//! Minimal BER (ASN.1) reader/writer for LDAPv3 bind + search messages.
//!
//! The Phase 06 LDAP stub at [`super::ldap_server`] speaks a custom
//! plaintext `SEARCH <filter>\n` / `COUNT <n>\n` framed-line protocol so
//! per-language harnesses can drive it without linking a real LDAP
//! client.  The deferred work for that phase tracks "tier (b)" — a
//! real LDAPv3 ASN.1 BER wire round-trip so a harness using
//! `javax.naming.directory.InitialDirContext` (or any other stock LDAP
//! client) can talk to the stub directly.
//!
//! This module is the unblocking primitive: a zero-dependency BER
//! reader+writer that covers exactly the tags LDAPv3 bind +
//! search-request +  search-result-entry + search-result-done messages
//! need.  It deliberately rejects everything else so a malformed
//! payload cannot exfiltrate state through the parser; rejection falls
//! through to `None` and the caller short-circuits to the plaintext
//! fallback path.
//!
//! # Scope
//!
//! Universal tags: `INTEGER` (0x02), `OCTET STRING` (0x04),
//! `ENUMERATED` (0x0A), `SEQUENCE` (0x30).
//!
//! Application tags (LDAP RFC 4511 §4.1):
//! `BindRequest` (0x60), `BindResponse` (0x61), `SearchRequest` (0x63),
//! `SearchResultEntry` (0x64), `SearchResultDone` (0x65).
//!
//! Context-specific tags inside `Filter` (RFC 4511 §4.5.1):
//! and [0], or [1], not [2], equalityMatch [3], substrings [4],
//! greaterOrEqual [5], lessOrEqual [6], present [7], approxMatch [8].
//! Plus simple-auth [0] inside `AuthenticationChoice`.
//!
//! Length encoding: short-form (single byte 0x00-0x7F) and long-form
//! (0x81-0x84 length-of-length, value up to 32 bits).  Indefinite
//! length (0x80) is rejected — LDAP DER never uses it.
//!
//! Integer encoding: two's-complement, big-endian, minimum-byte form
//! (LDAP integers are non-negative `MessageID` / version / result-code
//! values, but the decoder accepts the full two's-complement range so
//! a hand-rolled client that emits leading zero bytes still parses).
//!
//! # Filter rendering
//!
//! The decoded `SearchRequest` filter is re-rendered into the
//! RFC 4515 string syntax (`(uid=alice)`, `(|(uid=alice)(uid=*))`) so
//! the existing [`super::ldap_server::LdapStub::evaluate`] subset
//! matcher consumes it without a parallel evaluator.  Only the four
//! filter shapes the matcher already covers are rendered; anything
//! richer (`>=`, `<=`, `~=`, `not`) collapses to `*` so an exotic
//! adversarial payload over-matches rather than zero-matches.

#![cfg(feature = "dynamic")]

/// LDAPv3 BER tag bytes the stub recognises.
pub mod tags {
    /// Universal primitive integer (RFC 4511 §5).
    pub const INTEGER: u8 = 0x02;
    /// Universal primitive octet string.
    pub const OCTET_STRING: u8 = 0x04;
    /// Universal primitive enumerated.
    pub const ENUMERATED: u8 = 0x0A;
    /// Universal constructed sequence.
    pub const SEQUENCE: u8 = 0x30;

    /// `BindRequest` `[APPLICATION 0]` constructed (RFC 4511 §4.2).
    pub const BIND_REQUEST: u8 = 0x60;
    /// `BindResponse` `[APPLICATION 1]` constructed.
    pub const BIND_RESPONSE: u8 = 0x61;
    /// `SearchRequest` `[APPLICATION 3]` constructed.
    pub const SEARCH_REQUEST: u8 = 0x63;
    /// `SearchResultEntry` `[APPLICATION 4]` constructed.
    pub const SEARCH_RESULT_ENTRY: u8 = 0x64;
    /// `SearchResultDone` `[APPLICATION 5]` constructed.
    pub const SEARCH_RESULT_DONE: u8 = 0x65;

    /// `simple` `[0]` primitive OCTET STRING inside
    /// `AuthenticationChoice`.
    pub const AUTH_SIMPLE: u8 = 0x80;

