/*
 * Copyright (c) 2016 Apple Inc. All Rights Reserved.
 *
 * @APPLE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this
 * file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_LICENSE_HEADER_END@
 */

#if OCTAGON

#import <CloudKit/CloudKit.h>
#import <XCTest/XCTest.h>
#import <OCMock/OCMock.h>

#include <Security/SecItemPriv.h>
#include <Security/SecEntitlements.h>
#include <ipc/server_security_helpers.h>
#import <Foundation/NSXPCConnection_Private.h>

#import "keychain/categories/NSError+UsefulConstructors.h"

#import "keychain/ckks/tests/CloudKitMockXCTest.h"
#import "keychain/ckks/tests/CloudKitKeychainSyncingMockXCTest.h"
#import "keychain/ckks/CKKS.h"
#import "keychain/ckks/CKKSItem.h"
#import "keychain/ckks/CKKSItemEncrypter.h"
#import "keychain/ckks/CKKSKey.h"
#import "keychain/ckks/CKKSViewManager.h"
#import "keychain/ckks/CKKSZoneStateEntry.h"

#import "keychain/ckks/CKKSControl.h"
#import "keychain/ckks/CloudKitCategories.h"

#import "keychain/ckks/tests/MockCloudKit.h"
#import "keychain/ckks/tests/CKKSTests.h"
#import "keychain/ckks/tests/CKKSTests+API.h"

@implementation CloudKitKeychainSyncingTestsBase (APITests)

-(NSMutableDictionary*)pcsAddItemQuery:(NSString*)account
                                  data:(NSData*)data
                     serviceIdentifier:(NSNumber*)serviceIdentifier
                             publicKey:(NSData*)publicKey
                        publicIdentity:(NSData*)publicIdentity
{
    return [@{
              (id)kSecClass : (id)kSecClassGenericPassword,
              (id)kSecReturnPersistentRef: @YES,
              (id)kSecReturnAttributes: @YES,
              (id)kSecAttrSyncViewHint: @"keychain",
              (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
              (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
              (id)kSecAttrAccount : account,
              (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
              (id)kSecValueData : data,
              (id)kSecAttrDeriveSyncIDFromItemAttributes : (id)kCFBooleanTrue,
              (id)kSecAttrPCSPlaintextServiceIdentifier : serviceIdentifier,
              (id)kSecAttrPCSPlaintextPublicKey : publicKey,
              (id)kSecAttrPCSPlaintextPublicIdentity : publicIdentity,
              } mutableCopy];
}

-(NSDictionary*)pcsAddItem:(NSString*)account
                      data:(NSData*)data
         serviceIdentifier:(NSNumber*)serviceIdentifier
                 publicKey:(NSData*)publicKey
            publicIdentity:(NSData*)publicIdentity
             expectingSync:(bool)expectingSync
{
    NSMutableDictionary* query = [self pcsAddItemQuery:account
                                                  data:data
                                     serviceIdentifier:(NSNumber*)serviceIdentifier
                                             publicKey:(NSData*)publicKey
                                        publicIdentity:(NSData*)publicIdentity];
    CFTypeRef result = NULL;
    XCTestExpectation* syncExpectation = [self expectationWithDescription: @"callback occurs"];

    XCTAssertEqual(errSecSuccess, _SecItemAddAndNotifyOnSync((__bridge CFDictionaryRef) query, &result, ^(bool didSync, CFErrorRef error) {
        if(expectingSync) {
            XCTAssertTrue(didSync, "Item synced");
            XCTAssertNil((__bridge NSError*)error, "No error syncing item");
        } else {
            XCTAssertFalse(didSync, "Item did not sync");
            XCTAssertNotNil((__bridge NSError*)error, "Error syncing item");
        }

        [syncExpectation fulfill];
    }), @"_SecItemAddAndNotifyOnSync succeeded");

    // Verify that the item was written to CloudKit
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    // In real code, you'd need to wait for the _SecItemAddAndNotifyOnSync callback to succeed before proceeding
    [self waitForExpectations:@[syncExpectation] timeout:20];

    return (NSDictionary*) CFBridgingRelease(result);
}

- (BOOL (^) (CKRecord*)) checkPCSFieldsBlock: (CKRecordZoneID*) zoneID
                        PCSServiceIdentifier:(NSNumber*)servIdentifier
                                PCSPublicKey:(NSData*)publicKey
                           PCSPublicIdentity:(NSData*)publicIdentity
{
    __weak __typeof(self) weakSelf = self;
    return ^BOOL(CKRecord* record) {
        __strong __typeof(weakSelf) strongSelf = weakSelf;
        XCTAssertNotNil(strongSelf, "self exists");

        XCTAssert([record[SecCKRecordPCSServiceIdentifier] isEqual: servIdentifier], "PCS Service identifier matches input");
        XCTAssert([record[SecCKRecordPCSPublicKey]         isEqual: publicKey],      "PCS Public Key matches input");
        XCTAssert([record[SecCKRecordPCSPublicIdentity]    isEqual: publicIdentity], "PCS Public Identity matches input");

        if([record[SecCKRecordPCSServiceIdentifier] isEqual: servIdentifier] &&
           [record[SecCKRecordPCSPublicKey]         isEqual: publicKey] &&
           [record[SecCKRecordPCSPublicIdentity]    isEqual: publicIdentity]) {
            return YES;
        } else {
            return NO;
        }
    };
}
@end

@interface CloudKitKeychainSyncingAPITests : CloudKitKeychainSyncingTestsBase
@end

@implementation CloudKitKeychainSyncingAPITests
- (void)testSecuritydClientBringup {
#if 0
    CFErrorRef cferror = nil;
    xpc_endpoint_t endpoint = SecCreateSecuritydXPCServerEndpoint(&cferror);
    XCTAssertNil((__bridge id)cferror, "No error creating securityd endpoint");
    XCTAssertNotNil(endpoint, "Received securityd endpoint");
#endif

    NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(SecuritydXPCProtocol)];
    [SecuritydXPCClient configureSecuritydXPCProtocol: interface];
    XCTAssertNotNil(interface, "Received a configured CKKS interface");

#if 0
    NSXPCListenerEndpoint *listenerEndpoint = [[NSXPCListenerEndpoint alloc] init];
    [listenerEndpoint _setEndpoint:endpoint];

    NSXPCConnection* connection = [[NSXPCConnection alloc] initWithListenerEndpoint:listenerEndpoint];
    XCTAssertNotNil(connection , "Received an active connection");

    connection.remoteObjectInterface = interface;
#endif
}

- (void)testAddAndNotifyOnSync {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID];
    [self startCKKSSubsystem];

    // Let things shake themselves out.
    [self.keychainView waitForKeyHierarchyReadiness];
    [self waitForCKModifications];

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    } mutableCopy];

    XCTestExpectation* blockExpectation = [self expectationWithDescription: @"callback occurs"];

    XCTAssertEqual(errSecSuccess, _SecItemAddAndNotifyOnSync((__bridge CFDictionaryRef) query, NULL, ^(bool didSync, CFErrorRef error) {
        XCTAssertTrue(didSync, "Item synced properly");
        XCTAssertNil((__bridge NSError*)error, "No error syncing item");

        [blockExpectation fulfill];
    }), @"_SecItemAddAndNotifyOnSync succeeded");

