function_tests.c

/***
Copyright 2010-2026 by Omar Alejandro Herrera Reyna

    Caume Data Security Engine, also known as CaumeDSE is released under the
    GNU General Public License by the Copyright holder, with the additional
    exemption that compiling, linking, and/or using OpenSSL is allowed.

    LICENSE

    This file is part of Caume Data Security Engine, also called CaumeDSE.

    CaumeDSE is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    CaumeDSE is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with CaumeDSE.  If not, see <http://www.gnu.org/licenses/>.

    INCLUDED SOFTWARE

    This product includes software developed by the OpenSSL Project
    for use in the OpenSSL Toolkit (http://www.openssl.org/).
    This product includes cryptographic software written by
    Eric Young (eay@cryptsoft.com).
    This product includes software written by
    Tim Hudson (tjh@cryptsoft.com).

    This product includes software from the SQLite library that is in
    the public domain (http://www.sqlite.org/copyright.html).

    This product includes software from the GNU Libmicrohttpd project, Copyright
    © 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
    2008, 2009, 2010 , 2011, 2012 Free Software Foundation, Inc.

    This product includes software from Perl5, which is Copyright (C) 1993-2005,
    by Larry Wall and others.

***/
#include "common.h"
#if CDSE_ENABLE_HERRADURAKEX && HAVE_HERRADURA_H
#if defined(__GNUC__)
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wunused-function"
#pragma GCC diagnostic ignored "-Wunused-variable"
#endif
#include <herradura.h>
#if defined(__GNUC__)
#pragma GCC diagnostic pop
#endif
#endif

void testContentRows(void);
void testContentColumns(void);
void testDBBrowsing(void);
void testParserTempFiles(void);
void testInternalDBSchemaVersioning(void);
void testSecureDBTamperFixtures(void);

static int cmeDebugTestsNonInteractiveEnabled(void)
{
    const char *env = getenv("CDSE_DEBUG_TESTS_NONINTERACTIVE");
    return (env && *env && strcmp(env,"0"));
}

static void cmeTestPrintMarker(const char *marker)
{
    const char *current;
    size_t remaining;
    ssize_t written;

    if (marker)
    {
        fflush(stdout);
        current=marker;
        remaining=strlen(marker);
        while (remaining)
        {
            written=write(STDOUT_FILENO,current,remaining);
            if (written<=0)
            {
                break;
            }
            current+=written;
            remaining-=written;
        }
        fflush(stdout);
    }
}

static int cmeTestSuppressStderrBegin(int *savedStderr)
{
    int nullFd;

    fflush(stderr);
    *savedStderr=dup(STDERR_FILENO);
    if (*savedStderr<0)
    {
        return(1);
    }
    nullFd=open("/dev/null",O_WRONLY);
    if (nullFd<0)
    {
        close(*savedStderr);
        *savedStderr=-1;
        return(2);
    }
    if (dup2(nullFd,STDERR_FILENO)<0)
    {
        close(nullFd);
        close(*savedStderr);
        *savedStderr=-1;
        return(3);
    }
    close(nullFd);
    return(0);
}

static void cmeTestSuppressStderrEnd(int savedStderr)
{
    if (savedStderr>=0)
    {
        fflush(stderr);
        dup2(savedStderr,STDERR_FILENO);
        close(savedStderr);
    }
}

static char *cmeTestPath(const char *relativePath)
{
    char *result = NULL;
    cmeStrConstrAppend(&result, "%s%s", cmeDefaultFilePath, relativePath);
    return result;
}

static int aes_gcm_encrypt(const unsigned char *plaintext, int plaintext_len,
                           const unsigned char *aad, int aad_len,
                           const unsigned char *key, const unsigned char *iv,
                           int iv_len, unsigned char *ciphertext,
                           unsigned char *tag)
{
    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
    int len = 0, ciphertext_len = 0;
    if (!ctx)
        return -1;
    if (!EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
        goto err;
    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, NULL))
        goto err;
    if (!EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv))
        goto err;
    if (aad && aad_len)
        if (!EVP_EncryptUpdate(ctx, NULL, &len, aad, aad_len))
            goto err;
    if (!EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
        goto err;
    ciphertext_len = len;
    if (!EVP_EncryptFinal_ex(ctx, ciphertext + len, &len))
        goto err;
    ciphertext_len += len;
    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, tag))
        goto err;
    EVP_CIPHER_CTX_free(ctx);
    return ciphertext_len;
err:
    EVP_CIPHER_CTX_free(ctx);
    return -1;
}