    /// Filter `and` `[0]` constructed SET.
    pub const FILTER_AND: u8 = 0xA0;
    /// Filter `or` `[1]` constructed SET.
    pub const FILTER_OR: u8 = 0xA1;
    /// Filter `not` `[2]` constructed wrapper.
    pub const FILTER_NOT: u8 = 0xA2;
    /// Filter `equalityMatch` `[3]` constructed
    /// `AttributeValueAssertion`.
    pub const FILTER_EQUALITY: u8 = 0xA3;
    /// Filter `substrings` `[4]` constructed.
    pub const FILTER_SUBSTRINGS: u8 = 0xA4;
    /// Filter `present` `[7]` primitive `AttributeDescription`.
    pub const FILTER_PRESENT: u8 = 0x87;

    /// Substring `initial` `[0]` primitive.
    pub const SUBSTR_INITIAL: u8 = 0x80;
    /// Substring `any` `[1]` primitive.
    pub const SUBSTR_ANY: u8 = 0x81;
    /// Substring `final` `[2]` primitive.
    pub const SUBSTR_FINAL: u8 = 0x82;
}

/// Decoded TLV view.  `body` is borrowed from the source buffer; the
/// caller never has to allocate during parsing.
#[derive(Debug, Clone, Copy)]
pub struct Tlv<'a> {
    /// Raw tag byte.  Match against [`tags`] constants.
    pub tag: u8,
    /// The value-octets slice (length-prefix already stripped).
    pub body: &'a [u8],
    /// Offset into the source buffer immediately after this TLV.
    pub end: usize,
}

/// Read a single TLV starting at `offset` in `buf`.  Returns `None`
/// when the buffer is too short, the length is indefinite (0x80), or
/// the long-form length-of-length exceeds 4 bytes (>4 GiB messages are
/// out of scope for the in-process stub).
pub fn read_tlv(buf: &[u8], offset: usize) -> Option<Tlv<'_>> {
    if offset >= buf.len() {
        return None;
    }
    let tag = buf[offset];
    let first_len = *buf.get(offset + 1)?;
    let (length, length_consumed) = if first_len & 0x80 == 0 {
        (first_len as usize, 1usize)
    } else {
        let length_of_length = (first_len & 0x7F) as usize;
        if length_of_length == 0 || length_of_length > 4 {
            // 0x80 is indefinite length; >4 bytes is too long for the
            // in-process stub.
            return None;
        }
        let len_start = offset + 2;
        let len_end = len_start + length_of_length;
        if len_end > buf.len() {
            return None;
        }
        let mut acc: usize = 0;
        for &b in &buf[len_start..len_end] {
            acc = (acc << 8) | (b as usize);
        }
        (acc, 1 + length_of_length)
    };
    let body_start = offset + 1 + length_consumed;
    let body_end = body_start.checked_add(length)?;
    if body_end > buf.len() {
        return None;
    }
    Some(Tlv {
        tag,
        body: &buf[body_start..body_end],
        end: body_end,
    })
}

/// Decode an `INTEGER` value-octets slice into an `i64`.  Rejects
/// inputs longer than 8 bytes — LDAP versions, message IDs, and result
/// codes all fit in 32 bits.
pub fn decode_integer(body: &[u8]) -> Option<i64> {
    if body.is_empty() || body.len() > 8 {
        return None;
    }
    let sign_extend: i64 = if body[0] & 0x80 != 0 { -1 } else { 0 };
    let mut acc: i64 = sign_extend;
    for &b in body {
        acc = (acc << 8) | (b as i64 & 0xFF);
    }
    Some(acc)
}

/// Append an `INTEGER` TLV to `out`.  Minimum-byte two's-complement
/// encoding.
pub fn write_integer(out: &mut Vec<u8>, n: i64) {
    let mut bytes = n.to_be_bytes().to_vec();
    while bytes.len() > 1
        && ((bytes[0] == 0x00 && bytes[1] & 0x80 == 0)
            || (bytes[0] == 0xFF && bytes[1] & 0x80 != 0))
    {
        bytes.remove(0);
    }
    write_tlv(out, tags::INTEGER, &bytes);
}

/// Append an `ENUMERATED` TLV to `out`.  Single-byte encoding (LDAP
/// scope / result-code values all fit in one byte).
pub fn write_enumerated(out: &mut Vec<u8>, n: u8) {
    write_tlv(out, tags::ENUMERATED, &[n]);
}

