use crate::data_model::common::BigUnsigned;
use crate::data_model::crl::{CrlDecodeError, CrlVerifyError, RpkixCrl};
use crate::data_model::oid::OID_KEY_USAGE_RAW;
use crate::data_model::rc::{
    AsIdentifierChoice, AsResourceSet, IpAddressChoice, IpResourceSet, ResourceCertKind,
    ResourceCertificate, ResourceCertificateDecodeError,
};
use x509_parser::prelude::{FromDer, X509Certificate};

use crate::validation::x509_name::x509_names_equivalent;
use std::collections::{BTreeMap, HashMap, HashSet};
use x509_parser::x509::SubjectPublicKeyInfo;

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct ValidatedSubordinateCa {
    pub child_ca: ResourceCertificate,
    pub issuer_ca: ResourceCertificate,
    pub issuer_crl: RpkixCrl,
    pub effective_ip_resources: Option<IpResourceSet>,
    pub effective_as_resources: Option<AsResourceSet>,
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct ValidatedSubordinateCaLite {
    pub child_ca: ResourceCertificate,
    pub effective_ip_resources: Option<IpResourceSet>,
    pub effective_as_resources: Option<AsResourceSet>,
}

#[derive(Clone, Debug, Default)]
pub struct IssuerEffectiveResourcesIndex {
    parent_ip_by_afi_items:
        Option<BTreeMap<crate::data_model::rc::Afi, Vec<crate::data_model::rc::IpAddressOrRange>>>,
    parent_ip_merged_intervals: HashMap<crate::data_model::rc::Afi, Vec<(Vec<u8>, Vec<u8>)>>,
    parent_asnum_intervals: Option<Vec<(u32, u32)>>,
    parent_rdi_intervals: Option<Vec<(u32, u32)>>,
}

impl IssuerEffectiveResourcesIndex {
    pub fn from_effective_resources(
        issuer_effective_ip: Option<&IpResourceSet>,
        issuer_effective_as: Option<&AsResourceSet>,
    ) -> Result<Self, CaPathError> {
        let parent_ip_by_afi_items = issuer_effective_ip
            .map(ip_resources_by_afi_items)
            .transpose()?;

        let parent_ip_merged_intervals = issuer_effective_ip
            .map(ip_resources_to_merged_intervals_by_afi)
            .unwrap_or_default();

        let parent_asnum_intervals = issuer_effective_as
            .and_then(|resources| resources.asnum.as_ref().map(as_choice_to_merged_intervals));
        let parent_rdi_intervals = issuer_effective_as
            .and_then(|resources| resources.rdi.as_ref().map(as_choice_to_merged_intervals));

        Ok(Self {
            parent_ip_by_afi_items,
            parent_ip_merged_intervals,
            parent_asnum_intervals,
            parent_rdi_intervals,
        })
    }
}

#[derive(Debug, thiserror::Error)]
pub enum CaPathError {
    #[error("child CA certificate decode failed: {0} (RFC 6487 §4; RFC 5280 §4.1)")]
    ChildDecode(#[from] ResourceCertificateDecodeError),

    #[error("issuer CA certificate decode failed: {0} (RFC 6487 §4; RFC 5280 §4.1)")]
    IssuerDecode(ResourceCertificateDecodeError),

    #[error("issuer CRL decode failed: {0} (RFC 6487 §5; RFC 9829 §3.1; RFC 5280 §5.1)")]
    CrlDecode(#[from] CrlDecodeError),

    #[error(
        "child certificate must be a CA resource certificate (RFC 6487 §4.8.1; RFC 5280 §4.2.1.9)"
    )]
    ChildNotCa,

    #[error(
        "issuer certificate must be a CA resource certificate (RFC 6487 §4.8.1; RFC 5280 §4.2.1.9)"
    )]
    IssuerNotCa,

    #[error(
        "child issuer DN does not match issuer CA subject DN: child.issuer={child_issuer_dn} issuer.subject={issuer_subject_dn} (RFC 5280 §6.1)"
    )]
    IssuerSubjectMismatch {
        child_issuer_dn: String,
        issuer_subject_dn: String,
    },

    #[error("child CA certificate signature verification failed: {0} (RFC 5280 §6.1)")]
    ChildSignatureInvalid(String),

    #[error("issuer SubjectPublicKeyInfo parse error: {0} (RFC 5280 §4.1.2.7)")]
    IssuerSpkiParse(String),

    #[error(
        "trailing bytes after issuer SubjectPublicKeyInfo DER: {0} bytes (DER; RFC 5280 §4.1.2.7)"
    )]
    IssuerSpkiTrailingBytes(usize),

    #[error("certificate not valid at validation_time (RFC 5280 §4.1.2.5; RFC 5280 §6.1)")]
    CertificateNotValidAtTime,

    #[error("child CA KeyUsage extension missing (RFC 6487 §4.8.4; RFC 5280 §4.2.1.3)")]
    KeyUsageMissing,

    #[error("child CA KeyUsage criticality must be critical (RFC 6487 §4.8.4; RFC 5280 §4.2.1.3)")]
    KeyUsageNotCritical,

    #[error("child CA KeyUsage must have only keyCertSign and cRLSign set (RFC 6487 §4.8.4)")]
    KeyUsageInvalidBits,

    #[error(
        "CRL signature/binding verification failed: {0} (RFC 5280 §6.3.3; RFC 6487 §5; RFC 9829 §3.1)"
    )]
    CrlVerify(#[from] CrlVerifyError),

    #[error(
        "CRL not valid at validation_time (RFC 5280 §6.3.3(g); RFC 5280 §5.1.2.4-§5.1.2.5; RFC 6487 §5)"
    )]
    CrlNotValidAtTime,

    #[error("child CA certificate is revoked by issuer CRL (RFC 5280 §6.3.3; RFC 6487 §5)")]
    ChildRevoked,

    #[error(
        "child CA certificate must contain at least one RFC 3779 resource extension (IP or AS) (RFC 6487 §4.8.10-§4.8.11)"
    )]
    ResourcesMissing,

    #[error(
        "resource extension inheritance cannot be resolved (parent missing resources) (RFC 6487 §7.2)"
    )]
    InheritWithoutParentResources,

    #[error("child CA resources are not a subset of issuer resources (RFC 6487 §7.2)")]
    ResourcesNotSubset,

    #[error("issuer CA subjectKeyIdentifier missing (RFC 6487 §4.8.2)")]
    IssuerSkiMissing,

    #[error("child CA authorityKeyIdentifier missing (RFC 6487 §4.8.3; RFC 5280 §4.2.1.1)")]
    ChildAkiMissing,

    #[error(
        "child CA authorityKeyIdentifier does not match issuer subjectKeyIdentifier (RFC 6487 §4.8.3)"
    )]
    ChildAkiMismatch,

    #[error("child CA authorityInfoAccess missing (RFC 6487 §4.8.7; RFC 5280 §4.2.2.1)")]
    ChildAiaMissing,

    #[error(
        "child CA authorityInfoAccess does not reference issuer certificate rsync URI (RFC 6487 §4.8.7)"
    )]
    ChildAiaIssuerUriMismatch,

    #[error("child CA CRLDistributionPoints missing (RFC 6487 §4.8.6; RFC 5280 §4.2.1.13)")]
    ChildCrlDpMissing,

