client_test.go

package dnapi

import (
	"bytes"
	"context"
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/rand"
	"crypto/sha256"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log/slog"
	"net"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/DefinedNet/dnapi/dnapitest"
	"github.com/DefinedNet/dnapi/internal/testutil"
	"github.com/DefinedNet/dnapi/keys"
	"github.com/DefinedNet/dnapi/message"
	"github.com/slackhq/nebula/cert"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"gopkg.in/yaml.v2"
)

type m map[string]interface{}

// dropTimeAttr is a slog.HandlerOptions.ReplaceAttr that drops the time
// attribute from a record, so JSON output is deterministic in tests.
func dropTimeAttr(_ []string, a slog.Attr) slog.Attr {
	if a.Key == slog.TimeKey {
		return slog.Attr{}
	}
	return a
}

func TestEnroll(t *testing.T) {
	t.Parallel()

	useragent := "dnclientUnitTests/1.0.0 (not a real client)"
	ts := dnapitest.NewServer(useragent)
	client := NewClient(useragent, ts.URL)
	// attempting to defer ts.Close() will trigger early due to parallel testing - use T.Cleanup instead
	t.Cleanup(func() { ts.Close() })

	// Happy path enrollment
	code := "abcdef"
	orgID := "foobaz"
	orgName := "foobar's foo org"
	netID := "qux"
	netName := "the best network"
	netCurve := message.NetworkCurve25519
	netCIDR := "192.168.100.0/24"
	hostID := "foobar"
	hostName := "foo host"
	hostIP := "192.168.100.1"
	oidcEmail := "demo@defined.net"
	oidcExpiresAt := time.Now()
	counter := uint(5)
	hostname := "test-machine.local"
	ca, _ := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			// we need to send this or we'll get an error from the api client
			"pki": m{"ca": string(caPEM)},
			// here we reflect values back to the client for test purposes
			"test": m{"code": req.Code, "dhPubkey": req.NebulaPubkeyX25519, "hostname": req.Hostname},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      hostID,
				Counter:     counter,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   orgID,
					Name: orgName,
				},
				Network: message.HostNetworkMetadata{
					ID:    netID,
					Name:  netName,
					Curve: netCurve,
					CIDR:  netCIDR,
				},
				Host: message.HostHostMetadata{
					ID:        hostID,
					Name:      hostName,
					IPAddress: hostIP,
				},
				EndpointOIDCMeta: &message.HostEndpointOIDCMetadata{
					Email:     oidcEmail,
					ExpiresAt: &oidcExpiresAt,
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	cfg, pkey, creds, meta, err := client.Enroll(ctx, testutil.NewTestLogger(), code, hostname)
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	tk, err := keys.NewTrustedKey(ed25519.PublicKey(ca.PublicKey()))
	require.NoError(t, err)

	assert.Equal(t, hostID, creds.HostID)
	assert.Equal(t, counter, creds.Counter)
	assert.Equal(t, []keys.TrustedKey{tk}, creds.TrustedKeys)
	assert.NotEmpty(t, creds.PrivateKey)
	assert.NotEmpty(t, pkey)

	var y struct {
		PKI struct {
			Key string `yaml:"key"`
		} `yaml:"pki"`
		Test struct {
			Code     string `yaml:"code"`
			DHPubkey []byte `yaml:"dhPubkey"`
			Hostname string `yaml:"hostname"`
		} `yaml:"test"`
	}
	err = yaml.Unmarshal(cfg, &y)
	require.NoError(t, err)
	_, rest, _, err := cert.UnmarshalPublicKeyFromPEM(y.Test.DHPubkey)
	assert.NoError(t, err)
	assert.Len(t, rest, 0)
	assert.Equal(t, code, y.Test.Code)
	assert.Equal(t, hostname, y.Test.Hostname)

	// ensure private key was not inserted into config
	assert.Empty(t, y.PKI.Key)

	// test meta
	assert.Equal(t, orgID, meta.Org.ID)
	assert.Equal(t, orgName, meta.Org.Name)
	assert.Equal(t, netID, meta.Network.ID)
	assert.Equal(t, netName, meta.Network.Name)
	assert.Equal(t, hostID, meta.Host.ID)
	assert.Equal(t, hostName, meta.Host.Name)
	assert.Equal(t, []string{hostIP}, meta.Host.IPAddresses)
	assert.Equal(t, oidcEmail, meta.EndpointOIDC.Email)
	assert.WithinDuration(t, oidcExpiresAt, *meta.EndpointOIDC.ExpiresAt, 1*time.Second)

	// Test error handling
	errorMsg := "invalid enrollment code"
	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Errors: message.APIResponseErrors{{
				Code:    "ERR_INVALID_ENROLLMENT_CODE",
				Message: errorMsg,
			}},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	cfg, pkey, creds, meta, err = client.Enroll(ctx, testutil.NewTestLogger(), code, "")
	require.EqualError(t, err, "unexpected error during enrollment: "+errorMsg)

	assert.Nil(t, cfg)
	assert.Nil(t, pkey)
	assert.Nil(t, creds)
	assert.Nil(t, meta)
	apiError := &APIError{}
	reqIDErrPresent := errors.As(err, &apiError)
	require.True(t, reqIDErrPresent)
	assert.Equal(t, apiError.ReqID, "SupaDoopaRequestIdentifier")
}

func TestDoUpdate(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	t.Cleanup(func() { ts.Close() })

	ca, caPrivkey := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	c := NewClient(useragent, ts.URL)

	code := "foobar"
	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			// we need to send this or we'll get an error from the api client
			"pki": m{"ca": string(caPEM)},
			// here we reflect values back to the client for test purposes
			"test": m{"code": req.Code, "dhPubkey": req.NebulaPubkeyX25519},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      "foobar",
				Counter:     1,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   "foobaz",
					Name: "foobar's foo org",
				},
				Network: message.HostNetworkMetadata{
					ID:    "qux",
					Name:  "the best network",
					Curve: message.NetworkCurve25519,
					CIDR:  "192.168.100.0/24",
				},
				Host: message.HostHostMetadata{
					ID:        "quux",
					Name:      "foo host",
					IPAddress: "192.168.100.2",
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	config, pkey, creds, _, err := c.Enroll(ctx, testutil.NewTestLogger(), "foobar", "")
	require.NoError(t, err)