/// Append an `OCTET STRING` TLV to `out`.
pub fn write_octet_string(out: &mut Vec<u8>, s: &[u8]) {
    write_tlv(out, tags::OCTET_STRING, s);
}

/// Append a TLV with arbitrary tag + body to `out`.  Encodes length in
/// short-form when `body.len() < 128`; long-form otherwise.
pub fn write_tlv(out: &mut Vec<u8>, tag: u8, body: &[u8]) {
    out.push(tag);
    write_length(out, body.len());
    out.extend_from_slice(body);
}

fn write_length(out: &mut Vec<u8>, len: usize) {
    if len < 0x80 {
        out.push(len as u8);
        return;
    }
    let mut bytes: Vec<u8> = Vec::with_capacity(5);
    let mut n = len;
    while n != 0 {
        bytes.push((n & 0xFF) as u8);
        n >>= 8;
    }
    bytes.reverse();
    out.push(0x80 | bytes.len() as u8);
    out.extend_from_slice(&bytes);
}

/// Wrap `body` as a `SEQUENCE` TLV.  Convenience helper for assembling
/// LDAP messages.
pub fn wrap_sequence(body: &[u8]) -> Vec<u8> {
    let mut out = Vec::with_capacity(body.len() + 4);
    write_tlv(&mut out, tags::SEQUENCE, body);
    out
}

/// Decoded LDAPMessage header — protocol operation TLV's tag plus
/// body, ready to dispatch on.
#[derive(Debug, Clone, Copy)]
pub struct LdapMessageHeader<'a> {
    /// The LDAP message ID the client picked.  Echoed verbatim on the
    /// matching response.
    pub message_id: i64,
    /// The protocol op application tag (e.g. [`tags::BIND_REQUEST`]).
    pub op_tag: u8,
    /// The protocol op value-octets.  Pass into [`decode_bind_request`]
    /// / [`decode_search_request`] depending on `op_tag`.
    pub op_body: &'a [u8],
}

/// Decode an LDAP message header.  The outer `SEQUENCE` must already
/// be the top-level TLV in `buf`.  Returns `None` for malformed input,
/// missing fields, or unrecognised protocol-op classes.
pub fn decode_ldap_message(buf: &[u8]) -> Option<LdapMessageHeader<'_>> {
    let outer = read_tlv(buf, 0)?;
    if outer.tag != tags::SEQUENCE {
        return None;
    }
    let msg_id_tlv = read_tlv(outer.body, 0)?;
    if msg_id_tlv.tag != tags::INTEGER {
        return None;
    }
    let message_id = decode_integer(msg_id_tlv.body)?;
    let op_tlv = read_tlv(outer.body, msg_id_tlv.end)?;
    Some(LdapMessageHeader {
        message_id,
        op_tag: op_tlv.tag,
        op_body: op_tlv.body,
    })
}

/// Decoded `BindRequest` (RFC 4511 §4.2).
#[derive(Debug, Clone)]
pub struct BindRequest<'a> {
    /// Protocol version (always 3 for LDAPv3).
    pub version: i64,
    /// The bind DN ("" for anonymous bind).
    pub name: &'a [u8],
    /// `simple` authentication credential bytes, if present.  Other
    /// `AuthenticationChoice` variants (SASL) collapse to `None`.
    pub simple_password: Option<&'a [u8]>,
}

/// Decode the value-octets of a `BindRequest`.
pub fn decode_bind_request(body: &[u8]) -> Option<BindRequest<'_>> {
    let version_tlv = read_tlv(body, 0)?;
    if version_tlv.tag != tags::INTEGER {
        return None;
    }
    let version = decode_integer(version_tlv.body)?;
    let name_tlv = read_tlv(body, version_tlv.end)?;
    if name_tlv.tag != tags::OCTET_STRING {
        return None;
    }
    let auth_tlv = read_tlv(body, name_tlv.end)?;
    let simple_password = if auth_tlv.tag == tags::AUTH_SIMPLE {
        Some(auth_tlv.body)
    } else {
        None
    };
    Some(BindRequest {
        version,
        name: name_tlv.body,
        simple_password,
    })
}