    #[error(
        "child CA CRLDistributionPoints does not reference issuer CRL rsync URI (RFC 6487 §4.8.6)"
    )]
    ChildCrlDpUriMismatch,
}

pub fn validate_subordinate_ca_cert(
    child_ca_der: &[u8],
    issuer_ca_der: &[u8],
    issuer_crl_der: &[u8],
    issuer_ca_rsync_uri: Option<&str>,
    issuer_crl_rsync_uri: &str,
    issuer_effective_ip: Option<&IpResourceSet>,
    issuer_effective_as: Option<&AsResourceSet>,
    validation_time: time::OffsetDateTime,
) -> Result<ValidatedSubordinateCa, CaPathError> {
    let child_ca = ResourceCertificate::decode_der(child_ca_der)?;
    if child_ca.kind != ResourceCertKind::Ca {
        return Err(CaPathError::ChildNotCa);
    }

    let issuer_ca =
        ResourceCertificate::decode_der(issuer_ca_der).map_err(CaPathError::IssuerDecode)?;
    if issuer_ca.kind != ResourceCertKind::Ca {
        return Err(CaPathError::IssuerNotCa);
    }
    let issuer_spki = parse_subject_pki_from_der(&issuer_ca.tbs.subject_public_key_info)?;

    if !x509_names_equivalent(&child_ca.tbs.issuer_name, &issuer_ca.tbs.subject_name) {
        return Err(CaPathError::IssuerSubjectMismatch {
            child_issuer_dn: child_ca.tbs.issuer_name.to_string(),
            issuer_subject_dn: issuer_ca.tbs.subject_name.to_string(),
        });
    }

    validate_child_aki_matches_issuer_ski(&child_ca, &issuer_ca)?;
    if let Some(expected_issuer_uri) = issuer_ca_rsync_uri {
        validate_child_aia_points_to_issuer_uri(&child_ca, expected_issuer_uri)?;
    }
    validate_child_crldp_contains_issuer_crl_uri(&child_ca, issuer_crl_rsync_uri)?;

    if !time_within_validity(
        validation_time,
        child_ca.tbs.validity_not_before,
        child_ca.tbs.validity_not_after,
    ) || !time_within_validity(
        validation_time,
        issuer_ca.tbs.validity_not_before,
        issuer_ca.tbs.validity_not_after,
    ) {
        return Err(CaPathError::CertificateNotValidAtTime);
    }

    let child_x509 = parse_x509_cert(child_ca_der)?;
    verify_child_signature(&child_x509, &issuer_spki)?;
    validate_child_ca_key_usage(&child_x509)?;

    let issuer_crl = RpkixCrl::decode_der(issuer_crl_der)?;
    issuer_crl.verify_signature_with_issuer_certificate_der(issuer_ca_der)?;
    if !crl_valid_at_time(&issuer_crl, validation_time) {
        return Err(CaPathError::CrlNotValidAtTime);
    }

    if is_serial_revoked_by_crl(&child_ca, &issuer_crl) {
        return Err(CaPathError::ChildRevoked);
    }

    let effective_ip_resources = resolve_child_ip_resources(
        child_ca.tbs.extensions.ip_resources.as_ref(),
        issuer_effective_ip,
    )?;
    let effective_as_resources = resolve_child_as_resources(
        child_ca.tbs.extensions.as_resources.as_ref(),
        issuer_effective_as,
    )?;
    if effective_ip_resources.is_none() && effective_as_resources.is_none() {
        return Err(CaPathError::ResourcesMissing);
    }

    Ok(ValidatedSubordinateCa {
        child_ca,
        issuer_ca,
        issuer_crl,
        effective_ip_resources,
        effective_as_resources,
    })
}

/// Validate a subordinate child CA using *pre-decoded issuer CA* and *pre-decoded+verified issuer CRL*.
///
/// This avoids repeating issuer CA decode and issuer CRL decode+signature verification for every
/// child CA certificate discovered in a publication point.
pub fn validate_subordinate_ca_cert_with_prevalidated_issuer(
    child_ca_der: &[u8],
    child_ca: ResourceCertificate,
    issuer_ca: &ResourceCertificate,
    issuer_spki: &SubjectPublicKeyInfo<'_>,
    issuer_crl: &RpkixCrl,
    issuer_crl_revoked_serials: &HashSet<Vec<u8>>,
    issuer_ca_rsync_uri: Option<&str>,
    issuer_crl_rsync_uri: &str,
    issuer_effective_ip: Option<&IpResourceSet>,
    issuer_effective_as: Option<&AsResourceSet>,
    validation_time: time::OffsetDateTime,
) -> Result<ValidatedSubordinateCaLite, CaPathError> {
    let issuer_resources_index = IssuerEffectiveResourcesIndex::from_effective_resources(
        issuer_effective_ip,
        issuer_effective_as,
    )?;
    validate_subordinate_ca_cert_with_prevalidated_issuer_and_resources(
        child_ca_der,
        child_ca,
        issuer_ca,
        issuer_spki,
        issuer_crl,
        issuer_crl_revoked_serials,
        issuer_ca_rsync_uri,
        issuer_crl_rsync_uri,
        issuer_effective_ip,
        issuer_effective_as,
        &issuer_resources_index,
        validation_time,
    )
}

pub fn validate_subordinate_ca_cert_with_prevalidated_issuer_and_resources(
    child_ca_der: &[u8],
    child_ca: ResourceCertificate,
    issuer_ca: &ResourceCertificate,
    issuer_spki: &SubjectPublicKeyInfo<'_>,
    issuer_crl: &RpkixCrl,
    issuer_crl_revoked_serials: &HashSet<Vec<u8>>,
    issuer_ca_rsync_uri: Option<&str>,
    issuer_crl_rsync_uri: &str,
    issuer_effective_ip: Option<&IpResourceSet>,
    issuer_effective_as: Option<&AsResourceSet>,
    issuer_resources_index: &IssuerEffectiveResourcesIndex,
    validation_time: time::OffsetDateTime,
) -> Result<ValidatedSubordinateCaLite, CaPathError> {
    if child_ca.kind != ResourceCertKind::Ca {
        return Err(CaPathError::ChildNotCa);
    }
    if issuer_ca.kind != ResourceCertKind::Ca {
        return Err(CaPathError::IssuerNotCa);
    }

    if !x509_names_equivalent(&child_ca.tbs.issuer_name, &issuer_ca.tbs.subject_name) {
        return Err(CaPathError::IssuerSubjectMismatch {
            child_issuer_dn: child_ca.tbs.issuer_name.to_string(),
            issuer_subject_dn: issuer_ca.tbs.subject_name.to_string(),
        });
    }

    validate_child_aki_matches_issuer_ski(&child_ca, issuer_ca)?;
    if let Some(expected_issuer_uri) = issuer_ca_rsync_uri {
        validate_child_aia_points_to_issuer_uri(&child_ca, expected_issuer_uri)?;
    }
    validate_child_crldp_contains_issuer_crl_uri(&child_ca, issuer_crl_rsync_uri)?;

    if !time_within_validity(
        validation_time,
        child_ca.tbs.validity_not_before,
        child_ca.tbs.validity_not_after,
    ) || !time_within_validity(
        validation_time,
        issuer_ca.tbs.validity_not_before,
        issuer_ca.tbs.validity_not_after,
    ) {
        return Err(CaPathError::CertificateNotValidAtTime);
    }

    let child_x509 = parse_x509_cert(child_ca_der)?;
    verify_child_signature(&child_x509, issuer_spki)?;
    validate_child_ca_key_usage(&child_x509)?;

    if !crl_valid_at_time(issuer_crl, validation_time) {
        return Err(CaPathError::CrlNotValidAtTime);
    }

    let serial = BigUnsigned::from_biguint(&child_ca.tbs.serial_number);
    if issuer_crl_revoked_serials.contains(&serial.bytes_be) {
        return Err(CaPathError::ChildRevoked);
    }

    let effective_ip_resources = resolve_child_ip_resources_indexed(
        child_ca.tbs.extensions.ip_resources.as_ref(),
        issuer_effective_ip,
        issuer_resources_index.parent_ip_by_afi_items.as_ref(),
        &issuer_resources_index.parent_ip_merged_intervals,
    )?;
    let effective_as_resources = resolve_child_as_resources_indexed(
        child_ca.tbs.extensions.as_resources.as_ref(),
        issuer_effective_as,
        issuer_resources_index.parent_asnum_intervals.as_deref(),
        issuer_resources_index.parent_rdi_intervals.as_deref(),
    )?;
    if effective_ip_resources.is_none() && effective_as_resources.is_none() {
        return Err(CaPathError::ResourcesMissing);
    }

