package aes

import (
	"bytes"
	"errors"
	"io"
	"testing"

	"github.com/dromara/dongle/crypto/cipher"
	"github.com/dromara/dongle/internal/mock"
	"github.com/stretchr/testify/assert"
)

// Test data for error testing
var (
	key16Error    = []byte("1234567890123456") // AES-128 key
	iv16Error     = []byte("1234567890123456") // 16-byte IV
	testDataError = []byte("hello world")
)

// TestKeySizeError tests the KeySizeError type and its Error() method
func TestKeySizeError(t *testing.T) {
	t.Run("valid key sizes", func(t *testing.T) {
		// Test that valid key sizes don't trigger KeySizeError in actual usage
		validKeys := [][]byte{
			[]byte("1234567890123456"),                 // 16 bytes
			[]byte("123456789012345678901234"),         // 24 bytes
			[]byte("12345678901234567890123456789012"), // 32 bytes
		}
		for _, key := range validKeys {
			c := cipher.NewAesCipher(cipher.CBC)
			c.SetKey(key)
			c.SetIV(iv16Error)
			c.SetPadding(cipher.PKCS7)

			encrypter := NewStdEncrypter(c)
			assert.Nil(t, encrypter.Error) // Should not have KeySizeError for valid keys
		}
	})

	t.Run("invalid key sizes", func(t *testing.T) {
		invalidSizes := []int{0, 1, 8, 15, 17, 23, 25, 31, 33, 64, 128}
		for _, size := range invalidSizes {
			err := KeySizeError(size)
			expected := "crypto/aes: invalid key size 8, must be 16, 24, or 32 bytes"
			if size == 0 {
				expected = "crypto/aes: invalid key size 0, must be 16, 24, or 32 bytes"
			} else if size == 1 {
				expected = "crypto/aes: invalid key size 1, must be 16, 24, or 32 bytes"
			} else if size == 8 {
				expected = "crypto/aes: invalid key size 8, must be 16, 24, or 32 bytes"
			} else if size == 15 {
				expected = "crypto/aes: invalid key size 15, must be 16, 24, or 32 bytes"
			} else if size == 17 {
				expected = "crypto/aes: invalid key size 17, must be 16, 24, or 32 bytes"
			} else if size == 23 {
				expected = "crypto/aes: invalid key size 23, must be 16, 24, or 32 bytes"
			} else if size == 25 {
				expected = "crypto/aes: invalid key size 25, must be 16, 24, or 32 bytes"
			} else if size == 31 {
				expected = "crypto/aes: invalid key size 31, must be 16, 24, or 32 bytes"
			} else if size == 33 {
				expected = "crypto/aes: invalid key size 33, must be 16, 24, or 32 bytes"
			} else if size == 64 {
				expected = "crypto/aes: invalid key size 64, must be 16, 24, or 32 bytes"
			} else if size == 128 {
				expected = "crypto/aes: invalid key size 128, must be 16, 24, or 32 bytes"
			}
			assert.Equal(t, expected, err.Error())
		}
	})

	t.Run("negative key size", func(t *testing.T) {
		err := KeySizeError(-1)
		expected := "crypto/aes: invalid key size -1, must be 16, 24, or 32 bytes"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("large key size", func(t *testing.T) {
		err := KeySizeError(1000)
		expected := "crypto/aes: invalid key size 1000, must be 16, 24, or 32 bytes"
		assert.Equal(t, expected, err.Error())
	})
}

// TestEncryptError tests the EncryptError type and its Error() method
func TestEncryptError(t *testing.T) {
	t.Run("with nil error", func(t *testing.T) {
		err := EncryptError{Err: nil}
		expected := "crypto/aes: failed to encrypt data: <nil>"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with simple error", func(t *testing.T) {
		originalErr := errors.New("simple error")
		err := EncryptError{Err: originalErr}
		expected := "crypto/aes: failed to encrypt data: simple error"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with complex error message", func(t *testing.T) {
		originalErr := errors.New("encryption failed: invalid key format")
		err := EncryptError{Err: originalErr}
		expected := "crypto/aes: failed to encrypt data: encryption failed: invalid key format"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with wrapped error", func(t *testing.T) {
		originalErr := errors.New("underlying error")
		wrappedErr := errors.New("wrapped: " + originalErr.Error())
		err := EncryptError{Err: wrappedErr}
		expected := "crypto/aes: failed to encrypt data: wrapped: underlying error"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with empty error message", func(t *testing.T) {
		originalErr := errors.New("")
		err := EncryptError{Err: originalErr}
		expected := "crypto/aes: failed to encrypt data: "
		assert.Equal(t, expected, err.Error())
	})
}