static int aes_gcm_decrypt(const unsigned char *ciphertext, int ciphertext_len,
                           const unsigned char *aad, int aad_len,
                           const unsigned char *tag,
                           const unsigned char *key, const unsigned char *iv,
                           int iv_len, unsigned char *plaintext)
{
    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
    int len = 0, plaintext_len = 0, ret = -1;
    if (!ctx)
        return -1;
    if (!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
        goto err;
    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, NULL))
        goto err;
    if (!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv))
        goto err;
    if (aad && aad_len)
        if (!EVP_DecryptUpdate(ctx, NULL, &len, aad, aad_len))
            goto err;
    if (!EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
        goto err;
    plaintext_len = len;
    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, (void *)tag))
        goto err;
    ret = EVP_DecryptFinal_ex(ctx, plaintext + len, &len);
    if (ret > 0)
    {
        plaintext_len += len;
        ret = plaintext_len;
    }
    else
        ret = -1;
err:
    EVP_CIPHER_CTX_free(ctx);
    return ret;
}

#if CDSE_ENABLE_HERRADURAKEX && HAVE_HERRADURA_H
static void cmeTestHerraduraFillKey(BitArray *key)
{
    int cont;

    for (cont=0; cont<KEYBYTES; cont++)
    {
        key->b[cont]=(uint8_t)(0x10+cont*3);
    }
}

static void cmeTestHerraduraFillNonce(BitArray *nonce)
{
    int cont;

    for (cont=0; cont<KEYBYTES; cont++)
    {
        nonce->b[cont]=(uint8_t)(0xa0-cont*5);
    }
}

static void cmeTestHerraduraFillPlaintext(uint8_t *plaintext, size_t len)
{
    size_t cont;

    for (cont=0; cont<len; cont++)
    {
        plaintext[cont]=(uint8_t)((cont*7+3)&0xff);
    }
}

static int cmeTestHerraduraRoundTripSize(size_t len, int duplex)
{
    BitArray key;
    BitArray nonce;
    const uint8_t aad[]="cdse-independent-hkx-test-aad-v1";
    uint8_t *plaintext=NULL;
    uint8_t *ciphertext=NULL;
    uint8_t *decrypted=NULL;
    uint8_t tag[KEYBYTES];
    int result=1;

    plaintext=(uint8_t *)malloc(len ? len : 1);
    ciphertext=(uint8_t *)malloc(len ? len : 1);
    decrypted=(uint8_t *)malloc(len ? len : 1);
    if (!plaintext || !ciphertext || !decrypted)
    {
        result=0;
    }
    else
    {
        cmeTestHerraduraFillKey(&key);
        cmeTestHerraduraFillNonce(&nonce);
        cmeTestHerraduraFillPlaintext(plaintext,len);
        memset(ciphertext,0,len ? len : 1);
        memset(decrypted,0,len ? len : 1);
        memset(tag,0,sizeof(tag));
        if (duplex)
        {
            hske_nl_v2_duplex_encrypt(&key,&nonce,aad,sizeof(aad)-1,
                                      plaintext,len,ciphertext,tag);
            result=hske_nl_v2_duplex_decrypt(&key,&nonce,aad,sizeof(aad)-1,
                                             ciphertext,len,tag,decrypted);
        }
        else
        {
            hske_nl_aead_encrypt(&key,&nonce,aad,sizeof(aad)-1,
                                 plaintext,len,ciphertext,tag);
            result=hske_nl_aead_decrypt(&key,&nonce,aad,sizeof(aad)-1,
                                        ciphertext,len,tag,decrypted);
        }
        result=(result && !memcmp(plaintext,decrypted,len));
    }
    if (plaintext)
    {
        OPENSSL_cleanse(plaintext,len ? len : 1);
    }
    if (ciphertext)
    {
        OPENSSL_cleanse(ciphertext,len ? len : 1);
    }
    if (decrypted)
    {
        OPENSSL_cleanse(decrypted,len ? len : 1);
    }
    OPENSSL_cleanse(tag,sizeof(tag));
    cmeFree(plaintext);
    cmeFree(ciphertext);
    cmeFree(decrypted);
    return(result);
}
#endif