    Ok(ValidatedSubordinateCaLite {
        child_ca,
        effective_ip_resources,
        effective_as_resources,
    })
}

fn parse_subject_pki_from_der(der: &[u8]) -> Result<SubjectPublicKeyInfo<'_>, CaPathError> {
    let (rem, spki) = SubjectPublicKeyInfo::from_der(der)
        .map_err(|e| CaPathError::IssuerSpkiParse(e.to_string()))?;
    if !rem.is_empty() {
        return Err(CaPathError::IssuerSpkiTrailingBytes(rem.len()));
    }
    Ok(spki)
}

fn parse_x509_cert(der: &[u8]) -> Result<X509Certificate<'_>, CaPathError> {
    let (rem, cert) = X509Certificate::from_der(der)
        .map_err(|e| CaPathError::ChildSignatureInvalid(e.to_string()))?;
    if !rem.is_empty() {
        return Err(CaPathError::ChildSignatureInvalid(
            "trailing bytes after child certificate".to_string(),
        ));
    }
    Ok(cert)
}

fn verify_child_signature(
    child: &X509Certificate<'_>,
    issuer_spki: &SubjectPublicKeyInfo<'_>,
) -> Result<(), CaPathError> {
    child
        .verify_signature(Some(issuer_spki))
        .map_err(|e| CaPathError::ChildSignatureInvalid(e.to_string()))
}

fn validate_child_aki_matches_issuer_ski(
    child: &ResourceCertificate,
    issuer: &ResourceCertificate,
) -> Result<(), CaPathError> {
    let Some(issuer_ski) = issuer.tbs.extensions.subject_key_identifier.as_deref() else {
        return Err(CaPathError::IssuerSkiMissing);
    };
    let Some(child_aki) = child.tbs.extensions.authority_key_identifier.as_deref() else {
        return Err(CaPathError::ChildAkiMissing);
    };
    if child_aki != issuer_ski {
        return Err(CaPathError::ChildAkiMismatch);
    }
    Ok(())
}

fn validate_child_aia_points_to_issuer_uri(
    child: &ResourceCertificate,
    issuer_ca_rsync_uri: &str,
) -> Result<(), CaPathError> {
    let Some(uris) = child.tbs.extensions.ca_issuers_uris.as_ref() else {
        return Err(CaPathError::ChildAiaMissing);
    };
    if !uris.iter().any(|u| u.as_str() == issuer_ca_rsync_uri) {
        return Err(CaPathError::ChildAiaIssuerUriMismatch);
    }
    Ok(())
}

fn validate_child_crldp_contains_issuer_crl_uri(
    child: &ResourceCertificate,
    issuer_crl_rsync_uri: &str,
) -> Result<(), CaPathError> {
    let Some(uris) = child.tbs.extensions.crl_distribution_points_uris.as_ref() else {
        return Err(CaPathError::ChildCrlDpMissing);
    };
    if !uris.iter().any(|u| u.as_str() == issuer_crl_rsync_uri) {
        return Err(CaPathError::ChildCrlDpUriMismatch);
    }
    Ok(())
}

fn validate_child_ca_key_usage(cert: &X509Certificate<'_>) -> Result<(), CaPathError> {
    let mut ku_critical: Option<bool> = None;
    for ext in cert.extensions() {
        if ext.oid.as_bytes() == OID_KEY_USAGE_RAW {
            ku_critical = Some(ext.critical);
            break;
        }
    }

    let Some(critical) = ku_critical else {
        return Err(CaPathError::KeyUsageMissing);
    };
    if !critical {
        return Err(CaPathError::KeyUsageNotCritical);
    }

    let Some(ku) = cert
        .key_usage()
        .map_err(|e| CaPathError::ChildSignatureInvalid(e.to_string()))?
    else {
        return Err(CaPathError::KeyUsageMissing);
    };

    let v = &ku.value;
    let ok = v.key_cert_sign()
        && v.crl_sign()
        && !v.digital_signature()
        && !v.non_repudiation()
        && !v.key_encipherment()
        && !v.data_encipherment()
        && !v.key_agreement()
        && !v.encipher_only()
        && !v.decipher_only();
    if !ok {
        return Err(CaPathError::KeyUsageInvalidBits);
    }

    Ok(())
}

fn time_within_validity(
    t: time::OffsetDateTime,
    not_before: time::OffsetDateTime,
    not_after: time::OffsetDateTime,
) -> bool {
    let t = t.to_offset(time::UtcOffset::UTC);
    let not_before = not_before.to_offset(time::UtcOffset::UTC);
    let not_after = not_after.to_offset(time::UtcOffset::UTC);
    t >= not_before && t <= not_after
}

fn crl_valid_at_time(crl: &RpkixCrl, t: time::OffsetDateTime) -> bool {
    let t = t.to_offset(time::UtcOffset::UTC);
    let this_update = crl.this_update.utc.to_offset(time::UtcOffset::UTC);
    let next_update = crl.next_update.utc.to_offset(time::UtcOffset::UTC);
    t >= this_update && t < next_update
}

fn is_serial_revoked_by_crl(cert: &ResourceCertificate, crl: &RpkixCrl) -> bool {
    let serial = BigUnsigned::from_biguint(&cert.tbs.serial_number);
    crl.revoked_certs
        .iter()
        .any(|rc| rc.serial_number == serial)
}

fn resolve_child_ip_resources(
    child_ip: Option<&IpResourceSet>,
    issuer_effective: Option<&IpResourceSet>,
) -> Result<Option<IpResourceSet>, CaPathError> {
    let precomputed_parent_by_afi = issuer_effective
        .map(ip_resources_by_afi_items)
        .transpose()?;
    let precomputed_parent_intervals = issuer_effective
        .map(ip_resources_to_merged_intervals_by_afi)
        .unwrap_or_default();
    resolve_child_ip_resources_indexed(
        child_ip,
        issuer_effective,
        precomputed_parent_by_afi.as_ref(),
        &precomputed_parent_intervals,
    )
}

fn resolve_child_ip_resources_indexed(
    child_ip: Option<&IpResourceSet>,
    issuer_effective: Option<&IpResourceSet>,
    parent_by_afi: Option<
        &BTreeMap<crate::data_model::rc::Afi, Vec<crate::data_model::rc::IpAddressOrRange>>,
    >,
    parent_intervals_by_afi: &HashMap<crate::data_model::rc::Afi, Vec<(Vec<u8>, Vec<u8>)>>,
) -> Result<Option<IpResourceSet>, CaPathError> {
    let Some(child_ip) = child_ip else {
        return Ok(None);
    };

    let Some(_parent) = issuer_effective else {
        if child_ip.has_any_inherit() {
            return Err(CaPathError::InheritWithoutParentResources);
        }
        // With no parent effective resources, we cannot validate subset.
        return Err(CaPathError::ResourcesNotSubset);
    };

