@Test
public void TestVerifySignature() throws Exception {

    
    PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration();
    configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile);
    
    SignPoliciesUtility.signPolicies("./src/test/resources/unit_test_zts_private_k0.pem",
            "./src/test/resources/unit_test_zms_private_k0.pem", "./src/test/resources/sys.auth.pol",
            "./src/test/resources/sys.auth.new.pol");
    
    Path path = Paths.get("./src/test/resources/sys.auth.new.pol");
    DomainSignedPolicyData domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class);
    Assert.assertTrue(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new"));
    
    // negative test with tampered publickey - zts pubkey failure
    PolicyUpdaterConfiguration confMock = Mockito.mock(PolicyUpdaterConfiguration.class);
    Mockito.when(confMock.getZtsPublicKey(Mockito.any(ZTSClient.class), Mockito.<String>any())).thenReturn(null);
    Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, confMock, domainPolicySignedData, "sys.auth.new"));
    
    // negative test with tampered publickey - zms pubkey failure
    confMock = Mockito.mock(PolicyUpdaterConfiguration.class);
    PublicKey pKey = Crypto.loadPublicKey(Crypto.ybase64DecodeString("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0"
            + "RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TD"
            + "Nza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbX"
            + "ZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIF"
            + "BVQkxJQyBLRVktLS0tLQo-"));
    Mockito.when(confMock.getZtsPublicKey(Mockito.any(ZTSClient.class), Mockito.<String>any())).thenReturn(pKey);
    Mockito.when(confMock.getZmsPublicKey(Mockito.any(ZTSClient.class), Mockito.<String>any())).thenReturn(null);
    Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, confMock, domainPolicySignedData, "sys.auth.new"));
    
    // negative test with tampered expiration - zts signature failure
    path = Paths.get("./src/test/resources/sys.auth.pol.tampered.zts");
    domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class);
    Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new"));
    
    // negative test with tampered actions - zms signature failure
    path = Paths.get("./src/test/resources/sys.auth.pol.tampered.zms");
    domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class);
    Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new"));
    
    // Test error handling for illegal arguments
    boolean exceptionCaught = false;
    try {
        PolicyUpdater.validateSignedPolicies(null, configuration, null, "sys.auth.new");
    } catch (IllegalArgumentException ex) {
        exceptionCaught = true;
    }
    Assert.assertTrue(exceptionCaught);
    
    exceptionCaught = false;
    try {
        PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, null);
    } catch (IllegalArgumentException ex) {
        exceptionCaught = true;
    }
    Assert.assertTrue(exceptionCaught);
}