    [self waitForExpectationsWithTimeout:5.0 handler:nil];
}

- (void)testAddAndNotifyOnSyncFailure {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];
    [self.keychainView waitForFetchAndIncomingQueueProcessing];

    // Due to item UUID selection, this item will be added with UUID 50184A35-4480-E8BA-769B-567CF72F1EC0.
    // Add it to CloudKit first!
    CKRecord* ckr = [self createFakeRecord: self.keychainZoneID recordName:@"50184A35-4480-E8BA-769B-567CF72F1EC0"];
    [self.keychainZone addToZone: ckr];


    // Go for it!
    [self expectCKAtomicModifyItemRecordsUpdateFailure: self.keychainZoneID];

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    (id)kSecAttrSyncViewHint : self.keychainView.zoneName, // @ fake view hint for fake view
                                    } mutableCopy];

    XCTestExpectation* blockExpectation = [self expectationWithDescription: @"callback occurs"];

    XCTAssertEqual(errSecSuccess, _SecItemAddAndNotifyOnSync((__bridge CFDictionaryRef) query, NULL, ^(bool didSync, CFErrorRef error) {
        XCTAssertFalse(didSync, "Item did not sync (as expected)");
        XCTAssertNotNil((__bridge NSError*)error, "error exists when item fails to sync");

        [blockExpectation fulfill];
    }), @"_SecItemAddAndNotifyOnSync succeeded");

    [self waitForExpectationsWithTimeout:5.0 handler:nil];
    [self waitForCKModifications];
}

- (void)testAddAndNotifyOnSyncLoggedOut {
    // Test starts with nothing in database and the user logged out of CloudKit. We expect no CKKS operations.
    self.accountStatus = CKAccountStatusNoAccount;
    self.silentFetchesAllowed = false;
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.loggedOut wait:20*NSEC_PER_SEC], "CKKS should positively log out");

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    } mutableCopy];

    XCTestExpectation* blockExpectation = [self expectationWithDescription: @"callback occurs"];

    XCTAssertEqual(errSecSuccess, _SecItemAddAndNotifyOnSync((__bridge CFDictionaryRef) query, NULL, ^(bool didSync, CFErrorRef error) {
        XCTAssertFalse(didSync, "Item did not sync (with no iCloud account)");
        XCTAssertNotNil((__bridge NSError*)error, "Error exists syncing item while logged out");

        [blockExpectation fulfill];
    }), @"_SecItemAddAndNotifyOnSync succeeded");

    [self waitForExpectationsWithTimeout:5.0 handler:nil];
}

- (void)testAddAndNotifyOnSyncAccountStatusUnclear {
    // Test starts with nothing in database, but CKKS hasn't been told we've logged out yet.
    // We expect no CKKS operations.
    self.accountStatus = CKAccountStatusNoAccount;
    self.silentFetchesAllowed = false;

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    } mutableCopy];

    XCTestExpectation* blockExpectation = [self expectationWithDescription: @"callback occurs"];

    XCTAssertEqual(errSecSuccess, _SecItemAddAndNotifyOnSync((__bridge CFDictionaryRef) query, NULL, ^(bool didSync, CFErrorRef error) {
        XCTAssertFalse(didSync, "Item did not sync (with no iCloud account)");
        XCTAssertNotNil((__bridge NSError*)error, "Error exists syncing item while logged out");

        [blockExpectation fulfill];
    }), @"_SecItemAddAndNotifyOnSync succeeded");

    // And now, allow CKKS to discover we're logged out
    [self startCKKSSubsystem];
    XCTAssertEqual(0, [self.keychainView.loggedOut wait:20*NSEC_PER_SEC], "CKKS should positively log out");

    [self waitForExpectationsWithTimeout:5.0 handler:nil];
}

- (void)testAddAndNotifyOnSyncBeforeKeyHierarchyReady {
    // Test starts with a key hierarchy in cloudkit and the TLK having arrived
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self saveTLKMaterialToKeychain:self.keychainZoneID];
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];

    // But block CloudKit fetches (so the key hierarchy won't be ready when we add this new item)
    [self holdCloudKitFetches];

    [self startCKKSSubsystem];
    XCTAssertEqual(0, [self.keychainView.loggedIn wait:20*NSEC_PER_SEC], "CKKS should log in");
    [self.keychainView.zoneSetupOperation waitUntilFinished];

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecAttrSyncViewHint : self.keychainView.zoneName,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    } mutableCopy];

    XCTestExpectation* blockExpectation = [self expectationWithDescription: @"callback occurs"];

    XCTAssertEqual(errSecSuccess, _SecItemAddAndNotifyOnSync((__bridge CFDictionaryRef) query, NULL, ^(bool didSync, CFErrorRef error) {
        XCTAssertTrue(didSync, "Item synced");
        XCTAssertNil((__bridge NSError*)error, "Shouldn't have received an error syncing item");

        [blockExpectation fulfill];
    }), @"_SecItemAddAndNotifyOnSync succeeded");

    // We should be in the 'fetch' state, but no further
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateFetch] wait:20*NSEC_PER_SEC], @"Should have reached key state 'fetch', but no further");

    // When we release the fetch, the callback should still fire and the item should upload
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID];
    [self releaseCloudKitFetchHold];
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], @"Should have reached key state 'ready'");

    // Verify that the item was written to CloudKit
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    [self waitForExpectationsWithTimeout:5.0 handler:nil];
}

- (void)testPCSUnencryptedFieldsAdd {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];
    [self.keychainView waitForKeyHierarchyReadiness];

    NSNumber* servIdentifier = @3;
    NSData* publicKey = [@"asdfasdf" dataUsingEncoding:NSUTF8StringEncoding];
    NSData* publicIdentity = [@"somedata" dataUsingEncoding:NSUTF8StringEncoding];

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID
                          checkItem: [self checkPCSFieldsBlock:self.keychainZoneID
                                          PCSServiceIdentifier:(NSNumber *)servIdentifier
                                                  PCSPublicKey:publicKey
                                             PCSPublicIdentity:publicIdentity]];

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    (id)kSecAttrDeriveSyncIDFromItemAttributes : (id)kCFBooleanTrue,
                                    (id)kSecAttrPCSPlaintextServiceIdentifier : servIdentifier,
                                    (id)kSecAttrPCSPlaintextPublicKey : publicKey,
                                    (id)kSecAttrPCSPlaintextPublicIdentity : publicIdentity,
                                    (id)kSecAttrSyncViewHint : self.keychainView.zoneName, // allows a CKKSScanOperation to find this item
                                    } mutableCopy];

    XCTAssertEqual(errSecSuccess, SecItemAdd((__bridge CFDictionaryRef) query, NULL), @"SecItemAdd succeeded");

    // Verify that the item is written to CloudKit
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    CFTypeRef item = NULL;
    query[(id)kSecValueData] = nil;
    query[(id)kSecReturnAttributes] = @YES;
    XCTAssertEqual(errSecSuccess, SecItemCopyMatching((__bridge CFDictionaryRef) query, &item), "item should still exist");

    NSDictionary* itemAttributes = (NSDictionary*) CFBridgingRelease(item);
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextServiceIdentifier], servIdentifier, "Service Identifier exists");
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextPublicKey],         publicKey,      "public key exists");
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextPublicIdentity],    publicIdentity, "public identity exists");