void testHerraduraIndependent(void)
{
#if CDSE_ENABLE_HERRADURAKEX && HAVE_HERRADURA_H
    static const uint8_t expectedNLA1Ciphertext97[] = {
        0x57,0x93,0x3c,0xf5,0x30,0xee,0x9f,0xab,0xbc,0xab,0x39,0xc9,0xe5,0x59,0xf0,0x25,
        0xb4,0x40,0xaa,0x54,0x0e,0xae,0x56,0x68,0xfd,0x01,0xd8,0xdc,0xa6,0x33,0xdc,0xf7,
        0xe6,0xda,0xeb,0x5b,0x9f,0x10,0x81,0x93,0x28,0x5d,0x71,0x97,0x10,0x45,0xe6,0x6e,
        0x5c,0x2c,0x6c,0x3a,0x24,0xd0,0x51,0x18,0x46,0xbd,0x08,0x8c,0xf3,0xa4,0x12,0x8f,
        0x97,0xb2,0x58,0x65,0x20,0xc9,0x64,0x25,0x97,0xbe,0x1e,0x67,0x7c,0x32,0x7b,0x1a,
        0xe3,0xb7,0x01,0x8a,0x90,0xcd,0xad,0x7f,0x03,0xab,0x69,0xe8,0x5a,0x83,0xfb,0xc4,
        0xe6
    };
    static const uint8_t expectedNLA1Tag97[KEYBYTES] = {
        0x6e,0x80,0x58,0xb3,0x8d,0xb2,0xad,0x25,0x68,0x5c,0xfe,0x3f,0xbf,0xcc,0x9d,0xa9,
        0xf4,0x04,0xc3,0x65,0x70,0xd4,0x77,0xac,0x8f,0xb1,0x7c,0x16,0x2d,0x1c,0x72,0x90
    };
    static const uint8_t expectedNLA1Tag0[KEYBYTES] = {
        0xaa,0xe5,0x10,0xae,0x49,0x9a,0x6a,0xd7,0xd3,0x7b,0x13,0xb2,0xf8,0x19,0x48,0xeb,
        0x99,0x1b,0x2b,0x10,0x43,0xeb,0xc9,0xda,0xd0,0x9b,0x94,0xb7,0x37,0x47,0x95,0xaa
    };
    static const uint8_t expectedDuplexCiphertext97[] = {
        0x4a,0x29,0xab,0x1a,0x92,0x62,0xe8,0xfd,0x7a,0x43,0x28,0xcb,0x27,0xaf,0xec,0x50,
        0xd0,0xb2,0x3d,0xae,0x48,0x87,0x53,0xe1,0xf8,0x01,0x86,0xa0,0xa6,0x36,0xd7,0xe8,
        0xfb,0x3d,0x5d,0xdd,0x9c,0x44,0xa8,0xf6,0x6f,0xf1,0xee,0x7f,0x61,0x02,0x2c,0xf2,
        0x39,0x42,0x50,0x9b,0x69,0x5f,0x38,0xe2,0x07,0xfc,0xf3,0x45,0xbf,0xeb,0xc1,0x3f,
        0xc1,0xc5,0x08,0x3f,0xe6,0xc4,0x90,0xb0,0xc1,0xcf,0x20,0xf8,0x7c,0x1b,0xab,0xa7,
        0x46,0x3d,0x52,0x53,0x44,0xf0,0xca,0x5b,0x92,0x10,0x6a,0x48,0x73,0x2f,0x76,0x46,
        0x5b
    };
    static const uint8_t expectedDuplexTag97[KEYBYTES] = {
        0x7d,0x8d,0x43,0x5a,0x21,0xc9,0xea,0xd0,0xac,0x6f,0x63,0x27,0x26,0x49,0x54,0x54,
        0x4e,0xab,0x75,0x60,0xab,0xb6,0x18,0x25,0xa5,0x69,0x32,0xdd,0x5d,0x15,0xee,0x6a
    };
    static const uint8_t expectedDuplexTag0[KEYBYTES] = {
        0xed,0x9b,0x82,0x2d,0xcd,0x7e,0xfa,0xd2,0xaa,0x35,0xa5,0xae,0x90,0xcf,0x0f,0x68,
        0x31,0x35,0x3f,0x56,0x28,0x4b,0xbc,0x1c,0xfe,0x36,0x5d,0x40,0x7f,0x0b,0xb8,0x83
    };
    static const uint8_t expectedHFSCX97[KEYBYTES] = {
        0x00,0xd7,0xb4,0xd2,0xc7,0x03,0x91,0xc5,0x5c,0xba,0x49,0x7f,0xac,0xa5,0xa9,0x5a,
        0xb7,0x2c,0x87,0x46,0x08,0x9e,0x15,0xbc,0x20,0x3f,0x92,0x21,0xdd,0x04,0xd7,0xd3
    };
    static const uint8_t expectedHFSCXDS97[KEYBYTES] = {
        0xd1,0xa6,0x60,0x9d,0xc1,0xb3,0xf1,0x0e,0xe0,0x0e,0xb9,0xee,0x30,0x7f,0xd2,0x08,
        0x59,0x47,0x10,0x63,0xe3,0x8c,0x84,0x6d,0xb7,0x3d,0x50,0xf6,0x15,0x28,0x5c,0xb1
    };
    static const size_t sizes[] = {0,1,16,32,33,97,4097};
    BitArray key;
    BitArray nonce;
    BitArray wrongKey;
    BitArray wrongNonce;
    const uint8_t aad[]="cdse-independent-hkx-test-aad-v1";
    const uint8_t wrongAad[]="cdse-independent-hkx-test-aad-v2";
    uint8_t plaintext[97];
    uint8_t ciphertext[97];
    uint8_t decrypted[97];
    uint8_t tag[KEYBYTES];
    uint8_t hash[KEYBYTES];
    uint8_t tamperedCiphertext[97];
    uint8_t tamperedTag[KEYBYTES];
    size_t cont;
    int allSizesOk=1;
    int negativeOk=1;