    // Resolve per-AFI inherit, producing an effective set with no inherit.
    let parent_by_afi = parent_by_afi.ok_or(CaPathError::InheritWithoutParentResources)?;
    let mut out_families: Vec<crate::data_model::rc::IpAddressFamily> = Vec::new();

    for fam in &child_ip.families {
        match &fam.choice {
            IpAddressChoice::Inherit => {
                let items = parent_by_afi
                    .get(&fam.afi)
                    .ok_or(CaPathError::InheritWithoutParentResources)?;
                out_families.push(crate::data_model::rc::IpAddressFamily {
                    afi: fam.afi,
                    choice: IpAddressChoice::AddressesOrRanges(items.clone()),
                });
            }
            IpAddressChoice::AddressesOrRanges(items) => {
                // Subset check against parent union for that AFI.
                let parent_intervals = parent_intervals_by_afi
                    .get(&fam.afi)
                    .map(Vec::as_slice)
                    .unwrap_or(&[]);
                if !ip_family_items_subset_with_parent_intervals(items, parent_intervals) {
                    return Err(CaPathError::ResourcesNotSubset);
                }
                out_families.push(crate::data_model::rc::IpAddressFamily {
                    afi: fam.afi,
                    choice: IpAddressChoice::AddressesOrRanges(items.clone()),
                });
            }
        }
    }

    Ok(Some(IpResourceSet {
        families: out_families,
    }))
}

fn resolve_child_as_resources(
    child_as: Option<&AsResourceSet>,
    issuer_effective: Option<&AsResourceSet>,
) -> Result<Option<AsResourceSet>, CaPathError> {
    let precomputed_asnum = issuer_effective
        .and_then(|resources| resources.asnum.as_ref().map(as_choice_to_merged_intervals));
    let precomputed_rdi = issuer_effective
        .and_then(|resources| resources.rdi.as_ref().map(as_choice_to_merged_intervals));
    resolve_child_as_resources_indexed(
        child_as,
        issuer_effective,
        precomputed_asnum.as_deref(),
        precomputed_rdi.as_deref(),
    )
}

fn resolve_child_as_resources_indexed(
    child_as: Option<&AsResourceSet>,
    issuer_effective: Option<&AsResourceSet>,
    parent_asnum_intervals: Option<&[(u32, u32)]>,
    parent_rdi_intervals: Option<&[(u32, u32)]>,
) -> Result<Option<AsResourceSet>, CaPathError> {
    let Some(child_as) = child_as else {
        return Ok(None);
    };
    let Some(parent) = issuer_effective else {
        if matches!(child_as.asnum, Some(AsIdentifierChoice::Inherit))
            || matches!(child_as.rdi, Some(AsIdentifierChoice::Inherit))
        {
            return Err(CaPathError::InheritWithoutParentResources);
        }
        return Err(CaPathError::ResourcesNotSubset);
    };

    let asnum = match child_as.asnum.as_ref() {
        None => None,
        Some(AsIdentifierChoice::Inherit) => parent
            .asnum
            .clone()
            .ok_or(CaPathError::InheritWithoutParentResources)
            .map(Some)?,
        Some(_) => {
            if !as_choice_subset_with_parent_intervals(
                child_as.asnum.as_ref(),
                parent.asnum.as_ref(),
                parent_asnum_intervals,
            ) {
                return Err(CaPathError::ResourcesNotSubset);
            }
            child_as.asnum.clone()
        }
    };

    let rdi = match child_as.rdi.as_ref() {
        None => None,
        Some(AsIdentifierChoice::Inherit) => parent
            .rdi
            .clone()
            .ok_or(CaPathError::InheritWithoutParentResources)
            .map(Some)?,
        Some(_) => {
            if !as_choice_subset_with_parent_intervals(
                child_as.rdi.as_ref(),
                parent.rdi.as_ref(),
                parent_rdi_intervals,
            ) {
                return Err(CaPathError::ResourcesNotSubset);
            }
            child_as.rdi.clone()
        }
    };

    Ok(Some(AsResourceSet { asnum, rdi }))
}

fn as_choice_subset(
    child: Option<&AsIdentifierChoice>,
    parent: Option<&AsIdentifierChoice>,
) -> bool {
    as_choice_subset_with_parent_intervals(child, parent, None)
}

fn as_choice_subset_with_parent_intervals(
    child: Option<&AsIdentifierChoice>,
    parent: Option<&AsIdentifierChoice>,
    parent_intervals_hint: Option<&[(u32, u32)]>,
) -> bool {
    let Some(child) = child else {
        return true;
    };
    let Some(parent) = parent else {
        return false;
    };

    // Treat inherit as "all of parent" here; actual resolution is handled elsewhere.
    if matches!(child, AsIdentifierChoice::Inherit) {
        return true;
    }
    if matches!(parent, AsIdentifierChoice::Inherit) {
        return true;
    }

    let child_intervals = as_choice_to_merged_intervals(child);
    let owned_parent_intervals;
    let parent_intervals = match parent_intervals_hint {
        Some(intervals) => intervals,
        None => {
            owned_parent_intervals = as_choice_to_merged_intervals(parent);
            owned_parent_intervals.as_slice()
        }
    };
    for (cmin, cmax) in &child_intervals {
        if !as_interval_is_covered(parent_intervals, *cmin, *cmax) {
            return false;
        }
    }
    true
}

fn as_choice_to_merged_intervals(choice: &AsIdentifierChoice) -> Vec<(u32, u32)> {
    let mut v = Vec::new();
    match choice {
        AsIdentifierChoice::Inherit => {}
        AsIdentifierChoice::AsIdsOrRanges(items) => {
            for item in items {
                match item {
                    crate::data_model::rc::AsIdOrRange::Id(id) => v.push((*id, *id)),
                    crate::data_model::rc::AsIdOrRange::Range { min, max } => v.push((*min, *max)),
                }
            }
        }
    }
    v.sort_by_key(|(a, _b)| *a);
    merge_as_intervals(&v)
}

fn merge_as_intervals(v: &[(u32, u32)]) -> Vec<(u32, u32)> {
    let mut out: Vec<(u32, u32)> = Vec::new();
    for (min, max) in v {
        let Some(last) = out.last_mut() else {
            out.push((*min, *max));
            continue;
        };
        if *min <= last.1.saturating_add(1) {
            last.1 = last.1.max(*max);
            continue;
        }
        out.push((*min, *max));
    }
    out
}

fn as_interval_is_covered(parent: &[(u32, u32)], min: u32, max: u32) -> bool {
    for (pmin, pmax) in parent {
        if *pmin <= min && max <= *pmax {
            return true;
        }
        if *pmin > min {
            break;
        }
    }
    false
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
enum AfiKey {
    V4,
    V6,
}

fn ip_resources_by_afi_items(
    set: &IpResourceSet,
) -> Result<
    std::collections::BTreeMap<
        crate::data_model::rc::Afi,
        Vec<crate::data_model::rc::IpAddressOrRange>,
    >,
    CaPathError,
> {
    let mut m: std::collections::BTreeMap<
        crate::data_model::rc::Afi,
        Vec<crate::data_model::rc::IpAddressOrRange>,
    > = std::collections::BTreeMap::new();
    for fam in &set.families {
        match &fam.choice {
            IpAddressChoice::Inherit => return Err(CaPathError::InheritWithoutParentResources),
            IpAddressChoice::AddressesOrRanges(items) => {
                m.insert(fam.afi, items.clone());
            }
        }
    }
    Ok(m)
}

