/*
 *
 *    Copyright (c) 2026 Project CHIP Authors
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

#include <pw_unit_test/framework.h>

#include <app/ClusterStateCache.h>
#include <app/ConcreteAttributePath.h>
#include <app/ReadClient.h>
#include <app/data-model/Encode.h>
#include <controller/CHIPDeviceController.h>
#include <controller/CommissioningDelegate.h>
#include <controller/tests/DeviceCommissionerTestAccess.h>
#include <platform/CHIPDeviceLayer.h>

#include <clusters/OperationalCredentials/Attributes.h>
#include <clusters/OperationalCredentials/ClusterId.h>
#include <clusters/OperationalCredentials/Enums.h>
#include <clusters/OperationalCredentials/Structs.h>

using namespace chip;
using namespace chip::app;
using namespace chip::app::Clusters;
using namespace chip::Controller;
using namespace chip::Testing;

namespace {

class MockClusterStateCache : public ClusterStateCache
{
public:
    MockClusterStateCache() : ClusterStateCache(mCallback) {}

    template <typename AttrType>
    CHIP_ERROR SetAttribute(const ConcreteAttributePath & path, const AttrType & data)
    {
        Platform::ScopedMemoryBufferWithSize<uint8_t> handle;
        handle.Calloc(3000);
        TLV::ScopedBufferTLVWriter writer(std::move(handle), 3000);
        ReturnErrorOnFailure(DataModel::Encode(writer, TLV::AnonymousTag(), data));
        uint32_t writtenLength = writer.GetLengthWritten();
        ReturnErrorOnFailure(writer.Finalize(handle));

        TLV::ScopedBufferTLVReader reader;
        StatusIB status;
        reader.Init(std::move(handle), writtenLength);
        ReturnErrorOnFailure(reader.Next());
        ReadClient::Callback & cb = GetBufferedCallback();
        cb.OnAttributeData(path, &reader, status);

        return CHIP_NO_ERROR;
    }

private:
    class MockCallback : public ClusterStateCache::Callback
    {
        void OnDone(ReadClient *) override {}
        void OnAttributeData(const ConcreteDataAttributePath & aPath, TLV::TLVReader * apData, const StatusIB & aStatus) override {}
    };

    MockCallback mCallback;
};

class TestParseOperationalCredentialsInfo : public ::testing::Test
{
public:
    static void SetUpTestSuite() { ASSERT_EQ(chip::Platform::MemoryInit(), CHIP_NO_ERROR); }
    static void TearDownTestSuite() { chip::Platform::MemoryShutdown(); }

protected:
    DeviceCommissioner mCommissioner{};
};

TEST_F(TestParseOperationalCredentialsInfo, LegacyFeatureMapDefaultsToLegacyProfile)
{
    auto cache = Platform::MakeUnique<MockClusterStateCache>();
    ASSERT_NE(cache, nullptr);

    BitFlags<OperationalCredentials::Feature> featureMap;
    ConcreteAttributePath featureMapPath(kRootEndpointId, OperationalCredentials::Id,
                                         OperationalCredentials::Attributes::FeatureMap::Id);
    ASSERT_EQ(cache->SetAttribute(featureMapPath, *featureMap.RawStorage()), CHIP_NO_ERROR);

    DeviceCommissionerTestAccess access(&mCommissioner);
    access.SetAttributeCache(Platform::UniquePtr<ClusterStateCache>(cache.release()));

    ReadCommissioningInfo info{};
    ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
    EXPECT_FALSE(info.supportsPqcDeviceAttestation);
    EXPECT_TRUE(info.paiSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
    EXPECT_TRUE(info.dacSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
}

TEST_F(TestParseOperationalCredentialsInfo, FeatureMapStatusErrorFallsBackToLegacy)
{
    using OperationalCredentials::AttestationCryptoProfileBitmap;

    auto cache = Platform::MakeUnique<MockClusterStateCache>();
    ASSERT_NE(cache, nullptr);

    // An unavailable FeatureMap must select pre-PQC attestation instead of failing commissioning.
    ConcreteDataAttributePath featureMapPath(kRootEndpointId, OperationalCredentials::Id,
                                             OperationalCredentials::Attributes::FeatureMap::Id);
    ReadClient::Callback & callback = cache->GetBufferedCallback();
    callback.OnAttributeData(featureMapPath, nullptr, StatusIB(Protocols::InteractionModel::Status::UnsupportedAttribute));

    DeviceCommissionerTestAccess access(&mCommissioner);
    access.SetAttributeCache(Platform::UniquePtr<ClusterStateCache>(cache.release()));

    ReadCommissioningInfo info{};
    info.supportsPqcDeviceAttestation = true;
    info.paiSupportedAttestationProfiles.Set(AttestationCryptoProfileBitmap::kSupportsMlDsa65);
    info.dacSupportedAttestationProfiles.Set(AttestationCryptoProfileBitmap::kSupportsMlDsa44);

    ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
    EXPECT_FALSE(info.supportsPqcDeviceAttestation);
    EXPECT_EQ(info.paiSupportedAttestationProfiles.Raw(),
              BitMask<AttestationCryptoProfileBitmap>(AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy).Raw());
    EXPECT_EQ(info.dacSupportedAttestationProfiles.Raw(),
              BitMask<AttestationCryptoProfileBitmap>(AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy).Raw());
}

TEST_F(TestParseOperationalCredentialsInfo, PqcFeaturePreservesIndependentPaiAndDacProfiles)
{
    auto cache = Platform::MakeUnique<MockClusterStateCache>();
    ASSERT_NE(cache, nullptr);

    BitFlags<OperationalCredentials::Feature> featureMap(OperationalCredentials::Feature::kPQCDeviceAttestation);
    ConcreteAttributePath featureMapPath(kRootEndpointId, OperationalCredentials::Id,
                                         OperationalCredentials::Attributes::FeatureMap::Id);
    ASSERT_EQ(cache->SetAttribute(featureMapPath, *featureMap.RawStorage()), CHIP_NO_ERROR);

    OperationalCredentials::Structs::PQCDeviceAttestationProfileStruct::Type profileSupport;
    profileSupport.PAASupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy,
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa44);
    profileSupport.PAISupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy,
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa65);
    profileSupport.DACSupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy,
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa44);

    ConcreteAttributePath profilePath(kRootEndpointId, OperationalCredentials::Id,
                                      OperationalCredentials::Attributes::PQCDeviceAttestationProfile::Id);
    ASSERT_EQ(cache->SetAttribute(profilePath, profileSupport), CHIP_NO_ERROR);

    DeviceCommissionerTestAccess access(&mCommissioner);
    access.SetAttributeCache(Platform::UniquePtr<ClusterStateCache>(cache.release()));

    ReadCommissioningInfo info{};
    ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
    EXPECT_TRUE(info.supportsPqcDeviceAttestation);
    EXPECT_TRUE(info.paiSupportedAttestationProfiles.Has(OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa65));
    EXPECT_FALSE(
        info.paiSupportedAttestationProfiles.Has(OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa44));
    EXPECT_TRUE(info.dacSupportedAttestationProfiles.Has(OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa44));
    EXPECT_FALSE(
        info.dacSupportedAttestationProfiles.Has(OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa65));
}

TEST_F(TestParseOperationalCredentialsInfo, RetainsLargestPaaProfileAndClearsItOnLegacyFallback)
{
    using Profile  = OperationalCredentials::AttestationCryptoProfileEnum;
    using Profiles = OperationalCredentials::AttestationCryptoProfileBitmap;
    for (const uint16_t bitmap : { uint16_t(1), uint16_t(3), uint16_t(5), uint16_t(7), uint16_t(9) })
    {
        auto cache      = Platform::MakeUnique<MockClusterStateCache>();
        auto * cachePtr = cache.get();
        const ConcreteAttributePath featurePath(kRootEndpointId, OperationalCredentials::Id,
                                                OperationalCredentials::Attributes::FeatureMap::Id);
        ASSERT_EQ(cache->SetAttribute(featurePath, uint32_t(1)), CHIP_NO_ERROR);
        OperationalCredentials::Structs::PQCDeviceAttestationProfileStruct::Type profiles;
        profiles.PAASupportedProfiles = BitMask<Profiles>(bitmap);
        profiles.PAISupportedProfiles = BitMask<Profiles>(Profiles::kSupportsEcdsaMatterLegacy, Profiles::kSupportsMlDsa44);
        profiles.DACSupportedProfiles = BitMask<Profiles>(Profiles::kSupportsEcdsaMatterLegacy);
        ASSERT_EQ(cache->SetAttribute(ConcreteAttributePath(kRootEndpointId, OperationalCredentials::Id,
                                                            OperationalCredentials::Attributes::PQCDeviceAttestationProfile::Id),
                                      profiles),
                  CHIP_NO_ERROR);
        DeviceCommissionerTestAccess access(&mCommissioner);
        access.SetAttributeCache(Platform::UniquePtr<ClusterStateCache>(cache.release()));
        ReadCommissioningInfo info;
        ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
        if (bitmap == 9)
        {
            EXPECT_FALSE(access.PaaAttestationIssuerProfile().HasValue());
        }
        else
        {
            ASSERT_TRUE(access.PaaAttestationIssuerProfile().HasValue());
            EXPECT_EQ(access.PaaAttestationIssuerProfile().Value(),
                      bitmap >= 5       ? Profile::kMlDsa65
                          : bitmap == 3 ? Profile::kMlDsa44
                                        : Profile::kEcdsaMatterLegacy);
        }
        ASSERT_EQ(cachePtr->SetAttribute(featurePath, uint32_t(0)), CHIP_NO_ERROR);
        ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
        EXPECT_FALSE(access.PaaAttestationIssuerProfile().HasValue());
    }
}

