publicKey, State: KeyStateCurrent},
			{SigningKeyID: "overlap-key", PublicKey: overlapPrivateKey.Public().(ed25519.PublicKey), State: KeyStateOverlap},
		},
		SupportedCapabilities: []string{selectedRootCapability},
	})
	if err != nil {
		t.Fatal(err)
	}
	for name, token := range map[string]string{"current": compact, "overlap": overlapToken} {
		if _, err := rotationVerifier.Verify(token, now, expectedBindings()); err != nil {
			t.Fatalf("%s token during overlap: %v", name, err)
		}
	}

	mutableKey := append(ed25519.PublicKey(nil), publicKey...)
	mutableCapabilities := []string{selectedRootCapability}
	verifier, err := NewVerifier(VerifierConfig{
		Keys:                  []VerificationKey{{SigningKeyID: vector.KeyID, PublicKey: mutableKey, State: KeyStateCurrent}},
		SupportedCapabilities: mutableCapabilities,
	})
	if err != nil {
		t.Fatal(err)
	}
	for i := range mutableKey {
		mutableKey[i] = 0
	}
	mutableCapabilities[0] = "runtime.records.changed.v1"
	if _, err := verifier.Verify(compact, now, expectedBindings()); err != nil {
		t.Fatalf("verifier retained caller-owned mutable storage: %v", err)
	}

	var wait sync.WaitGroup
	for i := 0; i < 64; i++ {
		wait.Add(1)
		go func() {
			defer wait.Done()
			for j := 0; j < 100; j++ {
				if _, err := verifier.Verify(compact, now, expectedBindings()); err != nil {
					t.Errorf("concurrent Verify: %v", err)
					return
				}
			}
		}()
	}
	wait.Wait()
}

func TestVerifierConfigurationBoundaries(t *testing.T) {
	vector := readCompatibilityVector(t)
	publicKey := compatibilityPrivateKey(t, vector).Public().(ed25519.PublicKey)
	base := VerifierConfig{
		Keys:                  []VerificationKey{{SigningKeyID: vector.KeyID, PublicKey: publicKey, State: KeyStateCurrent}},
		SupportedCapabilities: []string{selectedRootCapability},
	}
	base.ClockSkew = MaxClockSkew
	if _, err := NewVerifier(base); err != nil {
		t.Fatalf("exact clock skew: %v", err)
	}
	base.ClockSkew = MaxClockSkew + time.Second
	if _, err := NewVerifier(base); err == nil {
		t.Fatal("one-over clock skew was accepted")
	}
	base.ClockSkew = 500 * time.Millisecond
	if _, err := NewVerifier(base); err == nil {
		t.Fatal("sub-second clock skew was accepted")
	}
	base.ClockSkew = 0
	base.Keys = append(base.Keys, base.Keys[0])
	if _, err := NewVerifier(base); err == nil {
		t.Fatal("duplicate key ID was accepted")
	}
	base.Keys = []VerificationKey{{SigningKeyID: vector.KeyID, PublicKey: publicKey, State: KeyStateRetired}}
	if _, err := NewVerifier(base); err == nil {
		t.Fatal("key set without one current key was accepted")
	}
}

func TestCapabilityIntersectionIsFailClosed(t *testing.T) {
	all := []string{"runtime.records.query.v1", selectedRootCapability}
	requested := []string{selectedRootCapability}
	grantSets := CapabilityGrantSets{
		Workload: all, AppInstallation: requested, Session: requested, Requested: requested,
	}
	got, err := IntersectCapabilities(grantSets)
	if err != nil {
		t.Fatal(err)
	}
	if !reflect.DeepEqual(got, requested) {
		t.Fatalf("intersection = %v, want %v", got, requested)
	}
	for _, emptyAxis := range []string{"workload", "installation", "session", "requested"} {
		sets := CapabilityGrantSets{Workload: requested, AppInstallation: requested, Session: requested, Requested: requested}
		switch emptyAxis {
		case "workload":
			sets.Workload = nil
		case "installation":
			sets.AppInstallation = nil
		case "session":
			sets.Session = nil
		case "requested":
			sets.Requested = nil
		}
		got, err := IntersectCapabilities(sets)
		if err != nil || len(got) != 0 {
			t.Fatalf("empty axis %s: got %v, err %v", emptyAxis, got, err)
		}
	}
	grantSets.Workload = []string{"runtime.z.v1", "runtime.a.v1"}
	if _, err := IntersectCapabilities(grantSets); err == nil {
		t.Fatal("non-canonical grant set was accepted")
	}
}