fn ip_resources_single_afi(
    parent: &IpResourceSet,
    afi: crate::data_model::rc::Afi,
    items: Option<&Vec<crate::data_model::rc::IpAddressOrRange>>,
) -> IpResourceSet {
    let mut families = Vec::new();
    if let Some(items) = items {
        families.push(crate::data_model::rc::IpAddressFamily {
            afi,
            choice: IpAddressChoice::AddressesOrRanges(items.clone()),
        });
    } else {
        // If parent doesn't mention this AFI explicitly, treat as empty.
        // The subset check will fail.
        let _ = parent;
    }
    IpResourceSet { families }
}

fn ip_family_items_subset(
    child_items: &[crate::data_model::rc::IpAddressOrRange],
    parent_set: &IpResourceSet,
) -> bool {
    let parent_by_afi = ip_resources_to_merged_intervals(parent_set);
    // parent_set should contain exactly one AFI.
    let (afi_key, parent_intervals) = match parent_by_afi.into_iter().next() {
        None => return false,
        Some(v) => v,
    };

    let mut child_intervals: Vec<(Vec<u8>, Vec<u8>)> = Vec::new();
    for item in child_items {
        match item {
            crate::data_model::rc::IpAddressOrRange::Prefix(p) => {
                child_intervals.push(prefix_to_range(p))
            }
            crate::data_model::rc::IpAddressOrRange::Range(r) => {
                child_intervals.push((r.min.clone(), r.max.clone()))
            }
        }
    }
    child_intervals.sort_by(|(a, _), (b, _)| a.cmp(b));
    let child_intervals = merge_ip_intervals(&child_intervals);

    let _ = afi_key;
    for (cmin, cmax) in &child_intervals {
        if !interval_is_covered(&parent_intervals, cmin, cmax) {
            return false;
        }
    }
    true
}

fn ip_resources_to_merged_intervals(
    set: &IpResourceSet,
) -> std::collections::HashMap<AfiKey, Vec<(Vec<u8>, Vec<u8>)>> {
    let m = ip_resources_to_merged_intervals_by_afi(set);
    m.into_iter()
        .map(|(afi, ranges)| {
            (
                match afi {
                    crate::data_model::rc::Afi::Ipv4 => AfiKey::V4,
                    crate::data_model::rc::Afi::Ipv6 => AfiKey::V6,
                },
                ranges,
            )
        })
        .collect()
}

fn ip_resources_to_merged_intervals_by_afi(
    set: &IpResourceSet,
) -> HashMap<crate::data_model::rc::Afi, Vec<(Vec<u8>, Vec<u8>)>> {
    let mut m: HashMap<crate::data_model::rc::Afi, Vec<(Vec<u8>, Vec<u8>)>> = HashMap::new();

    for fam in &set.families {
        match &fam.choice {
            IpAddressChoice::Inherit => {
                // When used in subset checks, treat inherit as "all" by leaving it absent.
                // Resolution should have happened earlier.
            }
            IpAddressChoice::AddressesOrRanges(items) => {
                let ent = m.entry(fam.afi).or_default();
                for item in items {
                    match item {
                        crate::data_model::rc::IpAddressOrRange::Prefix(p) => {
                            let (min, max) = prefix_to_range(p);
                            ent.push((min, max));
                        }
                        crate::data_model::rc::IpAddressOrRange::Range(r) => {
                            ent.push((r.min.clone(), r.max.clone()));
                        }
                    }
                }
            }
        }
    }

    for (_afi, v) in m.iter_mut() {
        v.sort_by(|(a, _), (b, _)| a.cmp(b));
        *v = merge_ip_intervals(v);
    }

    m
}

fn ip_family_items_subset_with_parent_intervals(
    child_items: &[crate::data_model::rc::IpAddressOrRange],
    parent_intervals: &[(Vec<u8>, Vec<u8>)],
) -> bool {
    if parent_intervals.is_empty() {
        return false;
    }

    let mut child_intervals: Vec<(Vec<u8>, Vec<u8>)> = Vec::new();
    for item in child_items {
        match item {
            crate::data_model::rc::IpAddressOrRange::Prefix(p) => {
                child_intervals.push(prefix_to_range(p))
            }
            crate::data_model::rc::IpAddressOrRange::Range(r) => {
                child_intervals.push((r.min.clone(), r.max.clone()))
            }
        }
    }
    child_intervals.sort_by(|(a, _), (b, _)| a.cmp(b));
    let child_intervals = merge_ip_intervals(&child_intervals);

    for (cmin, cmax) in &child_intervals {
        if !interval_is_covered(parent_intervals, cmin, cmax) {
            return false;
        }
    }
    true
}

fn merge_ip_intervals(v: &[(Vec<u8>, Vec<u8>)]) -> Vec<(Vec<u8>, Vec<u8>)> {
    let mut out: Vec<(Vec<u8>, Vec<u8>)> = Vec::new();
    for (min, max) in v {
        let Some(last) = out.last_mut() else {
            out.push((min.clone(), max.clone()));
            continue;
        };

        if bytes_leq(min, &increment_bytes(&last.1)) {
            if bytes_leq(&last.1, max) {
                last.1 = max.clone();
            }
            continue;
        }

        out.push((min.clone(), max.clone()));
    }
    out
}

fn interval_is_covered(parent: &[(Vec<u8>, Vec<u8>)], min: &[u8], max: &[u8]) -> bool {
    for (pmin, pmax) in parent {
        if bytes_leq(pmin, min) && bytes_leq(max, pmax) {
            return true;
        }
        if pmin.as_slice() > min {
            break;
        }
    }
    false
}

fn prefix_to_range(prefix: &crate::data_model::rc::IpPrefix) -> (Vec<u8>, Vec<u8>) {
    let mut min = prefix.addr.clone();
    let mut max = prefix.addr.clone();

    let bitlen = match prefix.afi {
        crate::data_model::rc::Afi::Ipv4 => 32u16,
        crate::data_model::rc::Afi::Ipv6 => 128u16,
    };
    let plen = prefix.prefix_len.min(bitlen);
    for bit in plen..bitlen {
        let byte = (bit / 8) as usize;
        let offset = 7 - (bit % 8);
        let mask = 1u8 << offset;
        min[byte] &= !mask;
        max[byte] |= mask;
    }
    (min, max)
}

fn bytes_leq(a: &[u8], b: &[u8]) -> bool {
    a <= b
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::data_model::common::X509NameDer;
    use crate::data_model::rc::{
        Afi, AsIdentifierChoice, AsResourceSet, IpAddressChoice, IpAddressFamily, IpAddressOrRange,
        IpResourceSet,
    };
    use crate::data_model::rc::{
        RcExtensions, ResourceCertKind, ResourceCertificate, RpkixTbsCertificate,
    };
    use der_parser::num_bigint::BigUint;
    use std::process::Command;
    fn dummy_cert(
        kind: ResourceCertKind,
        subject_dn: &str,
        issuer_dn: &str,
        ski: Option<Vec<u8>>,
        aki: Option<Vec<u8>>,
        aia: Option<Vec<&str>>,
        crldp: Option<Vec<&str>>,
    ) -> ResourceCertificate {
        let aia = aia.map(|v| v.into_iter().map(|s| s.to_string()).collect::<Vec<_>>());
        let crldp = crldp.map(|v| v.into_iter().map(|s| s.to_string()).collect::<Vec<_>>());

