// The trust store the platform supplies is found with nothing configured, and a

// public certificate chain verifies against it.

//

// On a Windows Sockets build the store is the system's ROOT store, read through

// the Win32 API; elsewhere it is a bundle file at one of the known locations.

// Either way a default-constructed client verifies a public server. A host that

// cannot be reached is a skip, so a runner without egress reports "not run"; a

// certificate the client refused is a failure.

#include <gtest/gtest.h>

#include <cstdlib>

import mcpplibs.tinyhttps;

import std;

namespace https = mcpplibs::tinyhttps;

TEST(SystemStore, IsFoundWithNothingConfigured) {

if (const char* file = std::getenv("SSL_CERT_FILE"); file && *file) {

GTEST_SKIP() << "SSL_CERT_FILE is set, so the system store is not consulted";

}

const auto pem = https::load_ca_certs();

EXPECT_FALSE(pem.empty());

EXPECT_NE(pem.find("-----BEGIN CERTIFICATE-----"), std::string::npos);

}

TEST(SystemStore, APublicChainVerifiesAgainstIt) {

https::Socket::platform_init();

https::HttpClientConfig config;

config.connectTimeoutMs = 15000;

config.readTimeoutMs = 20000;

https::HttpClient client{config};

https::HttpRequest request;

request.url = "https://one.one.one.one/";

const auto response = client.send(request);

if (response.statusCode == 0 && response.statusText == "Connection failed") {

GTEST_SKIP() << "one.one.one.one is not reachable from this runner";

}

EXPECT_NE(response.statusCode, 0) << response.statusText;

}