package process

import (
	"crypto/sha256"
	"encoding/hex"
	"testing"
)

// The pin accepts exactly the leaf certificate with the named SHA-256, and no other (novox/hq issue 1633).
func TestThePinAcceptsOnlyTheNamedCertificate(t *testing.T) {
	leaf := []byte("a certificate")
	sum := sha256.Sum256(leaf)
	cfg := PinnedToFingerprint("sha256:" + hex.EncodeToString(sum[:]))
	if err := cfg.VerifyPeerCertificate([][]byte{leaf}, nil); err != nil {
		t.Errorf("the pinned certificate was refused: %v", err)
	}
	if err := cfg.VerifyPeerCertificate([][]byte{[]byte("another")}, nil); err == nil {
		t.Error("another certificate was accepted")
	}
	if err := cfg.VerifyPeerCertificate(nil, nil); err == nil {
		t.Error("no certificate was accepted")
	}
}