/*
 *
 *    Copyright (c) 2022 Project CHIP Authors
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

#include <inttypes.h>

#include <credentials/PersistentStorageOpCertStore.h>
#include <lib/support/CHIPMem.h>
#include <lib/support/CodeUtils.h>
#include <lib/support/DefaultStorageKeyAllocator.h>
#include <lib/support/Span.h>
#include <lib/support/TestPersistentStorageDelegate.h>
#include <lib/support/UnitTestRegistration.h>
#include <nlunit-test.h>

using namespace chip;
using namespace chip::Credentials;
using CertChainElement = OperationalCertificateStore::CertChainElement;

namespace {

constexpr FabricIndex kFabricIndex1     = 1;
constexpr FabricIndex kFabricIndex2     = 2;
constexpr FabricIndex kOtherFabricIndex = static_cast<FabricIndex>(kFabricIndex1 + 10u);

// The PersistentStorageOpCertStore does not validate cert contents, so we can use simple constants
const uint8_t kTestRcacBuf[] = { 'r', 'c', 'a', 'c' };
const ByteSpan kTestRcacSpan{ kTestRcacBuf };

const uint8_t kTestIcacBuf[] = { 'i', 'c', 'a', 'c' };
const ByteSpan kTestIcacSpan{ kTestIcacBuf };

const uint8_t kTestNocBuf[] = { 'n', 'o', 'c' };
const ByteSpan kTestNocSpan{ kTestNocBuf };

void TestAddNocFlow(nlTestSuite * inSuite, void * inContext)
{
    TestPersistentStorageDelegate storageDelegate;
    PersistentStorageOpCertStore opCertStore;
    DefaultStorageKeyAllocator keyAllocator;

    // Failure before Init
    CHIP_ERROR err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0);

    // Init succeeds
    err = opCertStore.Init(&storageDelegate);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);

    // Manually add existing root for the FabricIndex, should fail AddNewTrustedRootCertForFabric for
    // same fabric but succeed GetCertificate.
    const uint8_t kTestRcacBufExists[] = { 'r', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' };

    err = storageDelegate.SyncSetKeyValue(keyAllocator.FabricRCAC(kFabricIndex1), kTestRcacBufExists, sizeof(kTestRcacBufExists));
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 1);
    NL_TEST_ASSERT(inSuite,
                   opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kRcac) == true); //< From manual add

    err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);

    uint8_t largeBuf[400];
    MutableByteSpan largeSpan{ largeBuf };

    err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);

    largeSpan = MutableByteSpan{ largeBuf };

    err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacBufExists }));

    // Adding root for another FabricIndex should work
    err = opCertStore.AddNewTrustedRootCertForFabric(kUndefinedFabricIndex, kTestRcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INVALID_FABRIC_INDEX);

    err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex2, kTestRcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 1); //< Storage count did not yet increase
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);

    // Should be able to read pending RCAC right away
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));

    // Trying to commit with pending RCAC but no NOC should fail but leave everything as-is
    err = opCertStore.CommitOpCertsForFabric(kFabricIndex2);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);

    // Trying to do AddNewOpCertsForFabric for fabric different that with pending RCAC should fail
    err = opCertStore.AddNewOpCertsForFabric(kOtherFabricIndex, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INVALID_FABRIC_INDEX);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);

    // Clear other bad cases from storage for now
    storageDelegate.ClearStorage();

    // Trying to do AddNewOpCertsForFabric for same fabric as that with pending RCAC should fail
    // if there are already existing NOC chain elements for the given fabric.
    const uint8_t kTestIcacBufExists[] = { 'i', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' };
    const uint8_t kTestNocBufExists[]  = { 'n', 'o', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' };

    err = storageDelegate.SyncSetKeyValue(keyAllocator.FabricICAC(kFabricIndex2), kTestIcacBufExists, sizeof(kTestIcacBufExists));
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 1);

    err = storageDelegate.SyncSetKeyValue(keyAllocator.FabricNOC(kFabricIndex2), kTestNocBufExists, sizeof(kTestNocBufExists));
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 2);

    NL_TEST_ASSERT(inSuite,
                   opCertStore.HasCertificateForFabric(kFabricIndex2, CertChainElement::kIcac) == true);         //< From manual add
    NL_TEST_ASSERT(inSuite, opCertStore.HasCertificateForFabric(kFabricIndex2, CertChainElement::kNoc) == true); //< From manual add

    err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);

    storageDelegate.SyncDeleteKeyValue(keyAllocator.FabricICAC(kFabricIndex2));
    storageDelegate.SyncDeleteKeyValue(keyAllocator.FabricNOC(kFabricIndex2));
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0);