	// convert privkey to private key
	pubkey, err := keys.MarshalHostEd25519PublicKey(creds.PrivateKey.Public().Unwrap().(ed25519.PublicKey))
	require.NoError(t, err)

	// make sure all credential values were set
	assert.NotEmpty(t, creds.HostID)
	assert.NotEmpty(t, creds.PrivateKey)
	assert.NotEmpty(t, creds.TrustedKeys)
	assert.NotEmpty(t, creds.Counter)

	// make sure we got a config back
	assert.NotEmpty(t, config)
	assert.NotEmpty(t, pkey)

	// Invalid request signature should return a specific error
	ts.ExpectDNClientRequest(message.CheckForUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		return []byte("")
	})

	// Create a new, invalid requesting authentication key
	nk, err := keys.New()
	require.NoError(t, err)

	invalidCreds := keys.Credentials{
		HostID:      creds.HostID,
		PrivateKey:  nk.HostEd25519PrivateKey,
		Counter:     creds.Counter,
		TrustedKeys: creds.TrustedKeys,
	}

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, err = c.CheckForUpdate(ctx, invalidCreds)
	assert.Error(t, err)
	assert.ErrorIs(t, err, ErrInvalidCredentials)
	serverErrs := ts.Errors() // This consumes/resets the server errors
	require.Len(t, serverErrs, 1)

	// Invalid signature
	ts.ExpectDNClientRequest(message.DoUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoUpdateResponse{
			Config:      dnapitest.NebulaCfg(caPEM),
			Counter:     2,
			Nonce:       dnapitest.GetNonce(r),
			TrustedKeys: ca.MarshalPublicKeyPEM(),
			Organization: message.HostOrgMetadata{
				ID:   "foobaz",
				Name: "foobar's foo org",
			},
			Network: message.HostNetworkMetadata{
				ID:    "qux",
				Name:  "the best network",
				Curve: message.NetworkCurve25519,
				CIDR:  "192.168.100.0/24",
			},
			Host: message.HostHostMetadata{
				ID:        "quux",
				Name:      "foo host",
				IPAddress: "192.168.100.2",
			},
		}
		rawRes := jsonMarshal(newConfigResponse)

		nk, err := keys.New()
		require.NoError(t, err)

		// XXX the mock server will update the ed pubkey for us, but this is problematic because
		// we are rejecting the update. reset the key
		err = ts.SetEdPubkey(pubkey)
		require.NoError(t, err)

		sig, err := nk.HostEd25519PrivateKey.Sign(rawRes)
		require.NoError(t, err)

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: sig,
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	cfg, pkey, newCreds, _, err := c.DoUpdate(ctx, *creds)
	require.Error(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())
	require.Nil(t, newCreds)
	require.Nil(t, cfg)
	require.Nil(t, pkey)

	// Invalid counter
	ts.ExpectDNClientRequest(message.DoUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoUpdateResponse{
			Config:      dnapitest.NebulaCfg(caPEM),
			Counter:     0,
			Nonce:       dnapitest.GetNonce(r),
			TrustedKeys: ca.MarshalPublicKeyPEM(),
			Organization: message.HostOrgMetadata{
				ID:   "foobaz",
				Name: "foobar's foo org",
			},
			Network: message.HostNetworkMetadata{
				ID:    "qux",
				Name:  "the best network",
				Curve: message.NetworkCurve25519,
				CIDR:  "192.168.100.0/24",
			},
			Host: message.HostHostMetadata{
				ID:        "quux",
				Name:      "foo host",
				IPAddress: "192.168.100.2",
			},
		}
		rawRes := jsonMarshal(newConfigResponse)

		// XXX the mock server will update the ed pubkey for us, but this is problematic because
		// we are rejecting the update. reset the key
		err := ts.SetEdPubkey(pubkey)
		require.NoError(t, err)

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: ed25519.Sign(caPrivkey, rawRes),
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	cfg, pkey, newCreds, _, err = c.DoUpdate(ctx, *creds)
	require.Error(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())
	require.Nil(t, newCreds)
	require.Nil(t, cfg)
	require.Nil(t, pkey)

	orgID := "foobaz"
	orgName := "foobar's foo org"
	netID := "qux"
	netName := "the best network"
	netCurve := message.NetworkCurve25519
	netCIDR := "192.168.100.0/24"
	hostID := "foobar"
	hostName := "foo host"
	hostIP := "192.168.100.1"
	oidcEmail := "demo@defined.net"