/// Decoded `SearchRequest` (RFC 4511 §4.5.1).
#[derive(Debug, Clone)]
pub struct SearchRequest<'a> {
    /// Base object DN the search is anchored at.
    pub base_object: &'a [u8],
    /// Scope enum value (0=baseObject, 1=singleLevel, 2=wholeSubtree).
    pub scope: u8,
    /// Filter rendered into the RFC 4515 string subset the existing
    /// [`super::ldap_server::LdapStub::evaluate`] matcher consumes.
    pub filter: String,
}

/// Decode the value-octets of a `SearchRequest`.
pub fn decode_search_request(body: &[u8]) -> Option<SearchRequest<'_>> {
    let base_tlv = read_tlv(body, 0)?;
    if base_tlv.tag != tags::OCTET_STRING {
        return None;
    }
    let scope_tlv = read_tlv(body, base_tlv.end)?;
    if scope_tlv.tag != tags::ENUMERATED || scope_tlv.body.len() != 1 {
        return None;
    }
    let scope = scope_tlv.body[0];
    let deref_tlv = read_tlv(body, scope_tlv.end)?;
    let size_tlv = read_tlv(body, deref_tlv.end)?;
    let time_tlv = read_tlv(body, size_tlv.end)?;
    let typesonly_tlv = read_tlv(body, time_tlv.end)?;
    let filter_tlv = read_tlv(body, typesonly_tlv.end)?;
    let filter = render_filter(filter_tlv.tag, filter_tlv.body);
    Some(SearchRequest {
        base_object: base_tlv.body,
        scope,
        filter,
    })
}

/// Render a decoded filter TLV into the RFC 4515 subset
/// [`super::ldap_server::LdapStub::evaluate`] accepts.  Unrecognised
/// shapes collapse to bare `*` so adversarial payloads over-match.
pub fn render_filter(tag: u8, body: &[u8]) -> String {
    match tag {
        tags::FILTER_AND => render_set("&", body),
        tags::FILTER_OR => render_set("|", body),
        tags::FILTER_EQUALITY => render_equality(body),
        tags::FILTER_PRESENT => {
            let attr = String::from_utf8_lossy(body);
            format!("({attr}=*)")
        }
        tags::FILTER_SUBSTRINGS => render_substrings(body),
        _ => "*".to_string(),
    }
}

fn render_set(operator: &str, body: &[u8]) -> String {
    let mut out = String::from("(");
    out.push_str(operator);
    let mut cur = 0usize;
    while cur < body.len() {
        let Some(child) = read_tlv(body, cur) else {
            // Truncated SET — break out and let the outer caller fall
            // through to over-match.
            out.push('*');
            break;
        };
        out.push_str(&render_filter(child.tag, child.body));
        cur = child.end;
    }
    out.push(')');
    out
}

fn render_equality(body: &[u8]) -> String {
    let Some(attr_tlv) = read_tlv(body, 0) else {
        return "*".to_string();
    };
    if attr_tlv.tag != tags::OCTET_STRING {
        return "*".to_string();
    }
    let Some(value_tlv) = read_tlv(body, attr_tlv.end) else {
        return "*".to_string();
    };
    if value_tlv.tag != tags::OCTET_STRING {
        return "*".to_string();
    }
    let attr = String::from_utf8_lossy(attr_tlv.body);
    let value = String::from_utf8_lossy(value_tlv.body);
    format!("({attr}={value})")
}

fn render_substrings(body: &[u8]) -> String {
    let Some(attr_tlv) = read_tlv(body, 0) else {
        return "*".to_string();
    };
    if attr_tlv.tag != tags::OCTET_STRING {
        return "*".to_string();
    }
    let Some(seq_tlv) = read_tlv(body, attr_tlv.end) else {
        return "*".to_string();
    };
    if seq_tlv.tag != tags::SEQUENCE {
        return "*".to_string();
    }
    let attr = String::from_utf8_lossy(attr_tlv.body);
    let mut initial = String::new();
    let mut any_parts: Vec<String> = Vec::new();
    let mut tail = String::new();
    let mut cur = 0usize;
    while cur < seq_tlv.body.len() {
        let Some(piece) = read_tlv(seq_tlv.body, cur) else {
            break;
        };
        let text = String::from_utf8_lossy(piece.body).into_owned();
        match piece.tag {
            tags::SUBSTR_INITIAL => initial = text,
            tags::SUBSTR_ANY => any_parts.push(text),
            tags::SUBSTR_FINAL => tail = text,
            _ => {}
        }
        cur = piece.end;
    }
    let mut joined = initial;
    if !any_parts.is_empty() {
        joined.push('*');
        joined.push_str(&any_parts.join("*"));
    }
    joined.push('*');
    joined.push_str(&tail);
    format!("({attr}={joined})")
}