    cmeTestHerraduraFillKey(&key);
    cmeTestHerraduraFillNonce(&nonce);
    cmeTestHerraduraFillPlaintext(plaintext,sizeof(plaintext));

    hske_nl_aead_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,sizeof(plaintext),ciphertext,tag);
    if (!memcmp(ciphertext,expectedNLA1Ciphertext97,sizeof(expectedNLA1Ciphertext97)) &&
        !memcmp(tag,expectedNLA1Tag97,sizeof(expectedNLA1Tag97)) &&
        hske_nl_aead_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
        !memcmp(plaintext,decrypted,sizeof(plaintext)))
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HSKE-NL-A1 AEAD known-answer vector matches.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HSKE-NL-A1 AEAD known-answer vector mismatch.\n");
    }

    hske_nl_v2_duplex_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,sizeof(plaintext),ciphertext,tag);
    if (!memcmp(ciphertext,expectedDuplexCiphertext97,sizeof(expectedDuplexCiphertext97)) &&
        !memcmp(tag,expectedDuplexTag97,sizeof(expectedDuplexTag97)) &&
        hske_nl_v2_duplex_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
        !memcmp(plaintext,decrypted,sizeof(plaintext)))
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HSKE duplex known-answer vector matches.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HSKE duplex known-answer vector mismatch.\n");
    }

    hske_nl_aead_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,0,ciphertext,tag);
    if (!memcmp(tag,expectedNLA1Tag0,sizeof(expectedNLA1Tag0)) &&
        hske_nl_aead_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,0,tag,decrypted))
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HSKE-NL-A1 AEAD empty-plaintext vector matches.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HSKE-NL-A1 AEAD empty-plaintext vector mismatch.\n");
    }

    hske_nl_v2_duplex_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,0,ciphertext,tag);
    if (!memcmp(tag,expectedDuplexTag0,sizeof(expectedDuplexTag0)) &&
        hske_nl_v2_duplex_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,0,tag,decrypted))
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HSKE duplex empty-plaintext vector matches.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HSKE duplex empty-plaintext vector mismatch.\n");
    }

    for (cont=0; cont<(sizeof(sizes)/sizeof(sizes[0])); cont++)
    {
        allSizesOk=(allSizesOk &&
                    cmeTestHerraduraRoundTripSize(sizes[cont],0) &&
                    cmeTestHerraduraRoundTripSize(sizes[cont],1));
    }
    if (allSizesOk)
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HSKE direct APIs round trip fixed boundary sizes.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HSKE direct APIs boundary-size round trip failed.\n");
    }

    hske_nl_aead_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,sizeof(plaintext),ciphertext,tag);
    memcpy(tamperedCiphertext,ciphertext,sizeof(tamperedCiphertext));
    memcpy(tamperedTag,tag,sizeof(tamperedTag));
    wrongKey=key;
    wrongNonce=nonce;
    wrongKey.b[0]^=0x01;
    wrongNonce.b[0]^=0x01;
    tamperedCiphertext[0]^=0x01;
    tamperedTag[0]^=0x01;
    negativeOk=(negativeOk &&
                !hske_nl_aead_decrypt(&wrongKey,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
                !hske_nl_aead_decrypt(&key,&wrongNonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
                !hske_nl_aead_decrypt(&key,&nonce,wrongAad,sizeof(wrongAad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
                !hske_nl_aead_decrypt(&key,&nonce,aad,sizeof(aad)-1,tamperedCiphertext,sizeof(tamperedCiphertext),tag,decrypted) &&
                !hske_nl_aead_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tamperedTag,decrypted));