	// This time sign the response with the correct CA key.
	ts.ExpectDNClientRequest(message.DoUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoUpdateResponse{
			Config:      dnapitest.NebulaCfg(caPEM),
			Counter:     3,
			Nonce:       dnapitest.GetNonce(r),
			TrustedKeys: ca.MarshalPublicKeyPEM(),
			Organization: message.HostOrgMetadata{
				ID:   orgID,
				Name: orgName,
			},
			Network: message.HostNetworkMetadata{
				ID:    netID,
				Name:  netName,
				Curve: netCurve,
				CIDR:  netCIDR,
			},
			Host: message.HostHostMetadata{
				ID:        hostID,
				Name:      hostName,
				IPAddress: hostIP,
			},
			EndpointOIDCMeta: &message.HostEndpointOIDCMetadata{
				Email:     oidcEmail,
				ExpiresAt: nil,
			},
		}
		rawRes := jsonMarshal(newConfigResponse)

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: ed25519.Sign(caPrivkey, rawRes),
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, _, _, meta, err := c.DoUpdate(ctx, *creds)
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	// test meta
	assert.Equal(t, orgID, meta.Org.ID)
	assert.Equal(t, orgName, meta.Org.Name)
	assert.Equal(t, netID, meta.Network.ID)
	assert.Equal(t, netName, meta.Network.Name)
	assert.Equal(t, hostID, meta.Host.ID)
	assert.Equal(t, hostName, meta.Host.Name)
	assert.Equal(t, []string{hostIP}, meta.Host.IPAddresses)
	assert.Equal(t, oidcEmail, meta.EndpointOIDC.Email)
	assert.Nil(t, meta.EndpointOIDC.ExpiresAt)

}

func TestDoConfigUpdate(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	t.Cleanup(func() { ts.Close() })

	ca, caPrivkey := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	c := NewClient(useragent, ts.URL)

	code := "foobar"
	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			"pki": m{"ca": string(caPEM)},
		})
		require.NoError(t, err)

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      "foobar",
				Counter:     1,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   "foobaz",
					Name: "foobar's foo org",
				},
				Network: message.HostNetworkMetadata{
					ID:    "qux",
					Name:  "the best network",
					Curve: message.NetworkCurve25519,
					CIDR:  "192.168.100.0/24",
				},
				Host: message.HostHostMetadata{
					ID:        "quux",
					Name:      "foo host",
					IPAddress: "192.168.100.2",
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, _, creds, _, err := c.Enroll(ctx, testutil.NewTestLogger(), code, "")
	require.NoError(t, err)

	orgID := "foobaz"
	orgName := "foobar's foo org"
	netID := "qux"
	netName := "the best network"
	hostID := "foobar"
	hostName := "foo host"
	hostIP := "192.168.100.1"
	oidcEmail := "demo@defined.net"
	oidcExpiresAt := time.Now().Add(24 * time.Hour).UTC().Truncate(time.Second)

	ts.ExpectDNClientRequest(message.DoConfigUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoConfigUpdateResponse{
			Config:      dnapitest.NebulaCfg(caPEM),
			Counter:     2,
			Nonce:       dnapitest.GetNonce(r),
			TrustedKeys: ca.MarshalPublicKeyPEM(),
			Organization: message.HostOrgMetadata{
				ID:   orgID,
				Name: orgName,
			},
			Network: message.HostNetworkMetadata{
				ID:    netID,
				Name:  netName,
				Curve: message.NetworkCurve25519,
				CIDR:  "192.168.100.0/24",
			},
			Host: message.HostHostMetadata{
				ID:        hostID,
				Name:      hostName,
				IPAddress: hostIP,
			},
			EndpointOIDCMeta: &message.HostEndpointOIDCMetadata{
				Email:     oidcEmail,
				ExpiresAt: &oidcExpiresAt,
			},
		}
		rawRes := jsonMarshal(newConfigResponse)

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: ed25519.Sign(caPrivkey, rawRes),
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, _, meta, err := c.DoConfigUpdate(ctx, *creds)
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	assert.Equal(t, orgID, meta.Org.ID)
	assert.Equal(t, orgName, meta.Org.Name)
	assert.Equal(t, netID, meta.Network.ID)
	assert.Equal(t, netName, meta.Network.Name)
	assert.Equal(t, hostID, meta.Host.ID)
	assert.Equal(t, hostName, meta.Host.Name)
	assert.Equal(t, []string{hostIP}, meta.Host.IPAddresses)
	require.NotNil(t, meta.EndpointOIDC)
	assert.Equal(t, oidcEmail, meta.EndpointOIDC.Email)
	require.NotNil(t, meta.EndpointOIDC.ExpiresAt)
	assert.WithinDuration(t, oidcExpiresAt, *meta.EndpointOIDC.ExpiresAt, time.Second)
}

func TestDoUpdate_P256(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	t.Cleanup(func() { ts.Close() })

	ca, caPrivkey := dnapitest.NebulaCACertP256()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	c := NewClient(useragent, ts.URL)

	code := "foobar"
	ts.ExpectEnrollment(code, message.NetworkCurveP256, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			// we need to send this or we'll get an error from the api client
			"pki": m{"ca": string(caPEM)},
			// here we reflect values back to the client for test purposes
			"test": m{"code": req.Code, "p256Pubkey": req.NebulaPubkeyP256},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      "foobar",
				Counter:     1,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   "foobaz",
					Name: "foobar's foo org",
				},
				Network: message.HostNetworkMetadata{
					ID:    "qux",
					Name:  "the best network",
					Curve: message.NetworkCurveP256,
					CIDR:  "192.168.100.0/24",
				},
				Host: message.HostHostMetadata{
					ID:        "quux",
					Name:      "foo host",
					IPAddress: "192.168.100.2",
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	config, pkey, creds, _, err := c.Enroll(ctx, testutil.NewTestLogger(), "foobar", "")
	require.NoError(t, err)