    // Trying to do AddNewOpCertsForFabric for same fabric as that with pending RCAC should succeed
    err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

    // Should be able to get the pending cert even if not in persisted storage
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kIcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacSpan }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kNoc, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocSpan }));

    // Trying to do AddNewOpCertsForFabric a second time after success before commit should fail,
    // but leave state as-is
    err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);

    // Should be able to get the pending cert even if not in persisted storage, after an API error
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kIcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacSpan }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kNoc, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocSpan }));

    // Trying to commit with wrong FabricIndex should fail
    err = opCertStore.CommitOpCertsForFabric(kOtherFabricIndex);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INVALID_FABRIC_INDEX);
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);

    // Commiting new certs should succeed on correct fabric
    err = opCertStore.CommitOpCertsForFabric(kFabricIndex2);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());

    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< All certs now committed

    // Should be able to get the committed certs
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kIcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacSpan }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kNoc, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocSpan }));

    opCertStore.Finish();
}

void TestUpdateNocFlow(nlTestSuite * inSuite, void * inContext)
{
    TestPersistentStorageDelegate storageDelegate;
    PersistentStorageOpCertStore opCertStore;
    DefaultStorageKeyAllocator keyAllocator;

    // Failure before Init
    CHIP_ERROR err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0);

    // Init succeeds
    err = opCertStore.Init(&storageDelegate);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);

    // Add a new pending trusted root to test for UpdateOpCertsForFabric failure on new root present
    err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

    // Trying to do an UpdateOpCertsForFabric with new root pending should fail
    err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

    // Revert state for next tests
    opCertStore.RevertPendingOpCerts();
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

    // Manually add root, ICAC and NOC to validate update since existing chain required
    const uint8_t kTestRcacBufExists[] = { 'r', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' };
    const uint8_t kTestIcacBufExists[] = { 'i', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' };
    const uint8_t kTestNocBufExists[]  = { 'n', 'o', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' };

    uint8_t largeBuf[400];
    MutableByteSpan largeSpan{ largeBuf };

    {
        err =
            storageDelegate.SyncSetKeyValue(keyAllocator.FabricRCAC(kFabricIndex1), kTestRcacBufExists, sizeof(kTestRcacBufExists));
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 1);
        NL_TEST_ASSERT(inSuite,
                       opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kRcac) == true); //< From manual add

        err =
            storageDelegate.SyncSetKeyValue(keyAllocator.FabricICAC(kFabricIndex1), kTestIcacBufExists, sizeof(kTestIcacBufExists));
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 2);
        NL_TEST_ASSERT(inSuite,
                       opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kIcac) == true); //< From manual add

        err = storageDelegate.SyncSetKeyValue(keyAllocator.FabricNOC(kFabricIndex1), kTestNocBufExists, sizeof(kTestNocBufExists));
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3);
        NL_TEST_ASSERT(inSuite,
                       opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kNoc) == true); //< From manual add

        // Test that we can manually stored certs
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacBufExists }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacBufExists }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocBufExists }));
    }

    // Update fails on fabric with wrong FabricIndex
    err = opCertStore.UpdateOpCertsForFabric(kOtherFabricIndex, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

    // Update succeeds on fabric with existing data
    err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain() == true);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3);

    // Can read back existing root unchanged
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacBufExists }));

    // NOC chain elements see the pending updated certs
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacBuf }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocBuf }));

    // Trying update again fails
    err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain() == true);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3);

    // Trying to add a new root after update, before commit/revert fails
    err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain() == true);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3);

    // Trying to add new opcerts for any fabric after update, before commit/revert fails
    err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);

    err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);

    // Committing writes the new values (we even "background-remove" the old ICAC/NOC before commit)
    storageDelegate.SyncDeleteKeyValue(keyAllocator.FabricICAC(kFabricIndex1));
    storageDelegate.SyncDeleteKeyValue(keyAllocator.FabricNOC(kFabricIndex1));
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 1); //< Root remains

    err = opCertStore.CommitOpCertsForFabric(kFabricIndex1);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< All certs now committed

