// Fixtura: CommonCrypto, Security.framework si TLS-ul clientului (URLSession, Network). Formele sunt cele din documentatia Apple:
// CC_SHA256 / CCCrypt / CCHmac / CCKeyDerivationPBKDF (CommonCrypto.h), SecKeyCreateRandomKey cu kSecAttrKeyType si kSecAttrKeySizeInBits
// (developer.apple.com/documentation/security/generating-new-cryptographic-keys), SecKeyCreateSignature / SecKeyVerifySignature /
// SecKeyCreateEncryptedData cu SecKeyAlgorithm, SecTrustEvaluateWithError, URLSessionConfiguration.tlsMinimumSupportedProtocolVersion,
// NWProtocolTLS.Options + sec_protocol_options_set_min_tls_protocol_version. Nu se compileaza; e text pentru scaner.
import Foundation
import CommonCrypto
import Security
import Network

func exemple(data: Data, keyData: Data, password: String, salt: Data, trust: SecTrust, privateKey: SecKey, publicKey: SecKey) throws {
    var hash = [UInt8](repeating: 0, count: Int(CC_SHA256_DIGEST_LENGTH))
    data.withUnsafeBytes { _ = CC_SHA256($0.baseAddress, CC_LONG(data.count), &hash) } // EXPECT: SHA-256 | quantum-safe
    _ = CC_MD5(nil, 0, &hash) // EXPECT: MD5 | weak-now
    _ = CC_SHA1(nil, 0, &hash) // EXPECT: SHA-1 | weak-now
    let status = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES), CCOptions(kCCOptionPKCS7Padding), keyBytes, kCCKeySizeAES256, iv, dataBytes, data.count, outBytes, outLength, &moved) // EXPECT: AES-256-CBC | quantum-safe
    let s3des = CCCrypt(CCOperation(kCCDecrypt), CCAlgorithm(kCCAlgorithm3DES), CCOptions(kCCOptionECBMode), keyBytes, kCCKeySize3DES, nil, dataBytes, data.count, outBytes, outLength, &moved) // EXPECT: 3DES-ECB | weak-now
    CCHmac(CCHmacAlgorithm(kCCHmacAlgSHA256), keyBytes, keyData.count, dataBytes, data.count, &hash) // EXPECT: HMAC-SHA-256 | quantum-safe
    let r = CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2), password, password.utf8.count, saltBytes, salt.count, CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA1), 10000, derived, 32) // EXPECT: PBKDF2-HMAC-SHA1 | weak-now

    let attributes: [String: Any] = [
        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
        kSecAttrKeySizeInBits as String: 256,
    ]
    var error: Unmanaged<CFError>?
    let ecKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) // dictionarul e variabila de mai sus; EXPECT: EC-secp256r1 | quantum-vulnerable
    let rsaKey = SecKeyCreateRandomKey([kSecAttrKeyType as String: kSecAttrKeyTypeRSA, kSecAttrKeySizeInBits as String: 2048] as CFDictionary, &error) // EXPECT: RSA-2048 | quantum-vulnerable
    let sig = SecKeyCreateSignature(privateKey, .ecdsaSignatureMessageX962SHA256, data as CFData, &error) // EXPECT: ECDSA | quantum-vulnerable
    let sig2 = SecKeyCreateSignature(privateKey, .rsaSignatureMessagePSSSHA256, data as CFData, &error) // EXPECT: RSA | quantum-vulnerable
    let ok = SecKeyVerifySignature(publicKey, .rsaSignatureMessagePKCS1v15SHA1, data as CFData, sig!, &error) // EXPECT: RSA | weak-now
    let ct = SecKeyCreateEncryptedData(publicKey, .rsaEncryptionOAEPSHA256, data as CFData, &error) // EXPECT: RSA | quantum-vulnerable
    let trusted = SecTrustEvaluateWithError(trust, &error) // lantul de incredere TLS: autentificare, nu schimb de cheie; EXPECT: X.509 chain validation (PKIX) | quantum-vulnerable

    let config = URLSessionConfiguration.default
    config.tlsMinimumSupportedProtocolVersion = .TLSv12 // EXPECT: TLSv1.2 | quantum-vulnerable
    config.tlsMaximumSupportedProtocolVersion = .TLSv13 // EXPECT: TLSv1.3 | unknown
    let tls = NWProtocolTLS.Options() // EXPECT: TLS (negotiated) | unknown
    sec_protocol_options_set_min_tls_protocol_version(tls.securityProtocolOptions, .TLSv13) // EXPECT: TLSv1.3 | unknown
    _ = (status, s3des, r, ecKey, rsaKey, sig2, ok, ct, trusted, config)
}