func TestBroadAuthorityIntersectionKeepsRequestBound(t *testing.T) {
	for _, count := range []int{MaxCapabilities + 1, MaxAuthorityCapabilities} {
		t.Run(fmt.Sprint(count), func(t *testing.T) {
			all := authorityCapabilitySet(count)
			for _, requestedCount := range []int{1, MaxCapabilities, MaxCapabilities + 1} {
				requested := all[:requestedCount]
				got, err := IntersectCapabilities(CapabilityGrantSets{
					Workload: all, AppInstallation: all, Session: all, Requested: requested,
				})
				if requestedCount > MaxCapabilities {
					if err == nil {
						t.Fatal("broad authorities allowed an over-limit request")
					}
				} else if err != nil || !reflect.DeepEqual(got, requested) {
					t.Fatalf("request count %d: intersection = %v, error = %v", requestedCount, got, err)
				}
			}
		})
	}

	all := authorityCapabilitySet(MaxCapabilities + 1)
	without := func(index int) []string {
		result := append([]string(nil), all[:index]...)
		return append(result, all[index+1:]...)
	}
	got, err := IntersectCapabilities(CapabilityGrantSets{
		Workload: without(0), AppInstallation: without(1), Session: without(2), Requested: all[:4],
	})
	if err != nil || !reflect.DeepEqual(got, all[3:4]) {
		t.Fatalf("four-axis intersection = %v, error = %v; want only %v", got, err, all[3:4])
	}
}

func TestCapabilityGrantsValidateCompleteBoundedAuthority(t *testing.T) {
	tests := []struct {
		name      string
		count     int
		mutate    func([]string)
		wantError bool
	}{
		{name: "empty"},
		{name: "broad", count: MaxCapabilities + 1},
		{name: "exact authority limit", count: MaxAuthorityCapabilities},
		{name: "over authority limit", count: MaxAuthorityCapabilities + 1, wantError: true},
		{name: "duplicate tail", count: MaxCapabilities + 1, mutate: func(c []string) { c[len(c)-1] = c[len(c)-2] }, wantError: true},
		{name: "unsorted tail", count: MaxCapabilities + 1, mutate: func(c []string) { c[len(c)-1] = c[0] }, wantError: true},
		{name: "invalid tail", count: MaxCapabilities + 1, mutate: func(c []string) { c[len(c)-1] = "runtime.Invalid.v1" }, wantError: true},
		{name: "overlong tail", count: MaxCapabilities + 1, mutate: func(c []string) { c[len(c)-1] = "runtime.z" + strings.Repeat("z", MaxCapabilityBytes) }, wantError: true},
	}
	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			authority := authorityCapabilitySet(tc.count)
			if tc.mutate != nil {
				tc.mutate(authority)
			}
			if err := ValidateCapabilityGrants(authority); (err != nil) != tc.wantError {
				t.Fatalf("ValidateCapabilityGrants error = %v, wantError %v", err, tc.wantError)
			}
			// Even an empty request must not hide malformed, unused grant tails.
			for _, requested := range [][]string{nil, authorityCapabilitySet(1)} {
				for axis := 0; axis < 3; axis++ {
					sets := CapabilityGrantSets{Workload: requested, AppInstallation: requested, Session: requested, Requested: requested}
					*[]*[]string{&sets.Workload, &sets.AppInstallation, &sets.Session}[axis] = authority
					got, err := IntersectCapabilities(sets)
					if (err != nil) != tc.wantError {
						t.Fatalf("axis %d, request %v: intersection = %v, error = %v, wantError %v", axis, requested, got, err, tc.wantError)
					}
					if !tc.wantError && (len(authority) == 0 || len(requested) == 0) && len(got) != 0 {
						t.Fatalf("empty axis granted capabilities: %v", got)
					}
				}
			}
		})
	}
}