	// convert private key to public key
	pubkey, err := keys.MarshalHostP256PublicKey(creds.PrivateKey.Public().Unwrap().(*ecdsa.PublicKey))
	require.NoError(t, err)

	// make sure all credential values were set
	assert.NotEmpty(t, creds.HostID)
	assert.NotEmpty(t, creds.PrivateKey)
	assert.NotEmpty(t, creds.TrustedKeys)
	assert.NotEmpty(t, creds.Counter)

	// make sure we got a config back
	assert.NotEmpty(t, config)
	assert.NotEmpty(t, pkey)

	// Invalid request signature should return a specific error
	ts.ExpectDNClientRequest(message.CheckForUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		return []byte("")
	})

	// Create a new, invalid requesting authentication key
	nk, err := keys.New()
	require.NoError(t, err)
	invalidCreds := keys.Credentials{
		HostID:      creds.HostID,
		PrivateKey:  nk.HostP256PrivateKey,
		Counter:     creds.Counter,
		TrustedKeys: creds.TrustedKeys,
	}

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, err = c.CheckForUpdate(ctx, invalidCreds)
	assert.Error(t, err)
	assert.ErrorIs(t, err, ErrInvalidCredentials)
	serverErrs := ts.Errors() // This consumes/resets the server errors
	require.Len(t, serverErrs, 1)

	// Invalid signature
	ts.ExpectDNClientRequest(message.DoUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoUpdateResponse{
			Config:  dnapitest.NebulaCfg(caPEM),
			Counter: 2,
			Nonce:   dnapitest.GetNonce(r),
		}
		rawRes := jsonMarshal(newConfigResponse)

		nk, err := keys.New()
		require.NoError(t, err)

		// XXX the mock server will update the ed pubkey for us, but this is problematic because
		// we are rejecting the update. reset the key
		err = ts.SetP256Pubkey(pubkey)
		require.NoError(t, err)

		sig, err := nk.HostP256PrivateKey.Sign(rawRes)
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_SIGN_MESSAGE",
					Message: "failed to sign message",
				}},
			})
		}

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: sig,
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	cfg, pkey, newCreds, _, err := c.DoUpdate(ctx, *creds)
	require.Error(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())
	require.Nil(t, newCreds)
	require.Nil(t, cfg)
	require.Nil(t, pkey)

	// Invalid counter
	ts.ExpectDNClientRequest(message.DoUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoUpdateResponse{
			Config:  dnapitest.NebulaCfg(caPEM),
			Counter: 0,
			Nonce:   dnapitest.GetNonce(r),
		}
		rawRes := jsonMarshal(newConfigResponse)

		// XXX the mock server will update the host pubkey for us, but this is problematic because
		// we are rejecting the update. reset the key
		err := ts.SetP256Pubkey(pubkey)
		require.NoError(t, err)

		hashed := sha256.Sum256(rawRes)
		sig, err := ecdsa.SignASN1(rand.Reader, caPrivkey, hashed[:])
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_SIGN_MESSAGE",
					Message: "failed to sign message",
				}},
			})
		}

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: sig,
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	cfg, pkey, newCreds, _, err = c.DoUpdate(ctx, *creds)
	require.Error(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())
	require.Nil(t, newCreds)
	require.Nil(t, cfg)
	require.Nil(t, pkey)

	// This time sign the response with the correct CA key.
	ts.ExpectDNClientRequest(message.DoUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoUpdateResponse{
			Config:      dnapitest.NebulaCfg(caPEM),
			Counter:     3,
			Nonce:       dnapitest.GetNonce(r),
			TrustedKeys: ca.MarshalPublicKeyPEM(),
			Organization: message.HostOrgMetadata{
				ID:   "foobaz",
				Name: "foobar's foo org",
			},
			Network: message.HostNetworkMetadata{
				ID:    "qux",
				Name:  "the best network",
				Curve: message.NetworkCurve25519,
				CIDR:  "192.168.100.0/24",
			},
			Host: message.HostHostMetadata{
				ID:        "quux",
				Name:      "foo host",
				IPAddress: "192.168.100.2",
			},
		}
		rawRes := jsonMarshal(newConfigResponse)
		hashed := sha256.Sum256(rawRes)
		sig, err := ecdsa.SignASN1(rand.Reader, caPrivkey, hashed[:])
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_SIGN_MESSAGE",
					Message: "failed to sign message",
				}},
			})
		}

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: sig,
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, _, _, _, err = c.DoUpdate(ctx, *creds)
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

}

func TestCommandResponse(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	t.Cleanup(func() { ts.Close() })

	ca, _ := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	c := NewClient(useragent, ts.URL)

	code := "foobar"
	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			// we need to send this or we'll get an error from the api client
			"pki": m{"ca": string(caPEM)},
			// here we reflect values back to the client for test purposes
			"test": m{"code": req.Code, "dhPubkey": req.NebulaPubkeyX25519},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      "foobar",
				Counter:     1,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   "foobaz",
					Name: "foobar's foo org",
				},
				Network: message.HostNetworkMetadata{
					ID:    "qux",
					Name:  "the best network",
					Curve: message.NetworkCurve25519,
					CIDR:  "192.168.100.0/24",
				},
				Host: message.HostHostMetadata{
					ID:        "quux",
					Name:      "foo host",
					IPAddress: "192.168.100.2",
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	config, pkey, creds, meta, err := c.Enroll(ctx, testutil.NewTestLogger(), "foobar", "")
	require.NoError(t, err)