    // Should be able to get the committed cert even if not in persisted storage, after an API error
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacBufExists }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacSpan }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocSpan }));

    // Calling revert doesn't undo the work we just did
    opCertStore.RevertPendingOpCerts();
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< All certs now committed

    // Verify the revert after commit left all data alone
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacBufExists }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacSpan }));

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocSpan }));

    // Verify that RemoveOpCertsForFabric fails on fabric with no data
    err = opCertStore.RemoveOpCertsForFabric(kFabricIndex2);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INVALID_FABRIC_INDEX);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3);

    // Verify that RemoveOpCertsForFabric works for fabric we just updated
    err = opCertStore.RemoveOpCertsForFabric(kFabricIndex1);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); // All keys gone

    opCertStore.Finish();
}

void TestReverts(nlTestSuite * inSuite, void * inContext)
{
    TestPersistentStorageDelegate storageDelegate;
    PersistentStorageOpCertStore opCertStore;

    // Failure before Init
    CHIP_ERROR err = opCertStore.RemoveOpCertsForFabric(kFabricIndex1);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0);

    // Init succeeds
    err = opCertStore.Init(&storageDelegate);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);

    // Add a new pending trusted root
    uint8_t largeBuf[400];
    MutableByteSpan largeSpan{ largeBuf };

    err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

    // Verify we can see the new trusted root
    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestRcacSpan));

    // Verify that after revert, we can't see the root anymore
    opCertStore.RevertPendingOpCerts();
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

    largeSpan = MutableByteSpan{ largeBuf };
    err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
    NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);

    {
        // Add new root again, to then test review of AddNewTrustedCertificates
        err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

        // Add NOC chain
        err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
    }

    // Make sure we can see all pending certs before revert
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestRcacSpan));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestIcacSpan));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestNocSpan));
    }

    // Revert
    opCertStore.RevertPendingOpCerts();
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

    // Verify that after revert, we can't see the root or chain anymore
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);
    }

    // Start again to add a new set, but then let's commit
    {
        // Add new root again, to then test review of AddNewTrustedCertificates
        err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

        // Add NOC chain
        err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
    }

    // Commiting new certs should succeed on correct fabric
    err = opCertStore.CommitOpCertsForFabric(kFabricIndex1);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());

    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< All certs now committed

    // Should be able to get the committed certs
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacSpan }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocSpan }));
    }

    const uint8_t kNewNoc[] = { 'n', 'o', 'c', ' ', 'n', 'e', 'w' };

    // Updating certs should work (NO ICAC)
    err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, ByteSpan{ kNewNoc }, ByteSpan{});
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< No change to keys

    // Should see committed root, pending NOC, absent ICAC
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kIcac));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kNewNoc }));
    }

    // Revert, should be back at previous state
    opCertStore.RevertPendingOpCerts();
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< Storage count did not yet change

    // Should be able to get the previously committed certs
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestIcacSpan }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestNocSpan }));
    }

    // Try again to update with missing ICAC and commit
    err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, ByteSpan{ kNewNoc }, ByteSpan{});
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< No change to keys

    err = opCertStore.CommitOpCertsForFabric(kFabricIndex1);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 2); //< ICAC cert should be gone

    // Should see committed root, new NOC, absent ICAC
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));
        NL_TEST_ASSERT(inSuite, opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kRcac));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kIcac));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kNewNoc }));
        NL_TEST_ASSERT(inSuite, opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kNoc));
    }

    opCertStore.Finish();
}

void TestRevertAddNoc(nlTestSuite * inSuite, void * inContext)
{
    TestPersistentStorageDelegate storageDelegate;
    PersistentStorageOpCertStore opCertStore;

    // Init succeeds
    CHIP_ERROR err = opCertStore.Init(&storageDelegate);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);

    // Add a new pending trusted root
    uint8_t largeBuf[400];
    MutableByteSpan largeSpan{ largeBuf };

    {
        // Add new root
        err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

        // Add NOC chain, with NO ICAC
        err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{});
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
    }

    // Make sure we get expected pending state before revert
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestRcacSpan));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestNocSpan));
    }

    // Revert using RemoveOpCertsForFabric
    err = opCertStore.RemoveOpCertsForFabric(kFabricIndex1);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

    // Add again, and commit
    {
        // Add new root
        err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