func TestBroadVerifierRegistryKeepsTokenBound(t *testing.T) {
	vector := readCompatibilityVector(t)
	privateKey := compatibilityPrivateKey(t, vector)
	keys := []VerificationKey{{SigningKeyID: vector.KeyID, PublicKey: privateKey.Public().(ed25519.PublicKey), State: KeyStateCurrent}}
	for _, count := range []int{MaxCapabilities + 1, MaxAuthorityCapabilities} {
		t.Run(fmt.Sprint(count), func(t *testing.T) {
			supported := authorityCapabilitySet(count)
			verifier, err := NewVerifier(VerifierConfig{Keys: keys, SupportedCapabilities: supported})
			if err != nil {
				t.Fatal(err)
			}
			for _, tokenCount := range []int{1, MaxCapabilities, MaxCapabilities + 1} {
				claims := compatibilityClaims()
				claims.Capabilities = supported[:tokenCount]
				bindings := expectedBindings()
				bindings.RequiredCapability = supported[0]
				now := time.Unix(claims.IssuedAt+1, 0)
				compact, err := Sign(vector.KeyID, privateKey, claims)
				if tokenCount > MaxCapabilities {
					if err == nil || claims.Validate() == nil {
						t.Fatal("broad registry allowed signing over-limit claims")
					}
					payload, err := json.Marshal(claims)
					if err != nil {
						t.Fatal(err)
					}
					header, err := canonicalProtectedHeader(vector.KeyID)
					if err != nil {
						t.Fatal(err)
					}
					compact = signRaw(t, base64.RawURLEncoding.EncodeToString(header), payload, privateKey)
					assertVerifyFails(t, verifier, compact, now, bindings)
				} else {
					if err != nil {
						t.Fatal(err)
					}
					got, err := verifier.Verify(compact, now, bindings)
					if err != nil || !reflect.DeepEqual(got, claims) {
						t.Fatalf("token count %d: claims = %#v, error = %v", tokenCount, got, err)
					}
				}
			}
		})
	}
	for _, mutate := range []func([]string) []string{
		func(c []string) []string { return nil },
		func(c []string) []string { return authorityCapabilitySet(MaxAuthorityCapabilities + 1) },
		func(c []string) []string { c[len(c)-1] = c[len(c)-2]; return c },
		func(c []string) []string { c[len(c)-1] = c[0]; return c },
		func(c []string) []string { c[len(c)-1] = "runtime.Invalid.v1"; return c },
		func(c []string) []string {
			c[len(c)-1] = "runtime.z" + strings.Repeat("z", MaxCapabilityBytes)
			return c
		},
	} {
		if _, err := NewVerifier(VerifierConfig{Keys: keys, SupportedCapabilities: mutate(authorityCapabilitySet(MaxCapabilities + 1))}); err == nil {
			t.Fatal("invalid broad verifier registry was accepted")
		}
	}
}

func compatibilityClaims() Claims {
	return Claims{
		DelegationID: "delegation-1", OrgID: "org-1", PrincipalID: "principal-1",
		SessionID: "session-1", CallerWorkloadID: "spiffe://example.test/ns/runtime/sa/records-client",
		AppInstallationID: "installation-1", RuntimeAudience: "nexuscrm-runtime",
		Capabilities: []string{selectedRootCapability},
		AuthEpoch:    7, SecurityEpoch: 11, IssuedAt: 1783857600, ExpiresAt: 1783857660,
	}
}

func expectedBindings() ExpectedBindings {
	claims := compatibilityClaims()
	return ExpectedBindings{
		OrgID: claims.OrgID, CallerWorkloadID: claims.CallerWorkloadID,
		AppInstallationID: claims.AppInstallationID, RuntimeAudience: claims.RuntimeAudience,
		RequiredCapability: selectedRootCapability,
	}
}

func expectedCallerBindings() ExpectedCallerBindings {
	claims := compatibilityClaims()
	return ExpectedCallerBindings{
		CallerWorkloadID: claims.CallerWorkloadID, RuntimeAudience: claims.RuntimeAudience,
		RequiredCapability: selectedRootCapability,
	}
}

func cloneClaims(claims Claims) Claims {
	claims.Capabilities = append([]string(nil), claims.Capabilities...)
	return claims
}

func capabilityOfLength(length int) string {
	prefix := "runtime."
	return prefix + strings.Repeat("a", length-len(prefix))
}

func capabilitySet(count int) []string {
	result := make([]string, count)
	for i := range result {
		prefix := fmt.Sprintf("runtime.capability-%02d-", i)
		result[i] = prefix + strings.Repeat("a", MaxCapabilityBytes-len(prefix))
	}
	return result
}

func authorityCapabilitySet(count int) []string {
	result := make([]string, count)
	for i := range result {
		result[i] = fmt.Sprintf("runtime.capability-%04d.v1", i)
	}
	return result
}