	// make sure all credential values were set
	assert.NotEmpty(t, creds.HostID)
	assert.NotEmpty(t, creds.PrivateKey)
	assert.NotEmpty(t, creds.TrustedKeys)
	assert.NotEmpty(t, creds.Counter)

	// make sure we got a config back
	assert.NotEmpty(t, config)
	assert.NotEmpty(t, pkey)

	// no EndpointOIDC for standard host enrollments
	assert.Nil(t, meta.EndpointOIDC)

	// This time sign the response with the correct CA key.
	responseToken := "abc123"
	res := map[string]any{"msg": "Hello, world!"}
	ts.ExpectDNClientRequest(message.CommandResponse, http.StatusOK, func(r message.RequestWrapper) []byte {
		var val map[string]any
		err := json.Unmarshal(r.Value, &val)
		require.NoError(t, err)
		require.Contains(t, val, "responseToken")
		require.Equal(t, responseToken, val["responseToken"])
		require.Contains(t, val, "response")
		require.Equal(t, res, val["response"])
		return jsonMarshal(struct{}{})
	})

	err = c.CommandResponse(context.Background(), *creds, responseToken, res)
	require.NoError(t, err)

	// Test error handling
	errorMsg := "sample error"
	ts.ExpectDNClientRequest(message.CommandResponse, http.StatusBadRequest, func(r message.RequestWrapper) []byte {
		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Errors: message.APIResponseErrors{{
				Code:    "ERR_INVALID_VALUE",
				Message: errorMsg,
			}},
		})
	})

	err = c.CommandResponse(context.Background(), *creds, "responseToken", map[string]any{"msg": "Hello, world!"})
	require.Error(t, err)
}

func TestStreamCommandResponse(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	t.Cleanup(func() { ts.Close() })

	ca, _ := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	c := NewClient(useragent, ts.URL)

	code := "foobar"
	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			// we need to send this or we'll get an error from the api client
			"pki": m{"ca": string(caPEM)},
			// here we reflect values back to the client for test purposes
			"test": m{"code": req.Code, "dhPubkey": req.NebulaPubkeyX25519},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      "foobar",
				Counter:     1,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   "foobaz",
					Name: "foobar's foo org",
				},
				Network: message.HostNetworkMetadata{
					ID:    "qux",
					Name:  "the best network",
					Curve: message.NetworkCurve25519,
					CIDR:  "192.168.100.0/24",
				},
				Host: message.HostHostMetadata{
					ID:        "quux",
					Name:      "foo host",
					IPAddress: "192.168.100.2",
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	config, pkey, creds, _, err := c.Enroll(ctx, testutil.NewTestLogger(), "foobar", "")
	require.NoError(t, err)

	// make sure all credential values were set
	assert.NotEmpty(t, creds.HostID)
	assert.NotEmpty(t, creds.PrivateKey)
	assert.NotEmpty(t, creds.TrustedKeys)
	assert.NotEmpty(t, creds.Counter)

	// make sure we got a config back
	assert.NotEmpty(t, config)
	assert.NotEmpty(t, pkey)

	// Buffer that will store the logs sent to the service for verification
	var buf bytes.Buffer

	// This time sign the response with the correct CA key.
	ts.ExpectStreamingRequest(message.CommandResponse, http.StatusOK, func(r message.RequestWrapper) []byte {
		return jsonMarshal(struct{}{})
	})

	sc, err := c.StreamCommandResponse(context.Background(), *creds, "responseToken")
	require.NoError(t, err)

	// Configure a logger to write to a buffer and the stream
	logger := slog.New(slog.NewJSONHandler(io.MultiWriter(sc, &buf), &slog.HandlerOptions{
		Level:       slog.LevelDebug,
		ReplaceAttr: dropTimeAttr,
	}))

	logger.Info("Hello, world! info!")
	logger.Warn("Hello, world! warning!")

	err = sc.Close()
	require.NoError(t, err)
	require.NoError(t, sc.Err())

	require.Equal(t, buf.Bytes(), ts.LastStreamedBody())

	// Test error handling
	errorMsg := "sample error"
	ts.ExpectStreamingRequest(message.CommandResponse, http.StatusBadRequest, func(r message.RequestWrapper) []byte {
		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Errors: message.APIResponseErrors{{
				Code:    "ERR_INVALID_VALUE",
				Message: errorMsg,
			}},
		})
	})

	buf.Reset()

	sc, err = c.StreamCommandResponse(context.Background(), *creds, "responseToken")
	require.NoError(t, err)

	logger = slog.New(slog.NewJSONHandler(io.MultiWriter(sc, &buf), &slog.HandlerOptions{
		Level:       slog.LevelDebug,
		ReplaceAttr: dropTimeAttr,
	}))

	logger.Info("Hello, world! info!")
	logger.Warn("Hello, world! warning!")