// TestDecryptError tests the DecryptError type and its Error() method
func TestDecryptError(t *testing.T) {
	t.Run("with nil error", func(t *testing.T) {
		err := DecryptError{Err: nil}
		expected := "crypto/aes: failed to decrypt data: <nil>"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with simple error", func(t *testing.T) {
		originalErr := errors.New("decryption failed")
		err := DecryptError{Err: originalErr}
		expected := "crypto/aes: failed to decrypt data: decryption failed"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with complex error message", func(t *testing.T) {
		originalErr := errors.New("decryption failed: invalid ciphertext format")
		err := DecryptError{Err: originalErr}
		expected := "crypto/aes: failed to decrypt data: decryption failed: invalid ciphertext format"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with authentication error", func(t *testing.T) {
		originalErr := errors.New("authentication failed")
		err := DecryptError{Err: originalErr}
		expected := "crypto/aes: failed to decrypt data: authentication failed"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with empty error message", func(t *testing.T) {
		originalErr := errors.New("")
		err := DecryptError{Err: originalErr}
		expected := "crypto/aes: failed to decrypt data: "
		assert.Equal(t, expected, err.Error())
	})
}

// TestReadError tests the ReadError type and its Error() method
func TestReadError(t *testing.T) {
	t.Run("with nil error", func(t *testing.T) {
		err := ReadError{Err: nil}
		expected := "crypto/aes: failed to read encrypted data: <nil>"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with simple error", func(t *testing.T) {
		originalErr := errors.New("read failed")
		err := ReadError{Err: originalErr}
		expected := "crypto/aes: failed to read encrypted data: read failed"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with complex error message", func(t *testing.T) {
		originalErr := errors.New("read failed: connection timeout")
		err := ReadError{Err: originalErr}
		expected := "crypto/aes: failed to read encrypted data: read failed: connection timeout"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with EOF error", func(t *testing.T) {
		originalErr := errors.New("unexpected EOF")
		err := ReadError{Err: originalErr}
		expected := "crypto/aes: failed to read encrypted data: unexpected EOF"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("with empty error message", func(t *testing.T) {
		originalErr := errors.New("")
		err := ReadError{Err: originalErr}
		expected := "crypto/aes: failed to read encrypted data: "
		assert.Equal(t, expected, err.Error())
	})
}

// TestBufferError tests the BufferError type and its Error() method
func TestBufferError(t *testing.T) {
	t.Run("small buffer", func(t *testing.T) {
		err := BufferError{bufferSize: 5, dataSize: 10}
		expected := "crypto/aes: : buffer size 5 is too small for data size 10"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("zero buffer size", func(t *testing.T) {
		err := BufferError{bufferSize: 0, dataSize: 10}
		expected := "crypto/aes: : buffer size 0 is too small for data size 10"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("negative buffer size", func(t *testing.T) {
		err := BufferError{bufferSize: -1, dataSize: 10}
		expected := "crypto/aes: : buffer size -1 is too small for data size 10"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("zero data size", func(t *testing.T) {
		err := BufferError{bufferSize: 5, dataSize: 0}
		expected := "crypto/aes: : buffer size 5 is too small for data size 0"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("negative data size", func(t *testing.T) {
		err := BufferError{bufferSize: 5, dataSize: -1}
		expected := "crypto/aes: : buffer size 5 is too small for data size -1"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("large buffer size", func(t *testing.T) {
		err := BufferError{bufferSize: 1000, dataSize: 2000}
		expected := "crypto/aes: : buffer size 1000 is too small for data size 2000"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("equal sizes", func(t *testing.T) {
		err := BufferError{bufferSize: 10, dataSize: 10}
		expected := "crypto/aes: : buffer size 10 is too small for data size 10"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("both zero", func(t *testing.T) {
		err := BufferError{bufferSize: 0, dataSize: 0}
		expected := "crypto/aes: : buffer size 0 is too small for data size 0"
		assert.Equal(t, expected, err.Error())
	})

	t.Run("both negative", func(t *testing.T) {
		err := BufferError{bufferSize: -5, dataSize: -10}
		expected := "crypto/aes: : buffer size -5 is too small for data size -10"
		assert.Equal(t, expected, err.Error())
	})
}