/// Encode a complete `LDAPMessage` carrying `op_tag` + `op_body` as
/// the protocol op.  Wraps everything in the outer `SEQUENCE`.
pub fn encode_ldap_message(message_id: i64, op_tag: u8, op_body: &[u8]) -> Vec<u8> {
    let mut inner = Vec::with_capacity(op_body.len() + 8);
    write_integer(&mut inner, message_id);
    write_tlv(&mut inner, op_tag, op_body);
    wrap_sequence(&inner)
}

/// LDAP result codes the stub uses (RFC 4511 §4.1.9).
pub mod result_codes {
    /// Operation completed successfully.
    pub const SUCCESS: u8 = 0;
    /// Operation rejected — used here for unrecognised request shapes.
    pub const UNWILLING_TO_PERFORM: u8 = 53;
}

/// Encode a minimal `BindResponse` (success, empty matchedDN, empty
/// diagnosticMessage).
pub fn encode_bind_response(message_id: i64, result_code: u8) -> Vec<u8> {
    let mut body = Vec::with_capacity(8);
    write_enumerated(&mut body, result_code);
    write_octet_string(&mut body, b"");
    write_octet_string(&mut body, b"");
    encode_ldap_message(message_id, tags::BIND_RESPONSE, &body)
}

/// Encode a `SearchResultEntry` carrying `dn` with no attributes.  The
/// Phase 06 LDAP stub's directory model only ever publishes the DN —
/// callers that need attributes can extend this once a fixture surfaces
/// the need.
pub fn encode_search_result_entry(message_id: i64, dn: &[u8]) -> Vec<u8> {
    let mut body = Vec::with_capacity(dn.len() + 8);
    write_octet_string(&mut body, dn);
    // PartialAttributeList ::= SEQUENCE OF partial Attribute — empty.
    write_tlv(&mut body, tags::SEQUENCE, &[]);
    encode_ldap_message(message_id, tags::SEARCH_RESULT_ENTRY, &body)
}

/// Encode a `SearchResultDone` (RFC 4511 §4.5.2).
pub fn encode_search_result_done(message_id: i64, result_code: u8) -> Vec<u8> {
    let mut body = Vec::with_capacity(8);
    write_enumerated(&mut body, result_code);
    write_octet_string(&mut body, b"");
    write_octet_string(&mut body, b"");
    encode_ldap_message(message_id, tags::SEARCH_RESULT_DONE, &body)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn read_tlv_short_form_length() {
        // tag=0x04, len=0x03, body="abc"
        let buf = b"\x04\x03abc";
        let tlv = read_tlv(buf, 0).expect("tlv");
        assert_eq!(tlv.tag, 0x04);
        assert_eq!(tlv.body, b"abc");
        assert_eq!(tlv.end, 5);
    }

    #[test]
    fn read_tlv_long_form_length() {
        // 200-byte body → length 0x81 0xC8
        let mut buf = vec![0x04, 0x81, 200];
        buf.extend(std::iter::repeat_n(b'a', 200));
        let tlv = read_tlv(&buf, 0).expect("tlv");
        assert_eq!(tlv.body.len(), 200);
    }

    #[test]
    fn read_tlv_rejects_indefinite_length() {
        let buf = [0x30u8, 0x80, 0x00, 0x00];
        assert!(read_tlv(&buf, 0).is_none());
    }

    #[test]
    fn read_tlv_rejects_truncated_body() {
        let buf = [0x04u8, 0x05, b'a', b'b'];
        assert!(read_tlv(&buf, 0).is_none());
    }

    #[test]
    fn decode_integer_handles_single_byte() {
        assert_eq!(decode_integer(&[3]), Some(3));
        assert_eq!(decode_integer(&[0]), Some(0));
    }

    #[test]
    fn decode_integer_handles_negative_via_sign_extension() {
        // 0xFF is -1 in two's complement
        assert_eq!(decode_integer(&[0xFF]), Some(-1));
    }

    #[test]
    fn decode_integer_rejects_empty_and_oversized() {
        assert!(decode_integer(&[]).is_none());
        assert!(decode_integer(&[0u8; 9]).is_none());
    }