	// Close shouldn't return an error - that's only if the writer fails to close
	assert.NoError(t, sc.Close())
	// Err should return the error from the server
	assert.Error(t, sc.Err())

	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining(), ts.ExpectedRequests())
}

func TestReauthenticate(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	t.Cleanup(func() { ts.Close() })

	ca, caPrivkey := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	c := NewClient(useragent, ts.URL)

	code := "foobar"
	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			// we need to send this or we'll get an error from the api client
			"pki": m{"ca": string(caPEM)},
			// here we reflect values back to the client for test purposes
			"test": m{"code": req.Code, "dhPubkey": req.NebulaPubkeyX25519},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      "foobar",
				Counter:     1,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   "foobaz",
					Name: "foobar's foo org",
				},
				Network: message.HostNetworkMetadata{
					ID:    "qux",
					Name:  "the best network",
					Curve: message.NetworkCurve25519,
					CIDR:  "192.168.100.0/24",
				},
				Host: message.HostHostMetadata{
					ID:        "quux",
					Name:      "foo host",
					IPAddress: "192.168.100.2",
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	config, pkey, creds, _, err := c.Enroll(ctx, testutil.NewTestLogger(), "foobar", "")
	require.NoError(t, err)

	// make sure all credential values were set
	assert.NotEmpty(t, creds.HostID)
	assert.NotEmpty(t, creds.PrivateKey)
	assert.NotEmpty(t, creds.TrustedKeys)
	assert.NotEmpty(t, creds.Counter)

	// make sure we got a config back
	assert.NotEmpty(t, config)
	assert.NotEmpty(t, pkey)

	// This time sign the response with the correct CA key.
	ts.ExpectDNClientRequest(message.Reauthenticate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.ReauthenticateResponse{
			LoginURL: "https://auth.example.com/login?authcode=123",
		}
		rawRes := jsonMarshal(newConfigResponse)

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: ed25519.Sign(caPrivkey, rawRes),
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	resp, err := c.Reauthenticate(ctx, *creds)
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	// make sure we got a login URL back
	assert.NotEmpty(t, resp)
	assert.NotEmpty(t, resp.LoginURL)
	assert.Equal(t, "https://auth.example.com/login?authcode=123", resp.LoginURL)

}

func jsonMarshal(v interface{}) []byte {
	b, err := json.Marshal(v)
	if err != nil {
		panic(err)
	}
	return b
}

func TestTimeout(t *testing.T) {
	ts := httptest.NewServer(
		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			time.Sleep(250 * time.Millisecond)
			fmt.Fprintln(w, "OK")
		}))
	defer ts.Close()

	useragent := "TestTimeout agent"
	c := NewClient(useragent, ts.URL)
	// The default timeout is 1 minutes. Assert the default value.
	assert.Equal(t, c.client.Timeout, 2*time.Minute)
	// The default streaming timeout is 15 minutes. Assert the default value.
	assert.Equal(t, c.streamingClient.Timeout, 15*time.Minute)
	// Overwrite the default value with a 10 millisecond timeout for test brevity.
	c.client.Timeout = 10 * time.Millisecond
	// DO IT
	_, err := c.client.Get(ts.URL + "/lol")
	require.Error(t, err)
}

func TestOverrideTimeout(t *testing.T) {
	ts := httptest.NewServer(
		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			time.Sleep(250 * time.Millisecond)
			fmt.Fprintln(w, "OK")
		}))
	defer ts.Close()

	useragent := "TestTimeout agent"
	c := NewClient(useragent, ts.URL)
	// DO IT
	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
	defer cancel()
	_, _, _, _, err := c.Enroll(ctx, testutil.NewTestLogger(), "ABC123", "")
	require.ErrorIs(t, err, context.DeadlineExceeded)
}

func TestDialWithFallback(t *testing.T) {
	t.Parallel()

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
	t.Cleanup(ts.Close)
	_, port, err := net.SplitHostPort(ts.Listener.Addr().String())
	require.NoError(t, err)

	// .invalid never resolves (RFC 2606), so the pinned address must be used
	dial := dialWithFallback(map[string][]string{"api.invalid": {"127.0.0.1"}})
	conn, err := dial(context.Background(), "tcp", "api.invalid:"+port)
	require.NoError(t, err)
	assert.Equal(t, ts.Listener.Addr().String(), conn.RemoteAddr().String())
	conn.Close()

	// hosts without a fallback surface the DNS error unchanged
	var dnsErr *net.DNSError
	_, err = dial(context.Background(), "tcp", "other.invalid:"+port)
	require.ErrorAs(t, err, &dnsErr)
}

func TestGetOidcPollCode(t *testing.T) {
	t.Parallel()

	useragent := "dnclientUnitTests/1.0.0 (not a real client)"
	ts := dnapitest.NewServer(useragent)
	client := NewClient(useragent, ts.URL)
	// attempting to defer ts.Close() will trigger early due to parallel testing - use T.Cleanup instead
	t.Cleanup(func() { ts.Close() })
	const expectedCode = "123456"
	ts.ExpectAPIRequest(http.StatusOK, func(req any) []byte {
		return jsonMarshal(message.APIResponse[message.PreAuthData]{Data: message.PreAuthData{PollToken: expectedCode, LoginURL: "https://example.com"}})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	resp, err := client.EndpointPreAuth(ctx)
	require.NoError(t, err)
	assert.NotNil(t, resp)
	assert.Equal(t, expectedCode, resp.PollToken)
	assert.Equal(t, "https://example.com", resp.LoginURL)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	//unhappy path
	ts.ExpectAPIRequest(http.StatusInternalServerError, func(req any) []byte {
		return jsonMarshal(message.APIResponse[message.PreAuthData]{
			Errors: message.APIResponseErrors{{
				Code:    "ERR_INTERNAL_SERVER_ERROR",
				Message: "internal server error",
			}},
		})
	})
	resp, err = client.EndpointPreAuth(ctx)
	require.Error(t, err)
	require.Nil(t, resp)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())
}

func TestDoOidcPoll(t *testing.T) {
	t.Parallel()