    hske_nl_v2_duplex_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,sizeof(plaintext),ciphertext,tag);
    memcpy(tamperedCiphertext,ciphertext,sizeof(tamperedCiphertext));
    memcpy(tamperedTag,tag,sizeof(tamperedTag));
    tamperedCiphertext[0]^=0x01;
    tamperedTag[0]^=0x01;
    negativeOk=(negativeOk &&
                !hske_nl_v2_duplex_decrypt(&wrongKey,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
                !hske_nl_v2_duplex_decrypt(&key,&wrongNonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
                !hske_nl_v2_duplex_decrypt(&key,&nonce,wrongAad,sizeof(wrongAad)-1,ciphertext,sizeof(ciphertext),tag,decrypted) &&
                !hske_nl_v2_duplex_decrypt(&key,&nonce,aad,sizeof(aad)-1,tamperedCiphertext,sizeof(tamperedCiphertext),tag,decrypted) &&
                !hske_nl_v2_duplex_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tamperedTag,decrypted));
    hske_nl_aead_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,sizeof(plaintext),ciphertext,tag);
    negativeOk=(negativeOk &&
                !hske_nl_v2_duplex_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted));
    hske_nl_v2_duplex_encrypt(&key,&nonce,aad,sizeof(aad)-1,plaintext,sizeof(plaintext),ciphertext,tag);
    negativeOk=(negativeOk &&
                !hske_nl_aead_decrypt(&key,&nonce,aad,sizeof(aad)-1,ciphertext,sizeof(ciphertext),tag,decrypted));
    if (negativeOk)
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HSKE direct APIs reject mutated auth inputs and wrong profile selection.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HSKE direct APIs accepted mutated auth input or wrong profile selection.\n");
    }

    hfscx_256(plaintext,sizeof(plaintext),NULL,hash);
    if (!memcmp(hash,expectedHFSCX97,sizeof(expectedHFSCX97)))
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HFSCX-256 known-answer vector matches.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HFSCX-256 known-answer vector mismatch.\n");
    }
    hfscx_256_ds(0x03,plaintext,sizeof(plaintext),NULL,hash);
    if (!memcmp(hash,expectedHFSCXDS97,sizeof(expectedHFSCXDS97)))
    {
        printf("TESTS: testHerraduraIndependent(), PASS: HFSCX-256-DS known-answer vector matches.\n");
    }
    else
    {
        printf("TESTS: testHerraduraIndependent(), FAIL: HFSCX-256-DS known-answer vector mismatch.\n");
    }
#else
    printf("TESTS: testHerraduraIndependent(), SKIP: HerraduraKEx provider is not compiled in.\n");
#endif
}

void testCryptoSymmetric(unsigned char *bufIn, unsigned char *bufOut)
{
    int cont,cont2,written,ctSize,result __attribute__((unused));
    unsigned char password[10]= "Password";
    unsigned char cleartext[] = "This is cleartext This is cleartext This is cleartext This is cleartext.\n";
    const char *algorithm = cmeOpenSSLLegacyStorageProfile;
    unsigned char *key=NULL;
    unsigned char *iv=NULL;
    unsigned char *expectedKeyIv=NULL;
    unsigned char *ciphertext=NULL;
    unsigned char *deciphertext=NULL;
    unsigned char *salt=NULL;
    unsigned char *legacySaltHex=NULL;
    unsigned char *legacyDeciphertext=NULL;
    FILE *fp=NULL;
    EVP_CIPHER_CTX *ctx=NULL;
    const EVP_CIPHER *cipher=NULL;
    int keyLen=0;
    int ivLen=0;
    cmeCryptoProfile cryptoProfile;

    key=(unsigned char *)malloc(1024);
    iv=(unsigned char *)malloc(1024);
    ciphertext=(unsigned char *)malloc(1024);
    expectedKeyIv=(unsigned char *)malloc(1024);