    // Find the item record in CloudKit. Since we're using kSecAttrDeriveSyncIDFromItemAttributes,
    // the record ID is likely 50184A35-4480-E8BA-769B-567CF72F1EC0
    [self waitForCKModifications];
    CKRecordID* recordID = [[CKRecordID alloc] initWithRecordName: @"50184A35-4480-E8BA-769B-567CF72F1EC0" zoneID:self.keychainZoneID];
    CKRecord* record = self.keychainZone.currentDatabase[recordID];
    XCTAssertNotNil(record, "Found record in CloudKit at expected UUID");

    XCTAssertEqualObjects(record[SecCKRecordPCSServiceIdentifier], servIdentifier, "Service identifier sent to cloudkit");
    XCTAssertEqualObjects(record[SecCKRecordPCSPublicKey],         publicKey,      "public key sent to cloudkit");
    XCTAssertEqualObjects(record[SecCKRecordPCSPublicIdentity],    publicIdentity, "public identity sent to cloudkit");
}

- (void)testPCSUnencryptedFieldsModify {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];
    [self.keychainView waitForKeyHierarchyReadiness];

    NSNumber* servIdentifier = @3;
    NSData* publicKey = [@"asdfasdf" dataUsingEncoding:NSUTF8StringEncoding];
    NSData* publicIdentity = [@"somedata" dataUsingEncoding:NSUTF8StringEncoding];

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID
                          checkItem: [self checkPCSFieldsBlock:self.keychainZoneID
                                          PCSServiceIdentifier:(NSNumber *)servIdentifier
                                                  PCSPublicKey:publicKey
                                             PCSPublicIdentity:publicIdentity]];

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    (id)kSecAttrDeriveSyncIDFromItemAttributes : (id)kCFBooleanTrue,
                                    (id)kSecAttrPCSPlaintextServiceIdentifier : servIdentifier,
                                    (id)kSecAttrPCSPlaintextPublicKey : publicKey,
                                    (id)kSecAttrPCSPlaintextPublicIdentity : publicIdentity,
                                    (id)kSecAttrSyncViewHint : self.keychainView.zoneName, // allows a CKKSScanOperation to find this item
                                    } mutableCopy];

    XCTAssertEqual(errSecSuccess, SecItemAdd((__bridge CFDictionaryRef) query, NULL), @"SecItemAdd succeeded");

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    [self waitForCKModifications];

    query[(id)kSecValueData] = nil;
    query[(id)kSecAttrPCSPlaintextServiceIdentifier] = nil;
    query[(id)kSecAttrPCSPlaintextPublicKey] = nil;
    query[(id)kSecAttrPCSPlaintextPublicIdentity] = nil;

    servIdentifier = @1;
    publicKey = [@"new public key" dataUsingEncoding:NSUTF8StringEncoding];

    NSNumber* newServiceIdentifier = @10;
    NSData* newPublicKey = [@"new public key" dataUsingEncoding:NSUTF8StringEncoding];
    NSData* newPublicIdentity = [@"new public identity" dataUsingEncoding:NSUTF8StringEncoding];

    NSDictionary* update = @{
                             (id)kSecAttrPCSPlaintextServiceIdentifier : newServiceIdentifier,
                             (id)kSecAttrPCSPlaintextPublicKey : newPublicKey,
                             (id)kSecAttrPCSPlaintextPublicIdentity : newPublicIdentity,
                             };

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID
                          checkItem: [self checkPCSFieldsBlock:self.keychainZoneID
                                          PCSServiceIdentifier:(NSNumber *)newServiceIdentifier
                                                  PCSPublicKey:newPublicKey
                                             PCSPublicIdentity:newPublicIdentity]];

    XCTAssertEqual(errSecSuccess, SecItemUpdate((__bridge CFDictionaryRef) query, (__bridge CFDictionaryRef) update), @"SecItemUpdate succeeded");
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    CFTypeRef item = NULL;
    query[(id)kSecValueData] = nil;
    query[(id)kSecReturnAttributes] = @YES;
    XCTAssertEqual(errSecSuccess, SecItemCopyMatching((__bridge CFDictionaryRef) query, &item), "item should still exist");

    NSDictionary* itemAttributes = (NSDictionary*) CFBridgingRelease(item);
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextServiceIdentifier], newServiceIdentifier, "Service Identifier exists");
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextPublicKey],         newPublicKey,         "public key exists");
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextPublicIdentity],    newPublicIdentity,    "public identity exists");

    // Find the item record in CloudKit. Since we're using kSecAttrDeriveSyncIDFromItemAttributes,
    // the record ID is likely 50184A35-4480-E8BA-769B-567CF72F1EC0
    [self waitForCKModifications];
    CKRecordID* recordID = [[CKRecordID alloc] initWithRecordName: @"50184A35-4480-E8BA-769B-567CF72F1EC0" zoneID:self.keychainZoneID];
    CKRecord* record = self.keychainZone.currentDatabase[recordID];
    XCTAssertNotNil(record, "Found record in CloudKit at expected UUID");

    XCTAssertEqualObjects(record[SecCKRecordPCSServiceIdentifier], newServiceIdentifier, "Service identifier sent to cloudkit");
    XCTAssertEqualObjects(record[SecCKRecordPCSPublicKey],         newPublicKey,         "public key sent to cloudkit");
    XCTAssertEqualObjects(record[SecCKRecordPCSPublicIdentity],    newPublicIdentity,    "public identity sent to cloudkit");
}

// As of [<rdar://problem/32558310> CKKS: Re-authenticate PCSPublicFields], these fields are NOT server-modifiable. This test proves it.
- (void)testPCSUnencryptedFieldsServerModifyFail {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];
    [self.keychainView waitForKeyHierarchyReadiness];

    NSNumber* servIdentifier = @3;
    NSData* publicKey = [@"asdfasdf" dataUsingEncoding:NSUTF8StringEncoding];
    NSData* publicIdentity = [@"somedata" dataUsingEncoding:NSUTF8StringEncoding];

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID
                          checkItem: [self checkPCSFieldsBlock:self.keychainZoneID
                                          PCSServiceIdentifier:(NSNumber *)servIdentifier
                                                  PCSPublicKey:publicKey
                                             PCSPublicIdentity:publicIdentity]];

    NSMutableDictionary* query = [@{
                                    (id)kSecClass : (id)kSecClassGenericPassword,
                                    (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
                                    (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
                                    (id)kSecAttrAccount : @"testaccount",
                                    (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
                                    (id)kSecValueData : (id) [@"asdf" dataUsingEncoding:NSUTF8StringEncoding],
                                    (id)kSecAttrDeriveSyncIDFromItemAttributes : (id)kCFBooleanTrue,
                                    (id)kSecAttrPCSPlaintextServiceIdentifier : servIdentifier,
                                    (id)kSecAttrPCSPlaintextPublicKey : publicKey,
                                    (id)kSecAttrPCSPlaintextPublicIdentity : publicIdentity,
                                    (id)kSecAttrSyncViewHint : self.keychainView.zoneName, // fake, for CKKSScanOperation
                                    } mutableCopy];

    XCTAssertEqual(errSecSuccess, SecItemAdd((__bridge CFDictionaryRef) query, NULL), @"SecItemAdd succeeded");

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    [self waitForCKModifications];