        ResourceCertificate {
            raw_der: Vec::new(),
            kind,
            tbs: RpkixTbsCertificate {
                version: 2,
                serial_number: BigUint::from(1u8),
                signature_algorithm: "1.2.840.113549.1.1.11".to_string(),
                issuer_name: X509NameDer(issuer_dn.as_bytes().to_vec()),
                subject_name: X509NameDer(subject_dn.as_bytes().to_vec()),
                validity_not_before: time::OffsetDateTime::UNIX_EPOCH,
                validity_not_after: time::OffsetDateTime::UNIX_EPOCH,
                subject_public_key_info: Vec::new(),
                extensions: RcExtensions {
                    basic_constraints_ca: kind == ResourceCertKind::Ca,
                    subject_key_identifier: ski,
                    authority_key_identifier: aki,
                    crl_distribution_points_uris: crldp,
                    ca_issuers_uris: aia,
                    subject_info_access: None,
                    certificate_policies_oid: None,
                    ip_resources: None,
                    as_resources: None,
                },
            },
        }
    }

    fn openssl_available() -> bool {
        Command::new("openssl")
            .arg("version")
            .output()
            .map(|o| o.status.success())
            .unwrap_or(false)
    }

    fn write_cert_der_with_addext(dir: &std::path::Path, addext: Option<&str>) -> Vec<u8> {
        assert!(openssl_available(), "openssl is required for this test");
        let key = dir.join("k.pem");
        let cert = dir.join("c.pem");
        let der = dir.join("c.der");

        let mut cmd = Command::new("openssl");
        cmd.arg("req")
            .arg("-x509")
            .arg("-newkey")
            .arg("rsa:2048")
            .arg("-nodes")
            .arg("-keyout")
            .arg(&key)
            .arg("-subj")
            .arg("/CN=ku")
            .arg("-days")
            .arg("1")
            .arg("-out")
            .arg(&cert);
        if let Some(ext) = addext {
            cmd.arg("-addext").arg(ext);
        }
        let out = cmd.output().expect("openssl req");
        assert!(
            out.status.success(),
            "openssl req failed: {}",
            String::from_utf8_lossy(&out.stderr)
        );

        let out = Command::new("openssl")
            .arg("x509")
            .arg("-in")
            .arg(&cert)
            .arg("-outform")
            .arg("DER")
            .arg("-out")
            .arg(&der)
            .output()
            .expect("openssl x509");
        assert!(
            out.status.success(),
            "openssl x509 failed: {}",
            String::from_utf8_lossy(&out.stderr)
        );
        std::fs::read(&der).expect("read der")
    }

    fn gen_issuer_and_child_der(dir: &std::path::Path) -> (Vec<u8>, Vec<u8>, Vec<u8>) {
        assert!(openssl_available(), "openssl is required for this test");
        let issuer_key = dir.join("issuer.key");
        let issuer_csr = dir.join("issuer.csr");
        let issuer_pem = dir.join("issuer.pem");
        let issuer_der = dir.join("issuer.der");

        let child_key = dir.join("child.key");
        let child_csr = dir.join("child.csr");
        let child_pem = dir.join("child.pem");
        let child_der = dir.join("child.der");

        let other_key = dir.join("other.key");
        let other_csr = dir.join("other.csr");
        let other_pem = dir.join("other.pem");
        let other_der = dir.join("other.der");

        let run = |cmd: &mut Command| {
            let out = cmd.output().expect("run openssl");
            assert!(
                out.status.success(),
                "command failed: {:?}\nstderr={}",
                cmd,
                String::from_utf8_lossy(&out.stderr)
            );
        };

        // Issuer self-signed.
        run(Command::new("openssl")
            .args(["genrsa", "-out"])
            .arg(&issuer_key)
            .arg("2048"));
        run(Command::new("openssl")
            .args(["req", "-new", "-key"])
            .arg(&issuer_key)
            .args(["-subj", "/CN=issuer", "-out"])
            .arg(&issuer_csr));
        run(Command::new("openssl")
            .args(["x509", "-req", "-in"])
            .arg(&issuer_csr)
            .args(["-signkey"])
            .arg(&issuer_key)
            .args(["-days", "1", "-out"])
            .arg(&issuer_pem));
        run(Command::new("openssl")
            .args(["x509", "-in"])
            .arg(&issuer_pem)
            .args(["-outform", "DER", "-out"])
            .arg(&issuer_der));

        // Child signed by issuer.
        run(Command::new("openssl")
            .args(["genrsa", "-out"])
            .arg(&child_key)
            .arg("2048"));
        run(Command::new("openssl")
            .args(["req", "-new", "-key"])
            .arg(&child_key)
            .args(["-subj", "/CN=child", "-out"])
            .arg(&child_csr));
        run(Command::new("openssl")
            .args(["x509", "-req", "-in"])
            .arg(&child_csr)
            .args(["-CA"])
            .arg(&issuer_pem)
            .args(["-CAkey"])
            .arg(&issuer_key)
            .args(["-CAcreateserial", "-days", "1", "-out"])
            .arg(&child_pem));
        run(Command::new("openssl")
            .args(["x509", "-in"])
            .arg(&child_pem)
            .args(["-outform", "DER", "-out"])
            .arg(&child_der));

        // Other self-signed issuer.
        run(Command::new("openssl")
            .args(["genrsa", "-out"])
            .arg(&other_key)
            .arg("2048"));
        run(Command::new("openssl")
            .args(["req", "-new", "-key"])
            .arg(&other_key)
            .args(["-subj", "/CN=other", "-out"])
            .arg(&other_csr));
        run(Command::new("openssl")
            .args(["x509", "-req", "-in"])
            .arg(&other_csr)
            .args(["-signkey"])
            .arg(&other_key)
            .args(["-days", "1", "-out"])
            .arg(&other_pem));
        run(Command::new("openssl")
            .args(["x509", "-in"])
            .arg(&other_pem)
            .args(["-outform", "DER", "-out"])
            .arg(&other_der));

        (
            std::fs::read(&issuer_der).expect("read issuer der"),
            std::fs::read(&child_der).expect("read child der"),
            std::fs::read(&other_der).expect("read other der"),
        )
    }

    #[test]
    fn resolve_child_ip_resources_rejects_inherit_without_parent_effective_resources() {
        let child = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::Inherit,
            }],
        };
        let err = resolve_child_ip_resources(Some(&child), None).unwrap_err();
        assert!(matches!(err, CaPathError::InheritWithoutParentResources));
    }

    #[test]
    fn resolve_child_ip_resources_rejects_non_inherit_without_parent_effective_resources() {
        let child = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::AddressesOrRanges(vec![]),
            }],
        };
        let err = resolve_child_ip_resources(Some(&child), None).unwrap_err();
        assert!(matches!(err, CaPathError::ResourcesNotSubset));
    }

    #[test]
    fn ip_resources_by_afi_items_rejects_inherit_families() {
        let parent = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv6,
                choice: IpAddressChoice::Inherit,
            }],
        };
        let err = ip_resources_by_afi_items(&parent).unwrap_err();
        assert!(matches!(err, CaPathError::InheritWithoutParentResources));
    }

    #[test]
    fn resolve_child_as_resources_rejects_inherit_without_parent_effective_resources() {
        let child = AsResourceSet {
            asnum: Some(AsIdentifierChoice::Inherit),
            rdi: None,
        };
        let err = resolve_child_as_resources(Some(&child), None).unwrap_err();
        assert!(matches!(err, CaPathError::InheritWithoutParentResources));
    }