    #[test]
    fn write_integer_minimum_byte_form() {
        let mut out = Vec::new();
        write_integer(&mut out, 0);
        assert_eq!(out, vec![0x02, 0x01, 0x00]);

        let mut out = Vec::new();
        write_integer(&mut out, 127);
        assert_eq!(out, vec![0x02, 0x01, 0x7F]);

        let mut out = Vec::new();
        write_integer(&mut out, 128);
        // Need leading zero byte because high bit of 0x80 would make
        // the value negative under two's-complement.
        assert_eq!(out, vec![0x02, 0x02, 0x00, 0x80]);
    }

    #[test]
    fn integer_round_trips() {
        for n in [0i64, 1, 3, 127, 128, 255, 256, 65535, 65536, -1, -128, -129] {
            let mut buf = Vec::new();
            write_integer(&mut buf, n);
            let tlv = read_tlv(&buf, 0).expect("tlv");
            assert_eq!(tlv.tag, tags::INTEGER);
            assert_eq!(decode_integer(tlv.body), Some(n));
        }
    }

    #[test]
    fn long_form_length_round_trip() {
        let mut buf = Vec::new();
        let body = vec![0xABu8; 1024];
        write_tlv(&mut buf, tags::OCTET_STRING, &body);
        let tlv = read_tlv(&buf, 0).expect("tlv");
        assert_eq!(tlv.body, &body[..]);
    }

    #[test]
    fn bind_request_round_trip() {
        // version=3, name="cn=admin", simple_password="secret"
        let mut body = Vec::new();
        write_integer(&mut body, 3);
        write_octet_string(&mut body, b"cn=admin");
        write_tlv(&mut body, tags::AUTH_SIMPLE, b"secret");
        let msg = encode_ldap_message(/*id=*/ 7, tags::BIND_REQUEST, &body);
        let hdr = decode_ldap_message(&msg).expect("header");
        assert_eq!(hdr.message_id, 7);
        assert_eq!(hdr.op_tag, tags::BIND_REQUEST);
        let req = decode_bind_request(hdr.op_body).expect("bind body");
        assert_eq!(req.version, 3);
        assert_eq!(req.name, b"cn=admin");
        assert_eq!(req.simple_password, Some(b"secret".as_slice()));
    }

    #[test]
    fn bind_response_round_trip_decodes_via_header() {
        let msg = encode_bind_response(/*id=*/ 7, result_codes::SUCCESS);
        let hdr = decode_ldap_message(&msg).expect("header");
        assert_eq!(hdr.message_id, 7);
        assert_eq!(hdr.op_tag, tags::BIND_RESPONSE);
        // BindResponse body: ENUMERATED + 2x OCTET STRING
        let tlv = read_tlv(hdr.op_body, 0).expect("rc");
        assert_eq!(tlv.tag, tags::ENUMERATED);
        assert_eq!(tlv.body, &[0]);
    }

    fn build_search_msg(message_id: i64, filter_tag: u8, filter_body: &[u8]) -> Vec<u8> {
        let mut body = Vec::new();
        write_octet_string(&mut body, b"ou=people,dc=nyx,dc=test");
        write_enumerated(&mut body, 2); // wholeSubtree
        write_enumerated(&mut body, 0); // derefAliases neverDerefAliases
        write_integer(&mut body, 0); // sizeLimit
        write_integer(&mut body, 0); // timeLimit
        // typesOnly BOOLEAN false; encoded as 0x01 0x01 0x00
        write_tlv(&mut body, 0x01, &[0x00]);
        write_tlv(&mut body, filter_tag, filter_body);
        // attributes: empty SEQUENCE
        write_tlv(&mut body, tags::SEQUENCE, &[]);
        encode_ldap_message(message_id, tags::SEARCH_REQUEST, &body)
    }

    fn equality_body(attr: &[u8], value: &[u8]) -> Vec<u8> {
        let mut body = Vec::new();
        write_octet_string(&mut body, attr);
        write_octet_string(&mut body, value);
        body
    }

    #[test]
    fn search_request_equality_filter_renders_to_rfc4515() {
        let eq = equality_body(b"uid", b"alice");
        let msg = build_search_msg(11, tags::FILTER_EQUALITY, &eq);
        let hdr = decode_ldap_message(&msg).expect("header");
        let req = decode_search_request(hdr.op_body).expect("search");
        assert_eq!(req.base_object, b"ou=people,dc=nyx,dc=test");
        assert_eq!(req.scope, 2);
        assert_eq!(req.filter, "(uid=alice)");
    }

