require_relative '../test_helper'
require 'stringio'

module SymmetricEncryption
  module Utils
    class AwsTest < Minitest::Test
      describe SymmetricEncryption::Utils::Aws do
        before do
          unless (ENV['AWS_ACCESS_KEY_ID'] && ENV['AWS_SECRET_ACCESS_KEY']) || ENV['AWS_CONFIG_FILE']
            # For example: export AWS_CONFIG_FILE=~/.aws/credentials
            skip 'Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or AWS_CONFIG_FILE to run AWS KMS tests'
          end
        end

        let :region do
          'us-east-1'
        end

        let :master_key_alias do
          'alias/symmetric-encryption/test'
        end

        let :aws do
          SymmetricEncryption::Utils::Aws.new(region: region, master_key_alias: master_key_alias)
        end

        describe '#key_spec' do
          it 'converts aes-256-cbc' do
            assert_equal 'AES_256', aws.key_spec('aes-256-cbc')
          end

          it 'converts aes-128-cbc' do
            assert_equal 'AES_128', aws.key_spec('aes-128-cbc')
          end
        end

        describe '#create_master_key' do
          it 'creates a new master key' do
            skip 'Only run if really needed, gets tested once as part of the CMK auto-create'
            aws.delete_master_key(retention_days: 7)
            aws.create_master_key
          end
        end

        describe '#generate_data_key' do
          it 'creates a new data key' do
            assert aws.generate_data_key('aes-128-cbc')
          end
        end

        describe '#generate_encrypted_data_key' do
          it 'creates a new data key' do
            assert aws.generate_encrypted_data_key('aes-128-cbc')
          end
        end

        describe '#encrypt' do
          it 'encrypts a block of data' do
            assert aws.encrypt('hello')
          end
        end

        describe '#decrypt' do
          it 'decrypts a previously encrypted block of data' do
            message   = 'hello world this is a top secret message'
            encrypted = aws.encrypt(message)
            decrypted = aws.decrypt(encrypted)
            assert_equal message, decrypted
          end
        end
      end
    end
  end
end