    #[test]
    fn child_aki_mismatch_is_rejected() {
        let issuer = dummy_cert(
            ResourceCertKind::Ca,
            "CN=issuer",
            "CN=issuer",
            Some(vec![1]),
            None,
            None,
            None,
        );
        let child = dummy_cert(
            ResourceCertKind::Ca,
            "CN=child",
            "CN=issuer",
            Some(vec![2]),
            Some(vec![9]),
            Some(vec!["rsync://example.test/issuer.cer"]),
            Some(vec!["rsync://example.test/issuer.crl"]),
        );
        let err = validate_child_aki_matches_issuer_ski(&child, &issuer).unwrap_err();
        assert!(matches!(err, CaPathError::ChildAkiMismatch), "{err}");
    }

    #[test]
    fn child_aia_missing_is_rejected() {
        let _issuer = dummy_cert(
            ResourceCertKind::Ca,
            "CN=issuer",
            "CN=issuer",
            Some(vec![1]),
            None,
            None,
            None,
        );
        let child = dummy_cert(
            ResourceCertKind::Ca,
            "CN=child",
            "CN=issuer",
            Some(vec![2]),
            Some(vec![1]),
            None,
            Some(vec!["rsync://example.test/issuer.crl"]),
        );
        let err =
            validate_child_aia_points_to_issuer_uri(&child, "rsync://example.test/issuer.cer")
                .unwrap_err();
        assert!(matches!(err, CaPathError::ChildAiaMissing), "{err}");

        // Also cover issuer ski missing.
        let issuer_missing_ski = dummy_cert(
            ResourceCertKind::Ca,
            "CN=issuer",
            "CN=issuer",
            None,
            None,
            None,
            None,
        );
        let err = validate_child_aki_matches_issuer_ski(&child, &issuer_missing_ski).unwrap_err();
        assert!(matches!(err, CaPathError::IssuerSkiMissing), "{err}");
    }

    #[test]
    fn child_aia_issuer_uri_mismatch_is_rejected() {
        let _issuer = dummy_cert(
            ResourceCertKind::Ca,
            "CN=issuer",
            "CN=issuer",
            Some(vec![1]),
            None,
            None,
            None,
        );
        let child = dummy_cert(
            ResourceCertKind::Ca,
            "CN=child",
            "CN=issuer",
            Some(vec![2]),
            Some(vec![1]),
            Some(vec!["rsync://example.test/other.cer"]),
            Some(vec!["rsync://example.test/issuer.crl"]),
        );
        let err =
            validate_child_aia_points_to_issuer_uri(&child, "rsync://example.test/issuer.cer")
                .unwrap_err();
        assert!(
            matches!(err, CaPathError::ChildAiaIssuerUriMismatch),
            "{err}"
        );
    }

    #[test]
    fn child_crldp_mismatch_is_rejected() {
        let issuer = dummy_cert(
            ResourceCertKind::Ca,
            "CN=issuer",
            "CN=issuer",
            Some(vec![1]),
            None,
            None,
            None,
        );
        let child = dummy_cert(
            ResourceCertKind::Ca,
            "CN=child",
            "CN=issuer",
            Some(vec![2]),
            Some(vec![1]),
            Some(vec!["rsync://example.test/issuer.cer"]),
            None,
        );
        let err =
            validate_child_crldp_contains_issuer_crl_uri(&child, "rsync://example.test/issuer.crl")
                .unwrap_err();
        assert!(matches!(err, CaPathError::ChildCrlDpMissing), "{err}");

        let child = dummy_cert(
            ResourceCertKind::Ca,
            "CN=child",
            "CN=issuer",
            Some(vec![2]),
            Some(vec![1]),
            Some(vec!["rsync://example.test/issuer.cer"]),
            Some(vec!["rsync://example.test/other.crl"]),
        );
        let err =
            validate_child_crldp_contains_issuer_crl_uri(&child, "rsync://example.test/issuer.crl")
                .unwrap_err();
        assert!(matches!(err, CaPathError::ChildCrlDpUriMismatch), "{err}");

        // Cover child AKI missing.
        let child_missing_aki = dummy_cert(
            ResourceCertKind::Ca,
            "CN=child",
            "CN=issuer",
            Some(vec![2]),
            None,
            Some(vec!["rsync://example.test/issuer.cer"]),
            Some(vec!["rsync://example.test/issuer.crl"]),
        );
        let err = validate_child_aki_matches_issuer_ski(&child_missing_aki, &issuer).unwrap_err();
        assert!(matches!(err, CaPathError::ChildAkiMissing), "{err}");
    }

    #[test]
    fn child_binding_checks_accept_when_matching() {
        let issuer = dummy_cert(
            ResourceCertKind::Ca,
            "CN=issuer",
            "CN=issuer",
            Some(vec![1]),
            None,
            None,
            None,
        );
        let child = dummy_cert(
            ResourceCertKind::Ca,
            "CN=child",
            "CN=issuer",
            Some(vec![2]),
            Some(vec![1]),
            Some(vec!["rsync://example.test/issuer.cer"]),
            Some(vec!["rsync://example.test/issuer.crl"]),
        );
        validate_child_aki_matches_issuer_ski(&child, &issuer).expect("aki ok");
        validate_child_aia_points_to_issuer_uri(&child, "rsync://example.test/issuer.cer")
            .expect("aia ok");
        validate_child_crldp_contains_issuer_crl_uri(&child, "rsync://example.test/issuer.crl")
            .expect("crldp ok");
    }

    #[test]
    fn validate_child_ca_key_usage_accepts_only_keycertsign_and_crlsign_critical() {
        let td = tempfile::tempdir().expect("tempdir");
        let der = write_cert_der_with_addext(
            td.path(),
            Some("keyUsage = critical, keyCertSign, cRLSign"),
        );
        let cert = parse_x509_cert(&der).expect("x509 parse ok");
        validate_child_ca_key_usage(&cert).expect("key usage ok");
    }

    #[test]
    fn validate_child_ca_key_usage_rejects_missing_noncritical_and_invalid_bits() {
        let td = tempfile::tempdir().expect("tempdir");
        let missing = write_cert_der_with_addext(td.path(), None);
        let cert = parse_x509_cert(&missing).expect("x509 parse ok");
        let err = validate_child_ca_key_usage(&cert).unwrap_err();
        assert!(matches!(err, CaPathError::KeyUsageMissing), "{err}");

        let td = tempfile::tempdir().expect("tempdir");
        let noncritical =
            write_cert_der_with_addext(td.path(), Some("keyUsage = keyCertSign, cRLSign"));
        let cert = parse_x509_cert(&noncritical).expect("x509 parse ok");
        let err = validate_child_ca_key_usage(&cert).unwrap_err();
        assert!(matches!(err, CaPathError::KeyUsageNotCritical), "{err}");

        let td = tempfile::tempdir().expect("tempdir");
        let invalid = write_cert_der_with_addext(
            td.path(),
            Some("keyUsage = critical, keyCertSign, cRLSign, digitalSignature"),
        );
        let cert = parse_x509_cert(&invalid).expect("x509 parse ok");
        let err = validate_child_ca_key_usage(&cert).unwrap_err();
        assert!(matches!(err, CaPathError::KeyUsageInvalidBits), "{err}");
    }

    #[test]
    fn verify_cert_signature_with_issuer_accepts_valid_chain_and_rejects_wrong_issuer() {
        let td = tempfile::tempdir().expect("tempdir");
        let (issuer, child, other) = gen_issuer_and_child_der(td.path());
        let issuer_cert = parse_x509_cert(&issuer).expect("x509 parse issuer");
        let child_cert = parse_x509_cert(&child).expect("x509 parse child");
        verify_child_signature(&child_cert, &issuer_cert.tbs_certificate.subject_pki)
            .expect("signature ok");
        let other_cert = parse_x509_cert(&other).expect("x509 parse other");
        let err = verify_child_signature(&child_cert, &other_cert.tbs_certificate.subject_pki)
            .unwrap_err();
        assert!(
            matches!(err, CaPathError::ChildSignatureInvalid(_)),
            "{err}"
        );
    }