        // Add NOC chain, with NO ICAC
        err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{});
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

        err = opCertStore.CommitOpCertsForFabric(kFabricIndex1);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 2); //< We have RCAC, NOC, no ICAC
    }

    // Update to add an ICAC
    const uint8_t kNewIcac[] = { 'i', 'c', 'a', 'c', ' ', 'n', 'e', 'w' };
    const uint8_t kNewNoc[]  = { 'n', 'o', 'c', ' ', 'n', 'e', 'w' };

    // Updating certs should work (NO ICAC)
    err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, ByteSpan{ kNewNoc }, ByteSpan{ kNewIcac });
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 2); //< No change to keys

    // Should see committed root, pending NOC, pending ICAC
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kNewIcac }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kNewNoc }));
    }

    // Commit, should see the new ICAC appear.
    err = opCertStore.CommitOpCertsForFabric(kFabricIndex1);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 3); //< We have RCAC, NOC, ICAC

    // Should see committed root, new NOC, new ICAC
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kTestRcacSpan }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kNewIcac }));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(ByteSpan{ kNewNoc }));
    }

    opCertStore.Finish();
}

void TestRevertPendingOpCertsExceptRoot(nlTestSuite * inSuite, void * inContext)
{
    TestPersistentStorageDelegate storageDelegate;
    PersistentStorageOpCertStore opCertStore;

    // Init succeeds
    CHIP_ERROR err = opCertStore.Init(&storageDelegate);
    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);

    // Add a new pending trusted root
    uint8_t largeBuf[400];
    MutableByteSpan largeSpan{ largeBuf };

    {
        // Add new root
        err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

        // Add NOC chain, with NO ICAC
        err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{});
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
    }

    // Make sure we get expected pending state before revert
    {
        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestRcacSpan));

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_NOT_FOUND);

        largeSpan = MutableByteSpan{ largeBuf };
        err       = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, largeSpan.data_equal(kTestNocSpan));
    }

    // Revert using RevertPendingOpCertsExceptRoot
    opCertStore.RevertPendingOpCertsExceptRoot();
    NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
    NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
    NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

    // Add again, and commit
    {
        // Add new root: should fail, since it should still be pending
        err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan);
        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_INCORRECT_STATE);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());

        // Add NOC chain, with NO ICAC
        err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{});
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, opCertStore.HasPendingRootCert() == true);
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 0); //< Storage count did not yet increase

        err = opCertStore.CommitOpCertsForFabric(kFabricIndex1);
        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingRootCert());
        NL_TEST_ASSERT(inSuite, !opCertStore.HasPendingNocChain());
        NL_TEST_ASSERT(inSuite, storageDelegate.GetNumKeys() == 2); //< We have RCAC, NOC, no ICAC
    }

    opCertStore.Finish();
}

/**
 *   Test Suite. It lists all the test functions.
 */
static const nlTest sTests[] = {
    NL_TEST_DEF("Test AddNOC-like flows PersistentStorageOpCertStore", TestAddNocFlow),
    NL_TEST_DEF("Test UpdateNOC-like flows PersistentStorageOpCertStore", TestUpdateNocFlow),
    NL_TEST_DEF("Test revert operations of PersistentStorageOpCertStore", TestReverts),
    NL_TEST_DEF("Test revert operations with AddNOC of PersistentStorageOpCertStore", TestRevertAddNoc),
    NL_TEST_DEF("Test revert operations using RevertPendingOpCertsExceptRoot", TestRevertPendingOpCertsExceptRoot),
    NL_TEST_SENTINEL()
};

/**
 *  Set up the test suite.
 */
int Test_Setup(void * inContext)
{
    CHIP_ERROR error = chip::Platform::MemoryInit();
    VerifyOrReturnError(error == CHIP_NO_ERROR, FAILURE);
    return SUCCESS;
}

/**
 *  Tear down the test suite.
 */
int Test_Teardown(void * inContext)
{
    chip::Platform::MemoryShutdown();
    return SUCCESS;
}

} // namespace

/**
 *  Main
 */
int TestPersistentStorageOpCertStore()
{
    nlTestSuite theSuite = { "PersistentStorageOpCertStore tests", &sTests[0], Test_Setup, Test_Teardown };

    // Run test suite againt one context.
    nlTestRunner(&theSuite, nullptr);
    return nlTestRunnerStats(&theSuite);
}

CHIP_REGISTER_TEST_SUITE(TestPersistentStorageOpCertStore)