    // Find the item record in CloudKit. Since we're using kSecAttrDeriveSyncIDFromItemAttributes,
    // the record ID is likely 50184A35-4480-E8BA-769B-567CF72F1EC0
    CKRecordID* recordID = [[CKRecordID alloc] initWithRecordName: @"50184A35-4480-E8BA-769B-567CF72F1EC0" zoneID:self.keychainZoneID];
    CKRecord* record = self.keychainZone.currentDatabase[recordID];
    XCTAssertNotNil(record, "Found record in CloudKit at expected UUID");

    // Items are encrypted using encv2
    XCTAssertEqualObjects(record[SecCKRecordEncryptionVersionKey], [NSNumber numberWithInteger:(int) CKKSItemEncryptionVersion2], "Uploaded using encv2");

    if(!record) {
        // Test has already failed; find the record just to be nice.
        for(CKRecord* maybe in self.keychainZone.currentDatabase.allValues) {
            if(maybe[SecCKRecordPCSServiceIdentifier] != nil) {
                record = maybe;
            }
        }
    }

    NSNumber* newServiceIdentifier = @10;
    NSData* newPublicKey = [@"new public key" dataUsingEncoding:NSUTF8StringEncoding];
    NSData* newPublicIdentity = [@"new public identity" dataUsingEncoding:NSUTF8StringEncoding];

    // Change the public key and public identity
    record = [record copyWithZone: nil];
    record[SecCKRecordPCSServiceIdentifier] = newServiceIdentifier;
    record[SecCKRecordPCSPublicKey] = newPublicKey;
    record[SecCKRecordPCSPublicIdentity] = newPublicIdentity;
    [self.keychainZone addToZone: record];

    // Trigger a notification
    [self.keychainView notifyZoneChange:nil];
    [self.keychainView waitForFetchAndIncomingQueueProcessing];

    CFTypeRef item = NULL;
    query[(id)kSecValueData] = nil;
    query[(id)kSecAttrPCSPlaintextServiceIdentifier] = nil;
    query[(id)kSecAttrPCSPlaintextPublicKey] = nil;
    query[(id)kSecAttrPCSPlaintextPublicIdentity] = nil;
    query[(id)kSecReturnAttributes] = @YES;
    XCTAssertEqual(errSecSuccess, SecItemCopyMatching((__bridge CFDictionaryRef) query, &item), "item should still exist");

    NSDictionary* itemAttributes = (NSDictionary*) CFBridgingRelease(item);
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextServiceIdentifier], servIdentifier, "service identifier is not updated");
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextPublicKey],         publicKey,      "public key not updated");
    XCTAssertEqualObjects(itemAttributes[(id)kSecAttrPCSPlaintextPublicIdentity],    publicIdentity, "public identity not updated");
}

-(void)testPCSUnencryptedFieldsRecieveUnauthenticatedFields {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];
    [self.keychainView waitForKeyHierarchyReadiness];

    NSNumber* servIdentifier = @3;
    NSData* publicKey = [@"asdfasdf" dataUsingEncoding:NSUTF8StringEncoding];
    NSData* publicIdentity = [@"somedata" dataUsingEncoding:NSUTF8StringEncoding];

    NSError* error = nil;

    // Manually encrypt an item
    NSString* recordName = @"7B598D31-F9C5-481E-98AC-5A507ACB2D85";
    CKRecordID* recordID = [[CKRecordID alloc] initWithRecordName:recordName zoneID:self.keychainZoneID];
    NSDictionary* item = [self fakeRecordDictionary: @"account-delete-me" zoneID:self.keychainZoneID];
    CKKSItem* cipheritem = [[CKKSItem alloc] initWithUUID:recordID.recordName
                                            parentKeyUUID:self.keychainZoneKeys.classC.uuid
                                                   zoneID:recordID.zoneID];
    CKKSKey* itemkey = [CKKSKey randomKeyWrappedByParent: self.keychainZoneKeys.classC error:&error];
    XCTAssertNotNil(itemkey, "Got a key");
    cipheritem.wrappedkey = itemkey.wrappedkey;
    XCTAssertNotNil(cipheritem.wrappedkey, "Got a wrapped key");

    cipheritem.encver = CKKSItemEncryptionVersion1;

    // This item has the PCS public fields, but they are not authenticated
    cipheritem.plaintextPCSServiceIdentifier = servIdentifier;
    cipheritem.plaintextPCSPublicKey = publicKey;
    cipheritem.plaintextPCSPublicIdentity = publicIdentity;

    NSDictionary<NSString*, NSData*>* authenticatedData = [cipheritem makeAuthenticatedDataDictionaryUpdatingCKKSItem: nil encryptionVersion:CKKSItemEncryptionVersion1];
    cipheritem.encitem = [CKKSItemEncrypter encryptDictionary:item key:itemkey.aessivkey authenticatedData:authenticatedData error:&error];
    XCTAssertNil(error, "no error encrypting object");
    XCTAssertNotNil(cipheritem.encitem, "Recieved ciphertext");

    [self.keychainZone addToZone:[cipheritem CKRecordWithZoneID: recordID.zoneID]];

    [self.keychainView waitForFetchAndIncomingQueueProcessing];

    NSDictionary* query = @{(id)kSecClass: (id)kSecClassGenericPassword,
                            (id)kSecReturnAttributes: @YES,
                            (id)kSecAttrSynchronizable: @YES,
                            (id)kSecAttrAccount: @"account-delete-me",
                            (id)kSecMatchLimit: (id)kSecMatchLimitOne,
                            };
    CFTypeRef cfresult = NULL;
    XCTAssertEqual(errSecSuccess, SecItemCopyMatching((__bridge CFDictionaryRef) query, &cfresult), "Found synced item");

    NSDictionary* result = CFBridgingRelease(cfresult);
    XCTAssertEqualObjects(result[(id)kSecAttrPCSPlaintextServiceIdentifier], servIdentifier, "Received PCS service identifier");
    XCTAssertEqualObjects(result[(id)kSecAttrPCSPlaintextPublicKey],         publicKey,      "Received PCS public key");
    XCTAssertEqualObjects(result[(id)kSecAttrPCSPlaintextPublicIdentity],    publicIdentity, "Received PCS public identity");
}

-(void)testPCSUnencryptedFieldsRecieveAuthenticatedFields {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];
    [self.keychainView waitForKeyHierarchyReadiness];
    [self.keychainView waitForOperationsOfClass:[CKKSIncomingQueueOperation class]];

    NSNumber* servIdentifier = @3;
    NSData* publicKey = [@"asdfasdf" dataUsingEncoding:NSUTF8StringEncoding];
    NSData* publicIdentity = [@"somedata" dataUsingEncoding:NSUTF8StringEncoding];

    NSError* error = nil;

    // Manually encrypt an item
    NSString* recordName = @"7B598D31-F9C5-481E-98AC-5A507ACB2D85";
    CKRecordID* recordID = [[CKRecordID alloc] initWithRecordName:recordName zoneID:self.keychainZoneID];
    NSDictionary* item = [self fakeRecordDictionary: @"account-delete-me" zoneID:self.keychainZoneID];
    CKKSItem* cipheritem = [[CKKSItem alloc] initWithUUID:recordID.recordName
                                            parentKeyUUID:self.keychainZoneKeys.classC.uuid
                                                   zoneID:recordID.zoneID];
    CKKSKey* itemkey = [CKKSKey randomKeyWrappedByParent: self.keychainZoneKeys.classC error:&error];
    XCTAssertNotNil(itemkey, "Got a key");
    cipheritem.wrappedkey = itemkey.wrappedkey;
    XCTAssertNotNil(cipheritem.wrappedkey, "Got a wrapped key");

    cipheritem.encver = CKKSItemEncryptionVersion2;