    if (!cmeGetCryptoProfile(&cryptoProfile,cmeDefaultEncAlg) &&
        cryptoProfile.implemented && cryptoProfile.allowedAsDefault)
    {
        printf("TESTS: testCryptoSymmetric(), PASS: default storage crypto profile resolved.\n");
    }
    else
    {
        printf("TESTS: testCryptoSymmetric(), FAIL: default storage crypto profile not resolved.\n");
    }
    if (!cmeGetCryptoProfile(&cryptoProfile,cmeHerraduraKExProfileHSKENLA1AEAD256) &&
        cryptoProfile.provider==cmeCryptoProviderHerraduraKEx &&
        cryptoProfile.keyLen==32 && cryptoProfile.nonceLen==32 &&
        cryptoProfile.tagLen==32 && cryptoProfile.isAEAD &&
        cryptoProfile.frameVersion==cmeCryptoFrameHerraduraKExV1 &&
        cryptoProfile.implemented==cmeUseHerraduraKEx &&
        cryptoProfile.allowedAsDefault==cmeUseHerraduraKEx)
    {
        printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE-NL-A1 AEAD storage profile metadata resolved.\n");
    }
    else
    {
        printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE-NL-A1 AEAD storage profile metadata mismatch.\n");
    }
    if (cmeCryptoAlgorithmIsImplemented(cmeHerraduraKExProfileHSKENLA1AEAD256)==cmeUseHerraduraKEx)
    {
        printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx implementation availability follows build flag.\n");
    }
    else
    {
        printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx implementation availability mismatch.\n");
    }
    if (!cmeUseHerraduraKEx)
    {
        unsigned char *hkxCiphertext=NULL;
        unsigned char *hkxSalt=NULL;
        int hkxWritten=0;
        if (cmeCipherByteString(cleartext,&hkxCiphertext,&hkxSalt,strlen((char *)cleartext),
                                &hkxWritten,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                "Password",'e'))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx profile rejects encryption when provider is not compiled in.\n");
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx profile encrypted without provider support.\n");
        }
        cmeFree(hkxCiphertext);
        cmeFree(hkxSalt);
    }
    else
    {
        unsigned char *hkxCiphertext=NULL;
        unsigned char *hkxPlaintext=NULL;
        unsigned char *hkxSalt=NULL;
        int hkxCiphertextLen=0;
        int hkxPlaintextLen=0;
        int hkxTamperResult=0;
        unsigned char *hkxTampered=NULL;
        unsigned char *hkxWrongSalt=NULL;
        unsigned char *aesCiphertext=NULL;
        unsigned char *aesPlaintext=NULL;
        unsigned char *aesSalt=NULL;
        int aesCiphertextLen=0;
        int aesPlaintextLen=0;
        if (!cmeCipherByteString(cleartext,&hkxCiphertext,&hkxSalt,strlen((char *)cleartext),
                                 &hkxCiphertextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                 "Password",'e') &&
            !cmeCipherByteString(hkxCiphertext,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                 &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                 "Password",'d') &&
            hkxPlaintextLen==(int)strlen((char *)cleartext) &&
            !memcmp(hkxPlaintext,cleartext,hkxPlaintextLen))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE-NL-A1 AEAD profile round trip.\n");
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE-NL-A1 AEAD profile round trip failed.\n");
        }
        cmeFree(hkxPlaintext);
        hkxPlaintext=NULL;
        hkxPlaintextLen=0;
        if (hkxCiphertext &&
            !cmeCipherByteString(hkxCiphertext,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                 &hkxPlaintextLen,cmeOpenSSLLegacyStorageProfile,
                                 "Password",'d') &&
            hkxPlaintextLen==(int)strlen((char *)cleartext) &&
            !memcmp(hkxPlaintext,cleartext,hkxPlaintextLen))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx frame decrypts via embedded profile metadata.\n");
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx frame metadata decrypt failed.\n");
        }
        cmeFree(hkxPlaintext);
        hkxPlaintext=NULL;
        hkxPlaintextLen=0;
        if (hkxCiphertext &&
            cmeCipherByteString(hkxCiphertext,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                "WrongPassword",'d'))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE-NL-A1 AEAD rejects wrong key.\n");
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE-NL-A1 AEAD accepted wrong key.\n");
        }
        cmeFree(hkxPlaintext);
        hkxPlaintext=NULL;
        hkxPlaintextLen=0;
        if (hkxSalt)
        {
            cmeStrConstrAppend((char **)&hkxWrongSalt,"%s",hkxSalt);
            hkxWrongSalt[0]=(hkxWrongSalt[0]=='0') ? '1' : '0';
        }
        if (hkxCiphertext && hkxWrongSalt &&
            cmeCipherByteString(hkxCiphertext,&hkxPlaintext,&hkxWrongSalt,hkxCiphertextLen,
                                &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                "Password",'d'))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE-NL-A1 AEAD rejects wrong salt.\n");
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE-NL-A1 AEAD accepted wrong salt.\n");
        }
        cmeFree(hkxPlaintext);
        hkxPlaintext=NULL;
        hkxPlaintextLen=0;
        if (hkxCiphertext && hkxCiphertextLen>cmeHerraduraKExFrameHeaderLen)
        {
            hkxTampered=(unsigned char *)malloc(hkxCiphertextLen);
            memcpy(hkxTampered,hkxCiphertext,hkxCiphertextLen);
            hkxTampered[cmeHerraduraKExFrameMagicLen+2+cmeHerraduraKExNonceLen] ^= 0x01;
            cmeFree(hkxPlaintext);
            hkxTamperResult=cmeCipherByteString(hkxTampered,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                                &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                                "Password",'d');
            if (hkxTamperResult)
            {
                printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE-NL-A1 AEAD rejects tampered tag.\n");
            }
            else
            {
                printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE-NL-A1 AEAD accepted tampered tag.\n");
            }
            cmeFree(hkxTampered);
            cmeFree(hkxPlaintext);
            hkxTampered=(unsigned char *)malloc(hkxCiphertextLen);
            memcpy(hkxTampered,hkxCiphertext,hkxCiphertextLen);
            hkxTampered[cmeHerraduraKExFrameMagicLen+2] ^= 0x01;
            hkxPlaintext=NULL;
            hkxPlaintextLen=0;
            hkxTamperResult=cmeCipherByteString(hkxTampered,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                                &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                                "Password",'d');
            if (hkxTamperResult)
            {
                printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE-NL-A1 AEAD rejects tampered nonce.\n");
            }
            else
            {
                printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE-NL-A1 AEAD accepted tampered nonce.\n");
            }
            cmeFree(hkxTampered);
            cmeFree(hkxPlaintext);
            hkxTampered=(unsigned char *)malloc(hkxCiphertextLen);
            memcpy(hkxTampered,hkxCiphertext,hkxCiphertextLen);
            hkxTampered[cmeHerraduraKExFrameHeaderLen] ^= 0x01;
            hkxPlaintext=NULL;
            hkxPlaintextLen=0;
            hkxTamperResult=cmeCipherByteString(hkxTampered,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                                &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                                "Password",'d');
            if (hkxTamperResult)
            {
                printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE-NL-A1 AEAD rejects tampered ciphertext.\n");
            }
            else
            {
                printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE-NL-A1 AEAD accepted tampered ciphertext.\n");
            }
            cmeFree(hkxTampered);
            cmeFree(hkxPlaintext);
            hkxTampered=(unsigned char *)malloc(hkxCiphertextLen);
            memcpy(hkxTampered,hkxCiphertext,hkxCiphertextLen);
            hkxTampered[cmeHerraduraKExFrameMagicLen]=0xff;
            hkxPlaintext=NULL;
            hkxPlaintextLen=0;
            hkxTamperResult=cmeCipherByteString(hkxTampered,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                                &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                                "Password",'d');
            if (hkxTamperResult)
            {
                printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx frame rejects unsupported profile id.\n");
            }
            else
            {
                printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx frame accepted unsupported profile id.\n");
            }
            cmeFree(hkxTampered);
            cmeFree(hkxPlaintext);
            hkxPlaintext=NULL;
            hkxPlaintextLen=0;
            hkxTamperResult=cmeCipherByteString(hkxCiphertext,&hkxPlaintext,&hkxSalt,cmeHerraduraKExFrameHeaderLen-1,
                                                &hkxPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                                "Password",'d');
            if (hkxTamperResult)
            {
                printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx frame rejects truncated frame.\n");
            }
            else
            {
                printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx frame accepted truncated frame.\n");
            }
            hkxTampered=NULL;
            hkxPlaintext=NULL;
            hkxPlaintextLen=0;
        }
        if (!cmeCipherByteString(cleartext,&aesCiphertext,&aesSalt,strlen((char *)cleartext),
                                 &aesCiphertextLen,cmeOpenSSLLegacyStorageProfile,
                                 "Password",'e') &&
            !cmeCipherByteString(aesCiphertext,&aesPlaintext,&aesSalt,aesCiphertextLen,
                                 &aesPlaintextLen,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                 "Password",'d') &&
            aesPlaintextLen==(int)strlen((char *)cleartext) &&
            !memcmp(aesPlaintext,cleartext,aesPlaintextLen))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: legacy AES profile decrypts when Herradura is configured.\n");
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: legacy AES fallback decrypt failed under Herradura profile.\n");
        }
        cmeFree(aesCiphertext);
        cmeFree(aesPlaintext);
        cmeFree(aesSalt);
        cmeFree(hkxTampered);
        cmeFree(hkxWrongSalt);
        cmeFree(hkxCiphertext);
        cmeFree(hkxPlaintext);
        cmeFree(hkxSalt);
        hkxCiphertext=NULL;
        hkxPlaintext=NULL;
        hkxSalt=NULL;
        hkxCiphertextLen=0;
        hkxPlaintextLen=0;
        if (!cmeCipherByteString(cleartext,&hkxCiphertext,&hkxSalt,strlen((char *)cleartext),
                                 &hkxCiphertextLen,cmeHerraduraKExProfileHSKEDuplex256,
                                 "Password",'e') &&
            !cmeCipherByteString(hkxCiphertext,&hkxPlaintext,&hkxSalt,hkxCiphertextLen,
                                 &hkxPlaintextLen,cmeHerraduraKExProfileHSKEDuplex256,
                                 "Password",'d') &&
            hkxPlaintextLen==(int)strlen((char *)cleartext) &&
            !memcmp(hkxPlaintext,cleartext,hkxPlaintextLen))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: HerraduraKEx HSKE duplex profile round trip.\n");
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: HerraduraKEx HSKE duplex profile round trip failed.\n");
        }
        cmeFree(hkxCiphertext);
        cmeFree(hkxPlaintext);
        cmeFree(hkxSalt);
    }