	useragent := "dnclientUnitTests/1.0.0 (not a real client)"
	ts := dnapitest.NewServer(useragent)
	client := NewClient(useragent, ts.URL)
	// attempting to defer ts.Close() will trigger early due to parallel testing - use T.Cleanup instead
	t.Cleanup(func() { ts.Close() })
	const expectedCode = "123456"
	ts.ExpectAPIRequest(http.StatusOK, func(r any) []byte {
		return jsonMarshal(message.APIResponse[message.EndpointAuthPollData]{Data: message.EndpointAuthPollData{
			Status:         message.EndpointAuthStarted,
			EnrollmentCode: expectedCode,
		}})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	resp, err := client.EndpointAuthPoll(ctx, expectedCode)
	require.NoError(t, err)
	assert.Equal(t, message.EndpointAuthStarted, resp.Status)
	assert.Equal(t, expectedCode, resp.EnrollmentCode)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	//unhappy path
	ts.ExpectAPIRequest(http.StatusBadRequest, func(r any) []byte {
		return nil
	})
	resp, err = client.EndpointAuthPoll(ctx, "") //blank code should error!
	require.Error(t, err)
	assert.Nil(t, resp)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	//complete path
	ts.ExpectAPIRequest(http.StatusOK, func(r any) []byte {
		return jsonMarshal(message.APIResponse[message.EndpointAuthPollData]{Data: message.EndpointAuthPollData{
			Status:         message.EndpointAuthCompleted,
			EnrollmentCode: "deadbeef",
		}})
	})
	resp, err = client.EndpointAuthPoll(ctx, expectedCode)
	require.NoError(t, err)
	assert.Equal(t, resp.Status, message.EndpointAuthCompleted)
	assert.Equal(t, resp.EnrollmentCode, "deadbeef")
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())
}

func TestDownloads(t *testing.T) {
	t.Parallel()

	useragent := "dnclientUnitTests/1.0.0 (not a real client)"
	ts := dnapitest.NewServer(useragent)
	client := NewClient(useragent, ts.URL)
	t.Cleanup(func() { ts.Close() })

	// Happy path - successful downloads response
	ts.ExpectAPIRequest(http.StatusOK, func(r any) []byte {
		return []byte(downloadsResponse)
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	resp, err := client.Downloads(ctx)
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	// Verify DNClient downloads - this list is not exhaustive but tests some of the more common platforms.
	require.NotNil(t, resp)
	require.Contains(t, resp.DNClient, "0.8.4")
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/freebsd/amd64/dnclient", resp.DNClient["0.8.4"]["freebsd-amd64"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/freebsd/arm64/dnclient", resp.DNClient["0.8.4"]["freebsd-arm64"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/linux/amd64/dnclient", resp.DNClient["0.8.4"]["linux-amd64"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/linux/arm64/dnclient", resp.DNClient["0.8.4"]["linux-arm64"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/windows/amd64/DNClient-Desktop.msi", resp.DNClient["0.8.4"]["windows-amd64-desktop"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/windows/amd64/DNClient-Server.msi", resp.DNClient["0.8.4"]["windows-amd64-server"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/windows/arm64/DNClient-Desktop.msi", resp.DNClient["0.8.4"]["windows-arm64-desktop"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/windows/arm64/DNClient-Server.msi", resp.DNClient["0.8.4"]["windows-arm64-server"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/macos/dnclient", resp.DNClient["0.8.4"]["macos-universal-server"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/macos/DNClient-Server.dmg", resp.DNClient["0.8.4"]["macos-universal-server-dmg"])
	assert.Equal(t, "https://dl.defined.net/290ff4b6/v0.8.4/macos/DNClient-Desktop.dmg", resp.DNClient["0.8.4"]["macos-universal-desktop"])

	// Verify the latest release info
	require.Contains(t, resp.DNClient, "latest")
	require.Equal(t, resp.DNClient["latest"], resp.DNClient["0.8.4"])

	// Verify mobile downloads
	assert.Equal(t, "https://play.google.com/store/apps/details?id=net.defined.mobile_nebula", resp.Mobile.Android)
	assert.Equal(t, "https://apps.apple.com/us/app/mobile-nebula/id1509587936", resp.Mobile.IOS)

	// Verify container downloads
	assert.Equal(t, "https://hub.docker.com/r/definednet/dnclient/", resp.Container.Docker)

	// Verify version info
	require.Contains(t, resp.VersionInfo.DNClient, "0.8.4")
	assert.True(t, resp.VersionInfo.DNClient["0.8.4"].Latest)
	assert.Equal(t, "2025-10-10", resp.VersionInfo.DNClient["0.8.4"].ReleaseDate)

	// Verify latest versions
	assert.Equal(t, "0.8.4", resp.VersionInfo.Latest.DNClient)
	assert.Equal(t, "0.5.1", resp.VersionInfo.Latest.Mobile)
}

func TestEnroll_PluralMeta(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	client := NewClient(useragent, ts.URL)
	t.Cleanup(func() { ts.Close() })