    // This item has the PCS public fields, and they are authenticated (since we're using v2)
    cipheritem.plaintextPCSServiceIdentifier = servIdentifier;
    cipheritem.plaintextPCSPublicKey = publicKey;
    cipheritem.plaintextPCSPublicIdentity = publicIdentity;

    // Use version 2, so PCS plaintext fields will be authenticated
    NSMutableDictionary<NSString*, NSData*>* authenticatedData = [[cipheritem makeAuthenticatedDataDictionaryUpdatingCKKSItem: nil encryptionVersion:CKKSItemEncryptionVersion2] mutableCopy];

    cipheritem.encitem = [CKKSItemEncrypter encryptDictionary:item key:itemkey.aessivkey authenticatedData:authenticatedData error:&error];
    XCTAssertNil(error, "no error encrypting object");
    XCTAssertNotNil(cipheritem.encitem, "Recieved ciphertext");

    [self.keychainZone addToZone:[cipheritem CKRecordWithZoneID: recordID.zoneID]];

    [self.keychainView waitForFetchAndIncomingQueueProcessing];

    NSDictionary* query = @{(id)kSecClass: (id)kSecClassGenericPassword,
                            (id)kSecReturnAttributes: @YES,
                            (id)kSecAttrSynchronizable: @YES,
                            (id)kSecAttrAccount: @"account-delete-me",
                            (id)kSecMatchLimit: (id)kSecMatchLimitOne,
                            };
    CFTypeRef cfresult = NULL;
    XCTAssertEqual(errSecSuccess, SecItemCopyMatching((__bridge CFDictionaryRef) query, &cfresult), "Found synced item");

    NSDictionary* result = CFBridgingRelease(cfresult);
    XCTAssertEqualObjects(result[(id)kSecAttrPCSPlaintextServiceIdentifier], servIdentifier, "Received PCS service identifier");
    XCTAssertEqualObjects(result[(id)kSecAttrPCSPlaintextPublicKey],         publicKey,      "Received PCS public key");
    XCTAssertEqualObjects(result[(id)kSecAttrPCSPlaintextPublicIdentity],    publicIdentity, "Received PCS public identity");

    // Test that if this item is updated, it remains encrypted in v2
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID
                          checkItem: [self checkPCSFieldsBlock:self.keychainZoneID
                                          PCSServiceIdentifier:(NSNumber *)servIdentifier
                                                  PCSPublicKey:publicKey
                                             PCSPublicIdentity:publicIdentity]];
    [self updateGenericPassword:@"different password" account:@"account-delete-me"];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    [self waitForCKModifications];

    CKRecord* newRecord = self.keychainZone.currentDatabase[recordID];
    XCTAssertEqualObjects(newRecord[SecCKRecordPCSServiceIdentifier], servIdentifier, "Didn't change service identifier");
    XCTAssertEqualObjects(newRecord[SecCKRecordPCSPublicKey],         publicKey,      "Didn't change public key");
    XCTAssertEqualObjects(newRecord[SecCKRecordPCSPublicIdentity],    publicIdentity, "Didn't change public identity");
    XCTAssertEqualObjects(newRecord[SecCKRecordEncryptionVersionKey], [NSNumber numberWithInteger:(int) CKKSItemEncryptionVersion2], "Uploaded using encv2");
}

-(void)testResetLocal {
    // Test starts with nothing in database, but one in our fake CloudKit.
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];
    [self saveTLKMaterialToKeychainSimulatingSOS:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    // We expect a single record to be uploaded
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem: [self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];
    [self addGenericPassword: @"data" account: @"account-delete-me"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    // After the local reset, we expect: a fetch, then nothing
    self.silentFetchesAllowed = false;
    [self expectCKFetch];

    XCTestExpectation* resetExpectation = [self expectationWithDescription: @"local reset callback occurs"];
    [self.injectedManager rpcResetLocal:nil reply:^(NSError* result) {
        XCTAssertNil(result, "no error resetting local");
        [resetExpectation fulfill];
    }];
    [self waitForExpectations:@[resetExpectation] timeout:20];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem: [self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

-(void)testResetLocalWhileLoggedOut {
    // We're "logged in to" cloudkit but not in circle.
    self.circleStatus = [[SOSAccountStatus alloc] init:kSOSCCNotInCircle error:nil];
    [self.accountStateTracker notifyCircleStatusChangeAndWaitForSignal];
    self.silentFetchesAllowed = false;

    // Test starts with local TLK and key hierarchy in our fake cloudkit
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self saveTLKMaterialToKeychainSimulatingSOS:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.loggedOut wait:500*NSEC_PER_MSEC], "Should have been told of a 'logout' event on startup");

    NSData* changeTokenData = [[[NSUUID UUID] UUIDString] dataUsingEncoding:NSUTF8StringEncoding];
    CKServerChangeToken* changeToken = [[CKServerChangeToken alloc] initWithData:changeTokenData];
    [self.keychainView dispatchSync: ^bool{
        CKKSZoneStateEntry* ckse = [CKKSZoneStateEntry state:self.keychainView.zoneName];
        ckse.changeToken = changeToken;

        NSError* error = nil;
        [ckse saveToDatabase:&error];
        XCTAssertNil(error, "No error saving new zone state to database");
        return true;
    }];

    XCTestExpectation* resetExpectation = [self expectationWithDescription: @"local reset callback occurs"];
    [self.injectedManager rpcResetLocal:nil reply:^(NSError* result) {
        XCTAssertNil(result, "no error resetting local");
        secnotice("ckks", "Received a rpcResetLocal callback");
        [resetExpectation fulfill];
    }];

    [self waitForExpectations:@[resetExpectation] timeout:20];

    [self.keychainView dispatchSync: ^bool{
        CKKSZoneStateEntry* ckse = [CKKSZoneStateEntry state:self.keychainView.zoneName];
        XCTAssertNotEqualObjects(changeToken, ckse.changeToken, "Change token is reset");
        return true;
    }];

    // Now log in, and see what happens! It should re-fetch, pick up the old key hierarchy, and use it
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];
    self.silentFetchesAllowed = true;
    self.circleStatus = [[SOSAccountStatus alloc] init:kSOSCCInCircle error:nil];;
    [self.accountStateTracker notifyCircleStatusChangeAndWaitForSignal];

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem:[self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

-(void)testResetLocalMultipleTimes {
    // Test starts with nothing in database, but one in our fake CloudKit.
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];
    [self saveTLKMaterialToKeychainSimulatingSOS:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    // We expect a single record to be uploaded
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready'");
    [self expectCKModifyItemRecords:1 currentKeyPointerRecords:1 zoneID:self.keychainZoneID
                          checkItem:[self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];
    [self addGenericPassword: @"data" account: @"account-delete-me"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    [self waitForCKModifications];

    // We're going to request a bunch of CloudKit resets, but hold them from finishing
    [self holdCloudKitFetches];