// TestErrorIntegration tests error types in actual AES operations
func TestErrorIntegration(t *testing.T) {
	t.Run("KeySizeError in StdEncrypter", func(t *testing.T) {
		invalidKeys := [][]byte{
			nil,
			{},
			[]byte("short"),
			[]byte("17bytes_key123456"),
			make([]byte, 33),
		}

		for _, key := range invalidKeys {
			c := cipher.NewAesCipher(cipher.CBC)
			c.SetKey(key)
			c.SetIV(iv16Error)
			c.SetPadding(cipher.PKCS7)

			encrypter := NewStdEncrypter(c)
			assert.NotNil(t, encrypter)
			assert.NotNil(t, encrypter.Error)
			assert.IsType(t, KeySizeError(0), encrypter.Error)
		}
	})

	t.Run("KeySizeError in StdDecrypter", func(t *testing.T) {
		invalidKeys := [][]byte{
			nil,
			{},
			[]byte("short"),
		}

		for _, key := range invalidKeys {
			c := cipher.NewAesCipher(cipher.CBC)
			c.SetKey(key)

			decrypter := NewStdDecrypter(c)
			assert.NotNil(t, decrypter)
			assert.NotNil(t, decrypter.Error)
			assert.IsType(t, KeySizeError(0), decrypter.Error)
		}
	})

	t.Run("KeySizeError in StreamEncrypter", func(t *testing.T) {
		var buf bytes.Buffer
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey([]byte("invalid"))

		encrypter := NewStreamEncrypter(&buf, c)
		streamEncrypter := encrypter.(*StreamEncrypter)
		assert.NotNil(t, streamEncrypter.Error)
		assert.IsType(t, KeySizeError(0), streamEncrypter.Error)
	})

	t.Run("KeySizeError in StreamDecrypter", func(t *testing.T) {
		file := mock.NewFile([]byte("test"), "test.txt")
		defer file.Close()
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey([]byte("invalid"))

		decrypter := NewStreamDecrypter(file, c)
		streamDecrypter := decrypter.(*StreamDecrypter)
		assert.NotNil(t, streamDecrypter.Error)
		assert.IsType(t, KeySizeError(0), streamDecrypter.Error)
	})

	t.Run("EncryptError in StreamEncrypter Write", func(t *testing.T) {
		var buf bytes.Buffer
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		// Don't set IV to cause encryption error
		c.SetPadding(cipher.PKCS7)

		encrypter := NewStreamEncrypter(&buf, c)
		n, err := encrypter.Write(testDataError)
		// This should cause c.cipher.Encrypt to return an error
		if err != nil {
			assert.Equal(t, 0, n)
			assert.IsType(t, EncryptError{}, err)
		}
	})

	t.Run("ReadError in StreamDecrypter Read", func(t *testing.T) {
		mockReader := mock.NewErrorReadWriteCloser(errors.New("read error"))
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)

		decrypter := NewStreamDecrypter(mockReader, c)
		buf := make([]byte, 10)
		n, err := decrypter.Read(buf)
		assert.Equal(t, 0, n)
		assert.IsType(t, ReadError{}, err)
	})
}

// TestErrorTypeAssertions tests type assertions for error types
func TestErrorTypeAssertions(t *testing.T) {
	t.Run("KeySizeError type assertion", func(t *testing.T) {
		var err error = KeySizeError(8)
		var keySizeErr KeySizeError
		ok := errors.As(err, &keySizeErr)
		assert.True(t, ok)
		assert.Equal(t, KeySizeError(8), keySizeErr)
	})

	t.Run("EncryptError type assertion", func(t *testing.T) {
		originalErr := errors.New("test error")
		var err error = EncryptError{Err: originalErr}
		var encryptErr EncryptError
		ok := errors.As(err, &encryptErr)
		assert.True(t, ok)
		assert.Equal(t, originalErr, encryptErr.Err)
	})

	t.Run("DecryptError type assertion", func(t *testing.T) {
		originalErr := errors.New("test error")
		var err error = DecryptError{Err: originalErr}
		var decryptErr DecryptError
		ok := errors.As(err, &decryptErr)
		assert.True(t, ok)
		assert.Equal(t, originalErr, decryptErr.Err)
	})

	t.Run("ReadError type assertion", func(t *testing.T) {
		originalErr := errors.New("test error")
		var err error = ReadError{Err: originalErr}
		var readErr ReadError
		ok := errors.As(err, &readErr)
		assert.True(t, ok)
		assert.Equal(t, originalErr, readErr.Err)
	})

	t.Run("BufferError type assertion", func(t *testing.T) {
		var err error = BufferError{bufferSize: 5, dataSize: 10}
		var bufferErr BufferError
		ok := errors.As(err, &bufferErr)
		assert.True(t, ok)
		assert.Equal(t, 5, bufferErr.bufferSize)
		assert.Equal(t, 10, bufferErr.dataSize)
	})
}

func TestStdEncrypter_Encrypt_ErrorPaths(t *testing.T) {
	t.Run("encrypt with existing error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey([]byte("short")) // Invalid key size
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		encrypter := NewStdEncrypter(c)
		assert.NotNil(t, encrypter.Error)