	code := "abcdef"
	orgID := "foobaz"
	orgName := "foobar's foo org"
	netID := "qux"
	netName := "the best network"
	netCIDRs := []string{"192.168.100.0/24", "10.0.0.0/16"}
	hostID := "foobar"
	hostName := "foo host"
	hostIPs := []string{"192.168.100.1", "10.0.0.1"}
	counter := uint(5)
	ca, _ := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			"pki": m{"ca": string(caPEM)},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      hostID,
				Counter:     counter,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   orgID,
					Name: orgName,
				},
				Network: message.HostNetworkMetadata{
					ID:    netID,
					Name:  netName,
					Curve: message.NetworkCurve25519,
					CIDRs: netCIDRs,
				},
				Host: message.HostHostMetadata{
					ID:          hostID,
					Name:        hostName,
					IPAddresses: hostIPs,
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, _, _, meta, err := client.Enroll(ctx, testutil.NewTestLogger(), code, "")
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	// test meta
	assert.Equal(t, orgID, meta.Org.ID)
	assert.Equal(t, orgName, meta.Org.Name)
	assert.Equal(t, netID, meta.Network.ID)
	assert.Equal(t, netName, meta.Network.Name)
	assert.Equal(t, hostID, meta.Host.ID)
	assert.Equal(t, hostName, meta.Host.Name)
	assert.Equal(t, hostIPs, meta.Host.IPAddresses)
}

func TestDoUpdate_PluralMeta(t *testing.T) {
	t.Parallel()

	useragent := "testClient"
	ts := dnapitest.NewServer(useragent)
	t.Cleanup(func() { ts.Close() })

	ca, caPrivkey := dnapitest.NebulaCACert()
	caPEM, err := ca.MarshalPEM()
	require.NoError(t, err)

	c := NewClient(useragent, ts.URL)

	code := "foobar"
	ts.ExpectEnrollment(code, message.NetworkCurve25519, func(req message.EnrollRequest) []byte {
		cfg, err := yaml.Marshal(m{
			"pki": m{"ca": string(caPEM)},
		})
		if err != nil {
			return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
				Errors: message.APIResponseErrors{{
					Code:    "ERR_FAILED_TO_MARSHAL_YAML",
					Message: "failed to marshal test response config",
				}},
			})
		}

		return jsonMarshal(message.APIResponse[message.EnrollResponseData]{
			Data: message.EnrollResponseData{
				HostID:      "foobar",
				Counter:     1,
				Config:      cfg,
				TrustedKeys: ca.MarshalPublicKeyPEM(),
				Organization: message.HostOrgMetadata{
					ID:   "foobaz",
					Name: "foobar's foo org",
				},
				Network: message.HostNetworkMetadata{
					ID:    "qux",
					Name:  "the best network",
					Curve: message.NetworkCurve25519,
					CIDR:  "192.168.100.0/24",
				},
				Host: message.HostHostMetadata{
					ID:        "foobar",
					Name:      "foo host",
					IPAddress: "192.168.100.2",
				},
			},
		})
	})

	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, _, creds, _, err := c.Enroll(ctx, testutil.NewTestLogger(), code, "")
	require.NoError(t, err)

	orgID := "foobaz"
	orgName := "foobar's foo org"
	netID := "qux"
	netName := "the best network"
	netCIDRs := []string{"192.168.100.0/24", "10.0.0.0/16"}
	hostID := "foobar"
	hostName := "foo host"
	hostIPs := []string{"192.168.100.1", "10.0.0.1"}

	ts.ExpectDNClientRequest(message.DoUpdate, http.StatusOK, func(r message.RequestWrapper) []byte {
		newConfigResponse := message.DoUpdateResponse{
			Config:      dnapitest.NebulaCfg(caPEM),
			Counter:     3,
			Nonce:       dnapitest.GetNonce(r),
			TrustedKeys: ca.MarshalPublicKeyPEM(),
			Organization: message.HostOrgMetadata{
				ID:   orgID,
				Name: orgName,
			},
			Network: message.HostNetworkMetadata{
				ID:    netID,
				Name:  netName,
				Curve: message.NetworkCurve25519,
				CIDRs: netCIDRs,
			},
			Host: message.HostHostMetadata{
				ID:          hostID,
				Name:        hostName,
				IPAddresses: hostIPs,
			},
		}
		rawRes := jsonMarshal(newConfigResponse)

		return jsonMarshal(message.SignedResponseWrapper{
			Data: message.SignedResponse{
				Version:   1,
				Message:   rawRes,
				Signature: ed25519.Sign(caPrivkey, rawRes),
			},
		})
	})

	ctx, cancel = context.WithTimeout(context.Background(), 1*time.Second)
	defer cancel()
	_, _, _, meta, err := c.DoUpdate(ctx, *creds)
	require.NoError(t, err)
	assert.Empty(t, ts.Errors())
	assert.Equal(t, 0, ts.RequestsRemaining())

	// test meta
	assert.Equal(t, orgID, meta.Org.ID)
	assert.Equal(t, orgName, meta.Org.Name)
	assert.Equal(t, netID, meta.Network.ID)
	assert.Equal(t, netName, meta.Network.Name)
	assert.Equal(t, hostID, meta.Host.ID)
	assert.Equal(t, hostName, meta.Host.Name)
	assert.Equal(t, hostIPs, meta.Host.IPAddresses)
}

func TestNebulaPemBanners(t *testing.T) {
	const NebulaECDSAP256PublicKeyBanner = "NEBULA ECDSA P256 PUBLIC KEY"
	const NebulaEd25519PublicKeyBanner = "NEBULA ED25519 PUBLIC KEY"
	ca, _ := dnapitest.NebulaCACert()
	pub := ca.MarshalPublicKeyPEM()
	assert.Contains(t, string(pub), NebulaEd25519PublicKeyBanner)

	ca, _ = dnapitest.NebulaCACertP256()
	pub = ca.MarshalPublicKeyPEM()
	assert.Contains(t, string(pub), NebulaECDSAP256PublicKeyBanner)
}