TEST_F(TestParseOperationalCredentialsInfo, PqcFeatureFallsBackToLegacyWhenDacDoesNotAdvertiseLegacy)
{
    auto cache = Platform::MakeUnique<MockClusterStateCache>();
    ASSERT_NE(cache, nullptr);

    BitFlags<OperationalCredentials::Feature> featureMap(OperationalCredentials::Feature::kPQCDeviceAttestation);
    ConcreteAttributePath featureMapPath(kRootEndpointId, OperationalCredentials::Id,
                                         OperationalCredentials::Attributes::FeatureMap::Id);
    ASSERT_EQ(cache->SetAttribute(featureMapPath, *featureMap.RawStorage()), CHIP_NO_ERROR);

    OperationalCredentials::Structs::PQCDeviceAttestationProfileStruct::Type profileSupport;
    profileSupport.PAASupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy,
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa44);
    profileSupport.PAISupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy,
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa44);
    profileSupport.DACSupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsMlDsa44);

    ConcreteAttributePath profilePath(kRootEndpointId, OperationalCredentials::Id,
                                      OperationalCredentials::Attributes::PQCDeviceAttestationProfile::Id);
    ASSERT_EQ(cache->SetAttribute(profilePath, profileSupport), CHIP_NO_ERROR);

    DeviceCommissionerTestAccess access(&mCommissioner);
    access.SetAttributeCache(Platform::UniquePtr<ClusterStateCache>(cache.release()));

    ReadCommissioningInfo info{};
    ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
    EXPECT_FALSE(info.supportsPqcDeviceAttestation);
    EXPECT_TRUE(info.paiSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
    EXPECT_TRUE(info.dacSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
}

TEST_F(TestParseOperationalCredentialsInfo, PqcFeatureFallsBackToLegacyWhenNoPqcIssuerIsAdvertised)
{
    auto cache = Platform::MakeUnique<MockClusterStateCache>();
    ASSERT_NE(cache, nullptr);

    BitFlags<OperationalCredentials::Feature> featureMap(OperationalCredentials::Feature::kPQCDeviceAttestation);
    ConcreteAttributePath featureMapPath(kRootEndpointId, OperationalCredentials::Id,
                                         OperationalCredentials::Attributes::FeatureMap::Id);
    ASSERT_EQ(cache->SetAttribute(featureMapPath, *featureMap.RawStorage()), CHIP_NO_ERROR);

    OperationalCredentials::Structs::PQCDeviceAttestationProfileStruct::Type profileSupport;
    profileSupport.PAASupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy);
    profileSupport.PAISupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy);
    profileSupport.DACSupportedProfiles = BitMask<OperationalCredentials::AttestationCryptoProfileBitmap>(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy);

    ConcreteAttributePath profilePath(kRootEndpointId, OperationalCredentials::Id,
                                      OperationalCredentials::Attributes::PQCDeviceAttestationProfile::Id);
    ASSERT_EQ(cache->SetAttribute(profilePath, profileSupport), CHIP_NO_ERROR);

    DeviceCommissionerTestAccess access(&mCommissioner);
    access.SetAttributeCache(Platform::UniquePtr<ClusterStateCache>(cache.release()));

    ReadCommissioningInfo info{};
    ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
    EXPECT_FALSE(info.supportsPqcDeviceAttestation);
    EXPECT_TRUE(info.paiSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
    EXPECT_TRUE(info.dacSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
}

TEST_F(TestParseOperationalCredentialsInfo, PqcFeatureFallsBackToLegacyWhenProfileAttributeIsMissing)
{
    auto cache = Platform::MakeUnique<MockClusterStateCache>();
    ASSERT_NE(cache, nullptr);

    BitFlags<OperationalCredentials::Feature> featureMap(OperationalCredentials::Feature::kPQCDeviceAttestation);
    ConcreteAttributePath featureMapPath(kRootEndpointId, OperationalCredentials::Id,
                                         OperationalCredentials::Attributes::FeatureMap::Id);
    ASSERT_EQ(cache->SetAttribute(featureMapPath, *featureMap.RawStorage()), CHIP_NO_ERROR);

    DeviceCommissionerTestAccess access(&mCommissioner);
    access.SetAttributeCache(Platform::UniquePtr<ClusterStateCache>(cache.release()));

    ReadCommissioningInfo info{};
    ASSERT_EQ(access.ParseOperationalCredentialsInfo(info), CHIP_NO_ERROR);
    EXPECT_FALSE(info.supportsPqcDeviceAttestation);
    EXPECT_TRUE(info.paiSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
    EXPECT_TRUE(info.dacSupportedAttestationProfiles.Has(
        OperationalCredentials::AttestationCryptoProfileBitmap::kSupportsEcdsaMatterLegacy));
}

} // namespace