		// Try to encrypt with existing error - it will still try to encrypt
		result, err := encrypter.Encrypt(testDataError)
		// The encryption will fail because the key is invalid
		assert.Empty(t, result)
		assert.NotNil(t, err)
		assert.IsType(t, KeySizeError(5), err)
	})

	t.Run("encrypt with invalid key causing aes.NewCipher error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		encrypter := NewStdEncrypter(c)
		// Manually set an invalid key to cause aes.NewCipher to fail
		encrypter.cipher.Key = []byte("invalid")

		result, err := encrypter.Encrypt(testDataError)
		// The encryption will fail because the key is invalid
		assert.Empty(t, result)
		assert.NotNil(t, err)
		assert.IsType(t, EncryptError{}, err)
	})

	t.Run("encrypt empty data", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		encrypter := NewStdEncrypter(c)
		result, err := encrypter.Encrypt([]byte{})
		assert.Empty(t, result)
		assert.Nil(t, err)
	})

	t.Run("encrypt with aes.NewCipher error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		encrypter := NewStdEncrypter(c)
		// Set a key that will cause aes.NewCipher to fail
		// This is difficult to achieve with the current implementation,
		// but we can test the error path by mocking
		encrypter.cipher.Key = nil // This should cause aes.NewCipher to fail

		result, err := encrypter.Encrypt(testDataError)
		assert.Empty(t, result)
		assert.NotNil(t, err)
		assert.IsType(t, EncryptError{}, err)
	})
}

func TestStdDecrypter_Decrypt_ErrorPaths(t *testing.T) {
	t.Run("decrypt with existing error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey([]byte("short")) // Invalid key size
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		decrypter := NewStdDecrypter(c)
		assert.NotNil(t, decrypter.Error)

		// Try to decrypt with existing error - it will still try to decrypt
		result, err := decrypter.Decrypt(testDataError)
		// The decryption will fail because the data is not properly encrypted
		// and the cipher interface will return an error
		assert.Empty(t, result)
		assert.NotNil(t, err)
	})

	t.Run("decrypt with invalid key causing aes.NewCipher error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		decrypter := NewStdDecrypter(c)
		// Manually set an invalid key to cause aes.NewCipher to fail
		decrypter.cipher.Key = []byte("invalid")

		result, err := decrypter.Decrypt(testDataError)
		// The decryption will fail because the data is not properly encrypted
		assert.Empty(t, result)
		assert.NotNil(t, err)
		// The error will be from the cipher interface, not DecryptError
	})

	t.Run("decrypt empty data", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		decrypter := NewStdDecrypter(c)
		result, err := decrypter.Decrypt([]byte{})
		assert.Empty(t, result)
		assert.Nil(t, err)
	})

	t.Run("decrypt with aes.NewCipher error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		decrypter := NewStdDecrypter(c)
		// Set a key that will cause aes.NewCipher to fail
		// This is difficult to achieve with the current implementation,
		// but we can test the error path by mocking
		decrypter.cipher.Key = nil // This should cause aes.NewCipher to fail

		result, err := decrypter.Decrypt(testDataError)
		assert.Empty(t, result)
		assert.NotNil(t, err)
		assert.IsType(t, DecryptError{}, err)
	})
}

func TestStreamEncrypter_Write_ErrorPaths(t *testing.T) {
	t.Run("write with existing error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey([]byte("short")) // Invalid key size
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)
		streamEncrypter := encrypter.(*StreamEncrypter)
		assert.NotNil(t, streamEncrypter.Error)

		n, err := encrypter.Write(testDataError)
		assert.Equal(t, 0, n)
		assert.NotNil(t, err)
		assert.Equal(t, streamEncrypter.Error, err)
	})

	t.Run("write with empty data", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)
		n, err := encrypter.Write([]byte{})
		assert.Equal(t, 0, n)
		assert.Nil(t, err)
	})

	t.Run("write with buffer accumulation", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)
		streamEncrypter := encrypter.(*StreamEncrypter)