    #[test]
    fn issuer_effective_resources_index_and_indexed_resolvers_cover_success_and_failure_paths() {
        use crate::data_model::rc::{AsIdOrRange, IpPrefix};

        let parent_ip = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::AddressesOrRanges(vec![IpAddressOrRange::Prefix(
                    IpPrefix {
                        afi: Afi::Ipv4,
                        prefix_len: 8,
                        addr: vec![10, 0, 0, 0],
                    },
                )]),
            }],
        };
        let parent_as = AsResourceSet {
            asnum: Some(AsIdentifierChoice::AsIdsOrRanges(vec![
                AsIdOrRange::Range {
                    min: 64500,
                    max: 64599,
                },
            ])),
            rdi: Some(AsIdentifierChoice::AsIdsOrRanges(vec![AsIdOrRange::Id(
                65000,
            )])),
        };
        let idx = IssuerEffectiveResourcesIndex::from_effective_resources(
            Some(&parent_ip),
            Some(&parent_as),
        )
        .expect("index builds");
        assert_eq!(
            idx.parent_ip_by_afi_items.as_ref().map(|v| v.len()),
            Some(1)
        );
        assert_eq!(idx.parent_ip_merged_intervals.len(), 1);
        assert_eq!(
            idx.parent_asnum_intervals.as_ref().map(|v| v.len()),
            Some(1)
        );
        assert_eq!(idx.parent_rdi_intervals.as_ref().map(|v| v.len()), Some(1));

        let child_ip_subset = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::AddressesOrRanges(vec![IpAddressOrRange::Prefix(
                    IpPrefix {
                        afi: Afi::Ipv4,
                        prefix_len: 16,
                        addr: vec![10, 1, 0, 0],
                    },
                )]),
            }],
        };
        assert!(
            resolve_child_ip_resources_indexed(
                Some(&child_ip_subset),
                Some(&parent_ip),
                idx.parent_ip_by_afi_items.as_ref(),
                &idx.parent_ip_merged_intervals,
            )
            .expect("subset should resolve")
            .is_some()
        );

        let child_ip_bad = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::AddressesOrRanges(vec![IpAddressOrRange::Prefix(
                    IpPrefix {
                        afi: Afi::Ipv4,
                        prefix_len: 16,
                        addr: vec![11, 0, 0, 0],
                    },
                )]),
            }],
        };
        let err = resolve_child_ip_resources_indexed(
            Some(&child_ip_bad),
            Some(&parent_ip),
            idx.parent_ip_by_afi_items.as_ref(),
            &idx.parent_ip_merged_intervals,
        )
        .unwrap_err();
        assert!(matches!(err, CaPathError::ResourcesNotSubset));

        let child_as_subset = AsResourceSet {
            asnum: Some(AsIdentifierChoice::AsIdsOrRanges(vec![AsIdOrRange::Id(
                64542,
            )])),
            rdi: Some(AsIdentifierChoice::AsIdsOrRanges(vec![AsIdOrRange::Id(
                65000,
            )])),
        };
        assert!(
            resolve_child_as_resources_indexed(
                Some(&child_as_subset),
                Some(&parent_as),
                idx.parent_asnum_intervals.as_deref(),
                idx.parent_rdi_intervals.as_deref(),
            )
            .expect("subset as resolves")
            .is_some()
        );

        let child_as_bad = AsResourceSet {
            asnum: Some(AsIdentifierChoice::AsIdsOrRanges(vec![AsIdOrRange::Id(
                65123,
            )])),
            rdi: None,
        };
        let err = resolve_child_as_resources_indexed(
            Some(&child_as_bad),
            Some(&parent_as),
            idx.parent_asnum_intervals.as_deref(),
            idx.parent_rdi_intervals.as_deref(),
        )
        .unwrap_err();
        assert!(matches!(err, CaPathError::ResourcesNotSubset));
    }

    #[test]
    fn resolve_child_ip_and_as_resources_success_paths() {
        use crate::data_model::rc::{AsIdOrRange, IpAddressOrRange, IpPrefix};

        let parent_ip = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::AddressesOrRanges(vec![IpAddressOrRange::Prefix(
                    IpPrefix {
                        afi: Afi::Ipv4,
                        prefix_len: 8,
                        addr: vec![10, 0, 0, 0],
                    },
                )]),
            }],
        };

        let child_ip_inherit = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::Inherit,
            }],
        };
        let eff = resolve_child_ip_resources(Some(&child_ip_inherit), Some(&parent_ip))
            .expect("inherit resolves")
            .expect("some ip");
        assert_eq!(eff.families.len(), 1);
        assert!(matches!(
            eff.families[0].choice,
            IpAddressChoice::AddressesOrRanges(_)
        ));

        let child_ip_subset = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::AddressesOrRanges(vec![IpAddressOrRange::Prefix(
                    IpPrefix {
                        afi: Afi::Ipv4,
                        prefix_len: 16,
                        addr: vec![10, 1, 0, 0],
                    },
                )]),
            }],
        };
        resolve_child_ip_resources(Some(&child_ip_subset), Some(&parent_ip))
            .expect("subset ok")
            .expect("some");

        let child_ip_bad = IpResourceSet {
            families: vec![IpAddressFamily {
                afi: Afi::Ipv4,
                choice: IpAddressChoice::AddressesOrRanges(vec![IpAddressOrRange::Prefix(
                    IpPrefix {
                        afi: Afi::Ipv4,
                        prefix_len: 16,
                        addr: vec![11, 0, 0, 0],
                    },
                )]),
            }],
        };
        let err = resolve_child_ip_resources(Some(&child_ip_bad), Some(&parent_ip)).unwrap_err();
        assert!(matches!(err, CaPathError::ResourcesNotSubset), "{err}");

        let parent_as = AsResourceSet {
            asnum: Some(AsIdentifierChoice::AsIdsOrRanges(vec![
                AsIdOrRange::Range { min: 1, max: 100 },
            ])),
            rdi: None,
        };
        let child_as_inherit = AsResourceSet {
            asnum: Some(AsIdentifierChoice::Inherit),
            rdi: None,
        };
        let eff_as = resolve_child_as_resources(Some(&child_as_inherit), Some(&parent_as))
            .expect("inherit as")
            .expect("some");
        assert_eq!(eff_as.asnum, parent_as.asnum);

        let child_as_subset = AsResourceSet {
            asnum: Some(AsIdentifierChoice::AsIdsOrRanges(vec![AsIdOrRange::Id(50)])),
            rdi: None,
        };
        resolve_child_as_resources(Some(&child_as_subset), Some(&parent_as))
            .expect("subset as")
            .expect("some");

        let child_as_bad = AsResourceSet {
            asnum: Some(AsIdentifierChoice::AsIdsOrRanges(vec![AsIdOrRange::Id(
                200,
            )])),
            rdi: None,
        };
        let err = resolve_child_as_resources(Some(&child_as_bad), Some(&parent_as)).unwrap_err();
        assert!(matches!(err, CaPathError::ResourcesNotSubset), "{err}");
    }
}

fn increment_bytes(v: &[u8]) -> Vec<u8> {
    let mut out = v.to_vec();
    for i in (0..out.len()).rev() {
        if out[i] != 0xFF {
            out[i] += 1;
            for j in i + 1..out.len() {
                out[j] = 0;
            }
            return out;
        }
    }
    vec![0u8; out.len()]
}