    #[test]
    fn search_request_present_filter_renders_with_wildcard() {
        let msg = build_search_msg(11, tags::FILTER_PRESENT, b"uid");
        let hdr = decode_ldap_message(&msg).expect("header");
        let req = decode_search_request(hdr.op_body).expect("search");
        assert_eq!(req.filter, "(uid=*)");
    }

    #[test]
    fn search_request_or_filter_nests_equalities() {
        let mut set_body = Vec::new();
        let eq_a = equality_body(b"uid", b"alice");
        let eq_b = equality_body(b"uid", b"bob");
        write_tlv(&mut set_body, tags::FILTER_EQUALITY, &eq_a);
        write_tlv(&mut set_body, tags::FILTER_EQUALITY, &eq_b);
        let msg = build_search_msg(11, tags::FILTER_OR, &set_body);
        let hdr = decode_ldap_message(&msg).expect("header");
        let req = decode_search_request(hdr.op_body).expect("search");
        assert_eq!(req.filter, "(|(uid=alice)(uid=bob))");
    }

    #[test]
    fn search_request_and_filter_nests_equalities() {
        let mut set_body = Vec::new();
        let eq_a = equality_body(b"uid", b"alice");
        let eq_b = equality_body(b"cn", b"admin");
        write_tlv(&mut set_body, tags::FILTER_EQUALITY, &eq_a);
        write_tlv(&mut set_body, tags::FILTER_EQUALITY, &eq_b);
        let msg = build_search_msg(11, tags::FILTER_AND, &set_body);
        let hdr = decode_ldap_message(&msg).expect("header");
        let req = decode_search_request(hdr.op_body).expect("search");
        assert_eq!(req.filter, "(&(uid=alice)(cn=admin))");
    }

    #[test]
    fn search_request_substrings_filter_renders_prefix_star_suffix() {
        let mut sub_body = Vec::new();
        write_octet_string(&mut sub_body, b"uid");
        let mut inner = Vec::new();
        write_tlv(&mut inner, tags::SUBSTR_INITIAL, b"al");
        write_tlv(&mut inner, tags::SUBSTR_FINAL, b"ce");
        write_tlv(&mut sub_body, tags::SEQUENCE, &inner);
        let msg = build_search_msg(11, tags::FILTER_SUBSTRINGS, &sub_body);
        let hdr = decode_ldap_message(&msg).expect("header");
        let req = decode_search_request(hdr.op_body).expect("search");
        assert_eq!(req.filter, "(uid=al*ce)");
    }

    #[test]
    fn search_request_unknown_filter_collapses_to_wildcard() {
        // 0xA5 = greaterOrEqual — not rendered, falls through to "*".
        let body = equality_body(b"uid", b"alice");
        let msg = build_search_msg(11, 0xA5, &body);
        let hdr = decode_ldap_message(&msg).expect("header");
        let req = decode_search_request(hdr.op_body).expect("search");
        assert_eq!(req.filter, "*");
    }

    #[test]
    fn encode_search_result_entry_round_trip() {
        let msg = encode_search_result_entry(/*id=*/ 11, b"uid=alice,ou=people");
        let hdr = decode_ldap_message(&msg).expect("header");
        assert_eq!(hdr.message_id, 11);
        assert_eq!(hdr.op_tag, tags::SEARCH_RESULT_ENTRY);
        let dn_tlv = read_tlv(hdr.op_body, 0).expect("dn");
        assert_eq!(dn_tlv.tag, tags::OCTET_STRING);
        assert_eq!(dn_tlv.body, b"uid=alice,ou=people");
    }

    #[test]
    fn encode_search_result_done_round_trip() {
        let msg = encode_search_result_done(/*id=*/ 11, result_codes::SUCCESS);
        let hdr = decode_ldap_message(&msg).expect("header");
        assert_eq!(hdr.op_tag, tags::SEARCH_RESULT_DONE);
        let rc = read_tlv(hdr.op_body, 0).expect("rc");
        assert_eq!(rc.tag, tags::ENUMERATED);
        assert_eq!(rc.body, &[0]);
    }
}