		// Add some data to buffer to test accumulation
		streamEncrypter.buffer = []byte("prefix")

		n, err := encrypter.Write(testDataError)
		assert.Nil(t, err)
		assert.Equal(t, len(testDataError), n)
		// Verify buffer was cleared
		assert.Nil(t, streamEncrypter.buffer)
	})

	t.Run("write with writer error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		// Create a mock writer that always returns an error
		mockWriter := mock.NewErrorReadWriteCloser(errors.New("write failed"))
		encrypter := NewStreamEncrypter(mockWriter, c)

		n, err := encrypter.Write(testDataError)
		assert.Equal(t, 0, n)
		assert.NotNil(t, err)
		assert.Contains(t, err.Error(), "write failed")
	})

	t.Run("write with cipher.Encrypt error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		// Don't set IV to cause cipher.Encrypt error
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)
		n, err := encrypter.Write(testDataError)
		// This should cause c.cipher.Encrypt to return an error
		if err != nil {
			assert.Equal(t, 0, n)
			assert.IsType(t, EncryptError{}, err)
		} else {
			// Fallback: if no error occurs, verify normal operation
			assert.Greater(t, n, 0)
		}
	})

	t.Run("write normal case", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)

		n, err := encrypter.Write(testDataError)
		assert.Nil(t, err)
		assert.Equal(t, len(testDataError), n)
	})

	t.Run("write with multiple writes", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)

		// First write
		n1, err1 := encrypter.Write([]byte("hello"))
		assert.Nil(t, err1)
		assert.Equal(t, 5, n1)

		// Second write
		n2, err2 := encrypter.Write([]byte(" world"))
		assert.Nil(t, err2)
		assert.Equal(t, 6, n2)
	})

	t.Run("write with large data", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)

		// Write large data
		largeData := make([]byte, 1000)
		for i := range largeData {
			largeData[i] = byte(i % 256)
		}

		n, err := encrypter.Write(largeData)
		assert.Nil(t, err)
		assert.Equal(t, len(largeData), n)
	})

	t.Run("write with zero data", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)

		// Write zero data
		n, err := encrypter.Write([]byte{})
		assert.Nil(t, err)
		assert.Equal(t, 0, n)
	})

	t.Run("write with single byte", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)

		// Write single byte
		n, err := encrypter.Write([]byte("a"))
		assert.Nil(t, err)
		assert.Equal(t, 1, n)
	})

	t.Run("write with nil block and valid key", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)
		streamEncrypter := encrypter.(*StreamEncrypter)
		// Set block to nil to test the aes.NewCipher retry logic
		streamEncrypter.block = nil

		n, err := encrypter.Write(testDataError)
		assert.Nil(t, err)
		assert.Equal(t, len(testDataError), n)
	})

}

func TestStreamEncrypter_Close_ErrorPaths(t *testing.T) {
	t.Run("close with existing error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey([]byte("short")) // Invalid key size
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)
		streamEncrypter := encrypter.(*StreamEncrypter)
		assert.NotNil(t, streamEncrypter.Error)

		err := encrypter.Close()
		assert.NotNil(t, err)
		assert.Equal(t, streamEncrypter.Error, err)
	})

	t.Run("close with underlying closer", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		// Use a mock closer that implements io.Closer
		mockCloser := mock.NewErrorReadWriteCloser(nil)
		encrypter := NewStreamEncrypter(mockCloser, c)

		err := encrypter.Close()
		assert.Nil(t, err) // mockCloser.Close() returns nil
	})

	t.Run("close with underlying closer error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		// Use a mock closer that returns an error
		var buf bytes.Buffer
		mockCloser := mock.NewCloseErrorWriteCloser(&buf, errors.New("close failed"))
		encrypter := NewStreamEncrypter(mockCloser, c)

		err := encrypter.Close()
		assert.NotNil(t, err)
		assert.Equal(t, "close failed", err.Error())
	})

	t.Run("close with non-closer writer", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		var buf bytes.Buffer
		encrypter := NewStreamEncrypter(&buf, c)

		err := encrypter.Close()
		assert.Nil(t, err) // bytes.Buffer doesn't implement io.Closer
	})
}

