export const validPublicCertificate = {
  connectionId: "connection-valid-public",
  hostname: "example.test",
  port: 443,
  validation: "success",
  errors: [],
  presentedChain: [
    { subject: "CN=example.test", sha256: "leaf-valid-public" },
    { subject: "CN=Example Intermediate", sha256: "intermediate-public" },
  ],
  constructedChain: [
    { subject: "CN=example.test", sha256: "leaf-valid-public" },
    { subject: "CN=Example Intermediate", sha256: "intermediate-public" },
    { subject: "CN=Example Root", sha256: "root-public" },
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const unknownLocalAuthority = {
  connectionId: "connection-unknown-local",
  hostname: "library.village",
  port: 443,
  validation: "failure",
  errors: ["unknown-issuer"],
  failure: {
    code: "unknown-issuer",
    certificateSha256: "ca-village-services",
    check: "trust-anchor",
    summary: "The candidate authority is not trusted by the current Firefox policy.",
  },
  presentedChain: [
    { subject: "CN=library.village", sha256: "leaf-village-library" },
    { subject: "CN=Village Services CA", sha256: "ca-village-services" },
  ],
  constructedChain: [
    { subject: "CN=library.village", sha256: "leaf-village-library" },
    { subject: "CN=Village Services CA", sha256: "ca-village-services" },
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const expiredLeafCertificate = {
  connectionId: "connection-expired-leaf",
  hostname: "archive.village",
  port: 443,
  validation: "failure",
  errors: ["expired"],
  failure: {
    code: "expired",
    certificateSha256: "leaf-expired-archive",
    check: "validity",
    summary: "The server certificate expired 46 days ago.",
  },
  presentedChain: [
    {
      subject: "CN=archive.village",
      sha256: "leaf-expired-archive",
      validFrom: "2025-06-01T00:00:00Z",
      validUntil: "2026-07-01T00:00:00Z",
    },
    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
  ],
  constructedChain: [
    {
      subject: "CN=archive.village",
      sha256: "leaf-expired-archive",
      validFrom: "2025-06-01T00:00:00Z",
      validUntil: "2026-07-01T00:00:00Z",
    },
    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
    { subject: "CN=Regional Root CA", sha256: "root-regional" },
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const hostnameMismatch = {
  connectionId: "connection-hostname-mismatch",
  hostname: "records.village",
  port: 443,
  validation: "failure",
  errors: ["hostname-mismatch"],
  failure: {
    code: "hostname-mismatch",
    certificateSha256: "leaf-wrong-host",
    check: "identity",
    summary: "The certificate identifies files.village, not records.village.",
  },
  presentedChain: [
    {
      subject: "CN=files.village",
      sha256: "leaf-wrong-host",
      dnsNames: ["files.village"],
    },
    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
  ],
  constructedChain: [
    {
      subject: "CN=files.village",
      sha256: "leaf-wrong-host",
      dnsNames: ["files.village"],
    },
    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
    { subject: "CN=Regional Root CA", sha256: "root-regional" },
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const explicitlyDistrustedAuthority = {
  connectionId: "connection-distrusted-authority",
  hostname: "registry.example",
  port: 443,
  validation: "failure",
  errors: ["explicitly-distrusted-authority"],
  failure: {
    code: "explicitly-distrusted-authority",
    certificateSha256: "root-distrusted",
    check: "local-policy",
    summary: "A local Browsec rule explicitly distrusts this root authority.",
  },
  presentedChain: [
    { subject: "CN=registry.example", sha256: "leaf-registry" },
    { subject: "CN=Commercial Issuing CA", sha256: "ca-commercial-issuing" },
  ],
  constructedChain: [
    { subject: "CN=registry.example", sha256: "leaf-registry" },
    { subject: "CN=Commercial Issuing CA", sha256: "ca-commercial-issuing" },
    { subject: "CN=Globally Trusted but Locally Rejected Root", sha256: "root-distrusted" },
  ],
  tls: { version: "TLSv1.3", alpn: "h2" },
};

export const conflictingCommunityAdvice = {
  ...unknownLocalAuthority,
  connectionId: "connection-conflicting-community-advice",
};