    XCTestExpectation* resetExpectation0 = [self expectationWithDescription: @"reset callback(0) occurs"];
    XCTestExpectation* resetExpectation1 = [self expectationWithDescription: @"reset callback(1) occurs"];
    XCTestExpectation* resetExpectation2 = [self expectationWithDescription: @"reset callback(2) occurs"];
    [self.injectedManager rpcResetLocal:nil reply:^(NSError* result) {
        XCTAssertNil(result, "should receive no error resetting local");
        secnotice("ckksreset", "Received a rpcResetLocal(0) callback");
        [resetExpectation0 fulfill];
    }];
    [self.injectedManager rpcResetLocal:nil reply:^(NSError* result) {
        XCTAssertNil(result, "should receive no error resetting local");
        secnotice("ckksreset", "Received a rpcResetLocal(1) callback");
        [resetExpectation1 fulfill];
    }];
    [self.injectedManager rpcResetLocal:nil reply:^(NSError* result) {
        XCTAssertNil(result, "should receive no error resetting local");
        secnotice("ckksreset", "Received a rpcResetLocal(2) callback");
        [resetExpectation2 fulfill];
    }];

    // After the reset(s), we expect no uploads. Let the resets flow!
    [self releaseCloudKitFetchHold];
    [self waitForExpectations:@[resetExpectation0, resetExpectation1, resetExpectation2] timeout:20];
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready'");

    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    [self expectCKModifyItemRecords:1 currentKeyPointerRecords:1 zoneID:self.keychainZoneID
                          checkItem:[self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

-(void)testResetCloudKitZone {
    self.silentZoneDeletesAllowed = true;

    // Test starts with nothing in database, but one in our fake CloudKit.
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];
    [self saveTLKMaterialToKeychainSimulatingSOS:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    // We expect a single record to be uploaded
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem: [self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];
    [self addGenericPassword: @"data" account: @"account-delete-me"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    [self waitForCKModifications];

    // After the reset, we expect a key hierarchy upload, and then the class C item upload
    [self expectCKModifyKeyRecords: 3 currentKeyPointerRecords: 3 tlkShareRecords: 1 zoneID:self.keychainZoneID];
        [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem: [self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];

    XCTestExpectation* resetExpectation = [self expectationWithDescription: @"reset callback occurs"];
    [self.injectedManager rpcResetCloudKit:nil reason:@"reset-test" reply:^(NSError* result) {
        XCTAssertNil(result, "no error resetting cloudkit");
        secnotice("ckks", "Received a resetCloudKit callback");
        [resetExpectation fulfill];
    }];
    [self waitForExpectations:@[resetExpectation] timeout:20];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem: [self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testResetCloudKitZoneDuringWaitForTLK {
    self.silentZoneDeletesAllowed = true;

    // Test starts with nothing in database, but one in our fake CloudKit.
    // No TLK, though!
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self putFakeDeviceStatusInCloudKit:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    // No records should be uploaded
    [self addGenericPassword: @"data" account: @"account-delete-me"];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForTLK] wait:20*NSEC_PER_SEC], "CKKS should have entered waitfortlk");

    // Restart CKKS to really get in the spirit of waitfortlk (and get a pending processOutgoingQueue operation going)
    self.keychainView = [[CKKSViewManager manager] restartZone: self.keychainZoneID.zoneName];
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForTLK] wait:20*NSEC_PER_SEC], "CKKS entered waitfortlk");

    CKKSOutgoingQueueOperation* outgoingOp = [self.keychainView processOutgoingQueue:nil];
    XCTAssertTrue([outgoingOp isPending], "outgoing queue processing should be on hold");

    // Now, reset everything. The outgoingOp should get cancelled.
    // We expect a key hierarchy upload, and then the class C item upload
    [self expectCKModifyKeyRecords:3 currentKeyPointerRecords:3 tlkShareRecords:1 zoneID:self.keychainZoneID];
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID
                          checkItem: [self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];

    XCTestExpectation* resetExpectation = [self expectationWithDescription: @"reset callback occurs"];
    [self.injectedManager rpcResetCloudKit:nil reason:@"reset-test" reply:^(NSError* result) {
        XCTAssertNil(result, "no error resetting cloudkit");
        [resetExpectation fulfill];
    }];
    [self waitForExpectations:@[resetExpectation] timeout:20];

    XCTAssertTrue([outgoingOp isCancelled], "old stuck ProcessOutgoingQueue should be cancelled");
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    // And adding another item works too
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem: [self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

/*
 * This test doesn't work, since the resetLocal fails. CKKS gets back into waitfortlk
 * but that isn't considered a successful resetLocal.
 *
- (void)testResetLocalDuringWaitForTLK {
    // Test starts with nothing in database, but one in our fake CloudKit.
    // No TLK, though!
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    // No records should be uploaded
    [self addGenericPassword: @"data" account: @"account-delete-me"];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForTLK] wait:20*NSEC_PER_SEC], "CKKS should have entered waitfortlk");

    // Restart CKKS to really get in the spirit of waitfortlk (and get a pending processOutgoingQueue operation going)
    self.keychainView = [[CKKSViewManager manager] restartZone: self.keychainZoneID.zoneName];
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForTLK] wait:20*NSEC_PER_SEC], "CKKS entered waitfortlk");

    CKKSOutgoingQueueOperation* outgoingOp = [self.keychainView processOutgoingQueue:nil];
    XCTAssertTrue([outgoingOp isPending], "outgoing queue processing should be on hold");

    // Now, reset everything. The outgoingOp should get cancelled.
    // We expect a key hierarchy upload, and then the class C item upload
    [self expectCKModifyKeyRecords: 3 currentKeyPointerRecords: 3 tlkShareRecords:3 zoneID:self.keychainZoneID];
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID
                          checkItem: [self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];

    XCTestExpectation* resetExpectation = [self expectationWithDescription: @"reset callback occurs"];
    [self.injectedManager rpcResetLocal:nil reply:^(NSError* result) {
        XCTAssertNil(result, "no error resetting local");
        [resetExpectation fulfill];
    }];
    [self waitForExpectations:@[resetExpectation] timeout:20];

    XCTAssertTrue([outgoingOp isCancelled], "old stuck ProcessOutgoingQueue should be cancelled");
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    // And adding another item works too
    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem: [self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}*/

-(void)testResetCloudKitZoneWhileLoggedOut {
    self.silentZoneDeletesAllowed = true;

    // We're "logged in to" cloudkit but not in circle.
    self.circleStatus = [[SOSAccountStatus alloc] init:kSOSCCNotInCircle error:nil];;
    [self.accountStateTracker notifyCircleStatusChangeAndWaitForSignal];
    self.silentFetchesAllowed = false;

    // Test starts with nothing in database, but one in our fake CloudKit.
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    CKRecord* ckr = [self createFakeRecord: self.keychainZoneID recordName:@"7B598D31-F9C5-481E-98AC-5A507ACB2D85"];
    [self.keychainZone addToZone: ckr];

    XCTAssertNotNil(self.keychainZone.currentDatabase, "Zone exists");
    XCTAssertNotNil(self.keychainZone.currentDatabase[ckr.recordID], "An item exists in the fake zone");

    XCTestExpectation* resetExpectation = [self expectationWithDescription: @"reset callback occurs"];
    [self.injectedManager rpcResetCloudKit:nil reason:@"reset-test" reply:^(NSError* result) {
        XCTAssertNil(result, "no error resetting cloudkit");
        secnotice("ckks", "Received a resetCloudKit callback");
        [resetExpectation fulfill];
    }];
    [self waitForExpectations:@[resetExpectation] timeout:20];