func TestStreamDecrypter_Read_ErrorPaths(t *testing.T) {
	t.Run("read with existing error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey([]byte("short")) // Invalid key size
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)
		streamDecrypter := decrypter.(*StreamDecrypter)
		assert.NotNil(t, streamDecrypter.Error)

		buf := make([]byte, 100)
		n, err := decrypter.Read(buf)
		assert.Equal(t, 0, n)
		assert.NotNil(t, err)
		assert.Equal(t, streamDecrypter.Error, err)
	})

	t.Run("read with empty data", func(t *testing.T) {
		// Create an empty encrypted file
		reader := mock.NewFile([]byte{}, "empty.dat")
		defer reader.Close()
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		decrypter := NewStreamDecrypter(reader, c)
		buf := make([]byte, 100)
		n, err := decrypter.Read(buf)
		assert.Equal(t, 0, n)
		assert.Equal(t, io.EOF, err)
	})

	t.Run("read with decrypted data", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)
		streamDecrypter := decrypter.(*StreamDecrypter)

		// Add some data to buffer to test position handling
		streamDecrypter.buffer = []byte("prefix")
		streamDecrypter.position = 0

		buf := make([]byte, 100)
		n, err := decrypter.Read(buf)
		// Should work normally even with pre-populated decrypted data
		assert.True(t, n >= 0)
		if err != nil {
			assert.Equal(t, io.EOF, err)
		}
	})

	t.Run("read with cipher.Decrypt error", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		// Don't set IV to cause cipher.Decrypt error
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		buf := make([]byte, 100)
		n, err := decrypter.Read(buf)
		// This should cause c.cipher.Decrypt to return an error
		if err != nil {
			assert.Equal(t, 0, n)
			assert.IsType(t, DecryptError{}, err)
		} else {
			// Fallback: if no error occurs, verify normal operation
			assert.True(t, n >= 0)
		}
	})

	t.Run("read normal case", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		buf := make([]byte, 100)
		n, err := decrypter.Read(buf)
		// Should work normally or return an error due to invalid encrypted data
		assert.True(t, n >= 0)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with multiple reads", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// First read
		buf1 := make([]byte, 5)
		n1, err1 := decrypter.Read(buf1)
		assert.True(t, n1 >= 0)
		if err1 != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err1 == io.EOF || err1 != nil)
		}

		// Second read
		buf2 := make([]byte, 5)
		n2, err2 := decrypter.Read(buf2)
		assert.True(t, n2 >= 0)
		if err2 != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err2 == io.EOF || err2 != nil)
		}
	})

	t.Run("read with small buffer", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// Use a very small buffer
		buf := make([]byte, 1)
		n, err := decrypter.Read(buf)
		assert.True(t, n >= 0)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with large buffer", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// Use a large buffer
		buf := make([]byte, 1000)
		n, err := decrypter.Read(buf)
		assert.True(t, n >= 0)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with exact buffer size", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// Use a buffer of exact size
		buf := make([]byte, len(testDataError))
		n, err := decrypter.Read(buf)
		assert.True(t, n >= 0)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with zero buffer", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// Use a zero-sized buffer
		buf := make([]byte, 0)
		n, err := decrypter.Read(buf)
		assert.Equal(t, 0, n)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with nil buffer", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// Use a nil buffer
		var buf []byte
		n, err := decrypter.Read(buf)
		assert.Equal(t, 0, n)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with nil block and valid key", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)
		streamDecrypter := decrypter.(*StreamDecrypter)
		// Set block to nil to test the aes.NewCipher retry logic
		streamDecrypter.block = nil

		buf := make([]byte, 100)
		n, err := decrypter.Read(buf)
		// Should work normally or return an error due to invalid encrypted data
		assert.True(t, n >= 0)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with partial data", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// Read partial data
		buf := make([]byte, 5)
		n, err := decrypter.Read(buf)
		assert.True(t, n >= 0)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})

	t.Run("read with exact data size", func(t *testing.T) {
		c := cipher.NewAesCipher(cipher.CBC)
		c.SetKey(key16Error)
		c.SetIV(iv16Error)
		c.SetPadding(cipher.PKCS7)

		reader := mock.NewFile(testDataError, "test.txt")
		defer reader.Close()
		decrypter := NewStreamDecrypter(reader, c)

		// Read exact data size
		buf := make([]byte, len(testDataError))
		n, err := decrypter.Read(buf)
		assert.True(t, n >= 0)
		if err != nil {
			// Could be EOF or DecryptError depending on the data
			assert.True(t, err == io.EOF || err != nil)
		}
	})
}