func quotedCapabilities(count int) string {
	capabilities := capabilitySet(count)
	quoted := make([]string, len(capabilities))
	for i, capability := range capabilities {
		quoted[i] = `"` + capability + `"`
	}
	return strings.Join(quoted, ",")
}

func mustVerifier(t *testing.T, keyID string, publicKey ed25519.PublicKey, state KeyState, skew time.Duration) *Verifier {
	t.Helper()
	keys := []VerificationKey{{SigningKeyID: keyID, PublicKey: publicKey, State: state}}
	if state != KeyStateCurrent {
		auxiliarySeed := sha256.Sum256([]byte("nexuscrm-p6b-auxiliary-current-key"))
		auxiliaryPrivateKey := ed25519.NewKeyFromSeed(auxiliarySeed[:])
		keys = append(keys, VerificationKey{
			SigningKeyID: "auxiliary-current-key",
			PublicKey:    auxiliaryPrivateKey.Public().(ed25519.PublicKey),
			State:        KeyStateCurrent,
		})
	}
	verifier, err := NewVerifier(VerifierConfig{
		Keys:                  keys,
		SupportedCapabilities: []string{selectedRootCapability},
		ClockSkew:             skew,
	})
	if err != nil {
		t.Fatal(err)
	}
	return verifier
}

func assertVerifyFails(t *testing.T, verifier *Verifier, compact string, now time.Time, expected ExpectedBindings) {
	t.Helper()
	if claims, err := verifier.Verify(compact, now, expected); err == nil || !reflect.DeepEqual(claims, Claims{}) {
		t.Fatalf("Verify = %#v, %v; want zero claims and error", claims, err)
	}
}

func assertFailureCategory(t *testing.T, verifier *Verifier, compact string, now time.Time, expected ExpectedBindings, want FailureCategory) {
	t.Helper()
	claims, err := verifier.Verify(compact, now, expected)
	var failure *Failure
	if !reflect.DeepEqual(claims, Claims{}) || !errors.As(err, &failure) || failure.Category != want {
		t.Fatalf("Verify = %#v, %v; failure = %#v, want category %v", claims, err, failure, want)
	}
}

func assertCallerBoundFailureCategory(t *testing.T, verifier *Verifier, compact string, now time.Time, expected ExpectedCallerBindings, want FailureCategory) {
	t.Helper()
	claims, err := verifier.VerifyCallerBound(compact, now, expected)
	var failure *Failure
	if !reflect.DeepEqual(claims, Claims{}) || !errors.As(err, &failure) || failure.Category != want {
		t.Fatalf("VerifyCallerBound = %#v, %v; failure = %#v, want category %v", claims, err, failure, want)
	}
}

func signRaw(t *testing.T, protectedPart string, payload []byte, privateKey ed25519.PrivateKey) string {
	t.Helper()
	payloadPart := base64.RawURLEncoding.EncodeToString(payload)
	input := protectedPart + "." + payloadPart
	signature := ed25519.Sign(privateKey, []byte(input))
	return input + "." + base64.RawURLEncoding.EncodeToString(signature)
}

func mustCanonicalClaims(t *testing.T) []byte {
	t.Helper()
	payload, err := canonicalClaims(compatibilityClaims())
	if err != nil {
		t.Fatal(err)
	}
	return payload
}

func parseClaimsError(data []byte) error {
	_, err := parseCanonicalClaims(data)
	return err
}

func parseHeaderError(data []byte) error {
	_, err := parseCanonicalProtectedHeader(data)
	return err
}

func readCompatibilityVector(t *testing.T) compatibilityVector {
	t.Helper()
	data, err := os.ReadFile(filepath.Join("testdata", "ed25519-jws-v1.json"))
	if err != nil {
		t.Fatal(err)
	}
	var vector compatibilityVector
	if err := json.Unmarshal(data, &vector); err != nil {
		t.Fatal(err)
	}
	return vector
}

func compatibilityPrivateKey(t *testing.T, vector compatibilityVector) ed25519.PrivateKey {
	t.Helper()
	seed := decodeBase64URL(t, vector.PrivateSeedBase64)
	if len(seed) != ed25519.SeedSize {
		t.Fatalf("private seed bytes = %d, want %d", len(seed), ed25519.SeedSize)
	}
	return ed25519.NewKeyFromSeed(seed)
}

func decodeBase64URL(t *testing.T, value string) []byte {
	t.Helper()
	decoded, err := base64.RawURLEncoding.DecodeString(value)
	if err != nil {
		t.Fatal(err)
	}
	return decoded
}