    XCTAssertNil(self.keychainZone.currentDatabase, "No zone anymore!");
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    // Now log in, and see what happens! It should create the zone again and upload a whole new key hierarchy
    self.silentFetchesAllowed = true;
    self.circleStatus = [[SOSAccountStatus alloc] init:kSOSCCInCircle error:nil];;
    [self.accountStateTracker notifyCircleStatusChangeAndWaitForSignal];

    [self expectCKModifyKeyRecords: 3 currentKeyPointerRecords: 3 tlkShareRecords: 1 zoneID:self.keychainZoneID];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    [self expectCKModifyItemRecords: 1 currentKeyPointerRecords: 1 zoneID:self.keychainZoneID checkItem:[self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testResetCloudKitZoneMultipleTimes {
    self.silentZoneDeletesAllowed = true;

    // Test starts with nothing in database, but one in our fake CloudKit.
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];
    [self saveTLKMaterialToKeychainSimulatingSOS:self.keychainZoneID];

    // Spin up CKKS subsystem.
    [self startCKKSSubsystem];

    // We expect a single record to be uploaded
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready'");
    [self expectCKModifyItemRecords:1 currentKeyPointerRecords:1 zoneID:self.keychainZoneID
                          checkItem:[self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];
    [self addGenericPassword: @"data" account: @"account-delete-me"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    [self waitForCKModifications];

    // We're going to request a bunch of CloudKit resets, but hold them from finishing
    [self holdCloudKitFetches];

    XCTestExpectation* resetExpectation0 = [self expectationWithDescription: @"reset callback(0) occurs"];
    XCTestExpectation* resetExpectation1 = [self expectationWithDescription: @"reset callback(1) occurs"];
    XCTestExpectation* resetExpectation2 = [self expectationWithDescription: @"reset callback(2) occurs"];
    [self.injectedManager rpcResetCloudKit:nil reason:@"reset-test" reply:^(NSError* result) {
        XCTAssertNil(result, "should receive no error resetting cloudkit");
        secnotice("ckksreset", "Received a resetCloudKit(0) callback");
        [resetExpectation0 fulfill];
    }];
    [self.injectedManager rpcResetCloudKit:nil reason:@"reset-test" reply:^(NSError* result) {
        XCTAssertNil(result, "should receive no error resetting cloudkit");
        secnotice("ckksreset", "Received a resetCloudKit(1) callback");
        [resetExpectation1 fulfill];
    }];
    [self.injectedManager rpcResetCloudKit:nil reason:@"reset-test" reply:^(NSError* result) {
        XCTAssertNil(result, "should receive no error resetting cloudkit");
        secnotice("ckksreset", "Received a resetCloudKit(2) callback");
        [resetExpectation2 fulfill];
    }];

    // After the reset(s), we expect a key hierarchy upload, and then the class C item upload
    [self expectCKModifyKeyRecords:3 currentKeyPointerRecords:3 tlkShareRecords:1 zoneID:self.keychainZoneID];
    [self expectCKModifyItemRecords:1 currentKeyPointerRecords:1 zoneID:self.keychainZoneID
                          checkItem:[self checkClassCBlock:self.keychainZoneID message:@"Object was encrypted under class C key in hierarchy"]];

    // And let the resets flow
    [self releaseCloudKitFetchHold];
    [self waitForExpectations:@[resetExpectation0, resetExpectation1, resetExpectation2] timeout:20];
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready'");

    OCMVerifyAllWithDelay(self.mockDatabase, 20);

    [self expectCKModifyItemRecords:1 currentKeyPointerRecords:1 zoneID:self.keychainZoneID
                          checkItem:[self checkClassABlock:self.keychainZoneID message:@"Object was encrypted under class A key in hierarchy"]];
    [self addGenericPassword:@"asdf"
                     account:@"account-class-A"
                    viewHint:nil
                      access:(id)kSecAttrAccessibleWhenUnlocked
                   expecting:errSecSuccess
                     message:@"Adding class A item"];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRPCFetchAndProcessWhileCloudKitNotResponding {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready'");
    [self holdCloudKitFetches];

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];
    [self.ckksControl rpcFetchAndProcessChanges:nil reply:^(NSError * _Nullable error) {
        // done! we should have an underlying error of "fetch isn't working"
        XCTAssertNotNil(error, "Should have received an error attempting to fetch and process");
        NSError* underlying = error.userInfo[NSUnderlyingErrorKey];
        XCTAssertNotNil(underlying, "Should have received an underlying error");
        XCTAssertEqualObjects(underlying.domain, CKKSResultDescriptionErrorDomain, "Underlying error should be CKKSResultDescriptionErrorDomain");
        XCTAssertEqual(underlying.code, CKKSResultDescriptionPendingSuccessfulFetch, "Underlying error should be 'pending fetch'");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];
    [self releaseCloudKitFetchHold];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRPCFetchAndProcessWhileCloudKitErroring {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready'");

    [self.keychainZone failNextFetchWith:[[CKPrettyError alloc] initWithDomain:CKErrorDomain
                                                                          code:CKErrorRequestRateLimited
                                                                      userInfo:@{CKErrorRetryAfterKey : [NSNumber numberWithInt:30]}]];

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];
    [self.ckksControl rpcFetchAndProcessChanges:nil reply:^(NSError * _Nullable error) {
        // done! we should have an underlying error of "fetch isn't working"
        XCTAssertNotNil(error, "Should have received an error attempting to fetch and process");
        NSError* underlying = error.userInfo[NSUnderlyingErrorKey];
        XCTAssertNotNil(underlying, "Should have received an underlying error");
        XCTAssertEqualObjects(underlying.domain, CKKSResultDescriptionErrorDomain, "Underlying error should be CKKSResultDescriptionErrorDomain");
        XCTAssertEqual(underlying.code, CKKSResultDescriptionPendingSuccessfulFetch, "Underlying error should be 'pending fetch'");

        NSError* underunderlying = underlying.userInfo[NSUnderlyingErrorKey];
        XCTAssertNotNil(underunderlying, "Should have received another layer of underlying error");
        XCTAssertEqualObjects(underunderlying.domain, CKErrorDomain, "Underlying error should be CKErrorDomain");
        XCTAssertEqual(underunderlying.code, CKErrorRequestRateLimited, "Underlying error should be 'rate limited'");

        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRPCFetchAndProcessWhileInWaitForTLK {
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self putFakeDeviceStatusInCloudKit:self.keychainZoneID];
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForTLK] wait:20*NSEC_PER_SEC], "CKKS entered waitfortlk");

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];
    [self.ckksControl rpcFetchAndProcessChanges:nil reply:^(NSError * _Nullable error) {
        // done! we should have an underlying error of "fetch isn't working"
        XCTAssertNotNil(error, "Should have received an error attempting to fetch and process");
        NSError* underlying = error.userInfo[NSUnderlyingErrorKey];
        XCTAssertNotNil(underlying, "Should have received an underlying error");
        XCTAssertEqualObjects(underlying.domain, CKKSResultDescriptionErrorDomain, "Underlying error should be CKKSResultDescriptionErrorDomain");
        XCTAssertEqual(underlying.code, CKKSResultDescriptionPendingKeyReady, "Underlying error should be 'pending key ready'");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRPCTLKMissingWhenMissing {
    // Bring CKKS up in waitfortlk
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self putFakeDeviceStatusInCloudKit:self.keychainZoneID];
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForTLK] wait:20*NSEC_PER_SEC], "CKKS entered waitfortlk");

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];

    [self.ckksControl rpcTLKMissing:@"keychain" reply:^(bool missing) {
        XCTAssertTrue(missing, "TLKs should be missing");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRPCTLKMissingWhenFound {
    // Bring CKKS up in 'ready'
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self saveTLKMaterialToKeychain:self.keychainZoneID];
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready''");

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];

    [self.ckksControl rpcTLKMissing:@"keychain" reply:^(bool missing) {
        XCTAssertFalse(missing, "TLKs should not be missing");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRPCKnownBadStateWhenTLKsMissing {
    // Bring CKKS up in waitfortlk
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self putFakeDeviceStatusInCloudKit:self.keychainZoneID];
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForTLK] wait:20*NSEC_PER_SEC], "CKKS entered waitfortlk");

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];

    [self.ckksControl rpcKnownBadState:@"keychain" reply:^(CKKSKnownBadState result) {
        XCTAssertEqual(result, CKKSKnownStateTLKsMissing, "TLKs should be missing");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRPCKnownBadStateWhenInWaitForUnlock {
    // Bring CKKS up in 'waitfortunlok'
    self.aksLockState = true;
    [self.lockStateTracker recheck];
    [self startCKKSSubsystem];

    // Wait for the key hierarchy state machine to get stuck waiting for the unlock dependency. No uploads should occur.
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateWaitForUnlock] wait:20*NSEC_PER_SEC], @"Key state should get stuck in waitforunlock");

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];

    [self.ckksControl rpcKnownBadState:@"keychain" reply:^(CKKSKnownBadState result) {
        XCTAssertEqual(result, CKKSKnownStateWaitForUnlock, "known state should be wait for unlock");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}


- (void)testRPCKnownBadStateWhenInGoodState {
    // Bring CKKS up in 'ready'
    [self putFakeKeyHierarchyInCloudKit:self.keychainZoneID];
    [self saveTLKMaterialToKeychain:self.keychainZoneID];
    [self expectCKKSTLKSelfShareUpload:self.keychainZoneID];
    [self startCKKSSubsystem];

    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "CKKS entered 'ready''");

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];

    [self.ckksControl rpcKnownBadState:@"keychain" reply:^(CKKSKnownBadState result) {
        XCTAssertEqual(result, CKKSKnownStatePossiblyGood, "known state should not be possibly-good");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];

    OCMVerifyAllWithDelay(self.mockDatabase, 20);
}

- (void)testRpcStatus {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];

    // Let things shake themselves out.
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "Key state should return to 'ready'");
    [self waitForCKModifications];

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];
    [self.ckksControl rpcStatus:@"keychain" reply:^(NSArray<NSDictionary*>* result, NSError* error) {
        XCTAssertNil(error, "should be no error fetching status for keychain");

        // Ugly "global" hack
        XCTAssertEqual(result.count, 2u, "Should have received two result dictionaries back");
        NSDictionary* keychainStatus = result[1];

        XCTAssertNotNil(keychainStatus, "Should have received at least one zone status back");
        XCTAssertEqualObjects(keychainStatus[@"view"], @"keychain", "Should have received status for the keychain view");
        XCTAssertEqualObjects(keychainStatus[@"keystate"], SecCKKSZoneKeyStateReady, "Should be in 'ready' status");
        XCTAssertNotNil(keychainStatus[@"ckmirror"], "Status should have any ckmirror");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];
}

- (void)testRpcFastStatus {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    [self startCKKSSubsystem];

    // Let things shake themselves out.
    OCMVerifyAllWithDelay(self.mockDatabase, 20);
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "Key state should return to 'ready'");
    [self waitForCKModifications];

    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];
    [self.ckksControl rpcFastStatus:@"keychain" reply:^(NSArray<NSDictionary*>* result, NSError* error) {
        XCTAssertNil(error, "should be no error fetching status for keychain");

        // Ugly "global" hack
        XCTAssertEqual(result.count, 1u, "Should have received one result dictionaries back");
        NSDictionary* keychainStatus = result[0];

        XCTAssertNotNil(keychainStatus, "Should have received at least one zone status back");
        XCTAssertEqualObjects(keychainStatus[@"view"], @"keychain", "Should have received status for the keychain view");
        XCTAssertEqualObjects(keychainStatus[@"keystate"], SecCKKSZoneKeyStateReady, "Should be in 'ready' status");
        XCTAssertNil(keychainStatus[@"ckmirror"], "fastStatus should not have any ckmirror");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];
}


- (void)testRpcStatusWaitsForAccountDetermination {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    // Set up the account state callbacks to happen in one second
    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (1 * NSEC_PER_SEC)), dispatch_get_global_queue(QOS_CLASS_DEFAULT, 0), ^{
        // Let CKKS come up (simulating daemon starting due to RPC)
        [self startCKKSSubsystem];
    });

    // Before CKKS figures out we're in an account, fire off the status RPC.
    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];
    [self.ckksControl rpcStatus:@"keychain" reply:^(NSArray<NSDictionary*>* result, NSError* error) {
        XCTAssertNil(error, "should be no error fetching status for keychain");

        // Ugly "global" hack
        XCTAssertEqual(result.count, 2u, "Should have received two result dictionaries back");
        NSDictionary* keychainStatus = result[1];

        XCTAssertNotNil(keychainStatus, "Should have received at least one zone status back");
        XCTAssertEqualObjects(keychainStatus[@"view"], @"keychain", "Should have received status for the keychain view");
        XCTAssertEqualObjects(keychainStatus[@"keystate"], SecCKKSZoneKeyStateReady, "Should be in 'ready' status");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];
}

- (void)testRpcStatusIsFastDuringError {
    [self createAndSaveFakeKeyHierarchy: self.keychainZoneID]; // Make life easy for this test.

    self.keychainFetchError = [NSError errorWithDomain:NSOSStatusErrorDomain code:errSecInternalError description:@"injected keychain failure"];

    // Let CKKS come up; it should enter 'error'
    [self startCKKSSubsystem];
    XCTAssertEqual(0, [self.keychainView.keyHierarchyConditions[SecCKKSZoneKeyStateError] wait:20*NSEC_PER_SEC], "CKKS entered 'error'");

    // Fire off the status RPC; it should return immediately
    XCTestExpectation* callbackOccurs = [self expectationWithDescription:@"callback-occurs"];
    [self.ckksControl rpcStatus:@"keychain" reply:^(NSArray<NSDictionary*>* result, NSError* error) {
        XCTAssertNil(error, "should be no error fetching status for keychain");

        // Ugly "global" hack
        XCTAssertEqual(result.count, 2u, "Should have received two result dictionaries back");
        NSDictionary* keychainStatus = result[1];

        XCTAssertNotNil(keychainStatus, "Should have received at least one zone status back");
        XCTAssertEqualObjects(keychainStatus[@"view"], @"keychain", "Should have received status for the keychain view");
        XCTAssertEqualObjects(keychainStatus[@"keystate"], SecCKKSZoneKeyStateError, "Should be in 'ready' status");
        [callbackOccurs fulfill];
    }];

    [self waitForExpectations:@[callbackOccurs] timeout:20];
}

@end

#endif // OCTAGON