    cmeGetCipher(&cipher,algorithm);
    keyLen=EVP_CIPHER_key_length(cipher);
    ivLen=EVP_CIPHER_iv_length(cipher);
    cmePBKDF(cipher,NULL,0,password,8,key,iv);
    if (PKCS5_PBKDF2_HMAC((const char *)password,8,NULL,0,cmeDefaultPBKDFCount,
                          EVP_sha256(),keyLen+ivLen,expectedKeyIv) &&
        !memcmp(key,expectedKeyIv,keyLen) && !memcmp(iv,expectedKeyIv+keyLen,ivLen))
    {
        printf("TESTS: testCryptoSymmetric(), PASS: default PBKDF profile v%d uses HMAC-SHA256 count=%d.\n",
               cmeDefaultPBKDFVersion,cmeDefaultPBKDFCount);
    }
    else
    {
        printf("TESTS: testCryptoSymmetric(), FAIL: default PBKDF profile mismatch.\n");
    }
    cmeCipherInit(&ctx,NULL,cipher,key,iv,'e');
    cont2=0;
    ctSize=strlen((char*)cleartext);
    printf ("---ctSize: %d\n",ctSize);
    for (cont=0; cont<(ctSize/evpBufferSize); cont++)
    {
        memcpy(bufIn,&cleartext[cont2],evpBufferSize);
        cmeCipherUpdate(ctx,bufOut,&written,bufIn,evpBufferSize,'e');
        memcpy(&ciphertext[cont2],bufOut,written);
        cont2 += written;
    }
    if (ctSize % evpBufferSize)
    {
        memcpy(bufIn,&cleartext[cont2],ctSize % evpBufferSize);
        cmeCipherUpdate(ctx,bufOut,&written,bufIn,ctSize % evpBufferSize,'e');
        memcpy(&ciphertext[cont2],bufOut,written);
        cont2 += written;
    }
    cmeCipherFinal(&ctx,bufOut,&written,'e');
    memcpy(&ciphertext[cont2],bufOut,written);
    cont2 += written;
    printf ("---etSize: %d\n",cont2);

    {
        char *encipheredPath = cmeTestPath("testfiles/enciphered.bin");
        fp=fopen(encipheredPath,"wb");
        if (fp)
        {
            result=fwrite(ciphertext,cont2,1,fp);
            if (result != 1)
            {
                printf("---error writing file '%s'\n",encipheredPath);
            }
            fflush(fp);
            fclose(fp);
        }
        else
        {
            printf("---error opening file '%s' for writing\n",encipheredPath);
        }
        cmeFree(encipheredPath);
    }
    cmeFree(key);                          //Free stuff
    cmeFree(iv);
    cmeFree(ciphertext);
    /**
        Manual Decryption of enciphered.bin using command line openssl works like this (using "Password"):
            gentoo64 ~ # openssl enc -d -p -nosalt -des-ede3-cbc -in enciphered.bin -out deciphered.txt
            enter des-ede3-cbc decryption password:
            key=DC647EB65E6711E155375218212B3964B17C7672C64FEF03
            iv =078BE05EDFE25CD0
    **/

    cmeCipherByteString(cleartext,&ciphertext,&salt,strlen((char *)cleartext),&written,cmeDefaultEncAlg, "Password", 'e');
    printf("Generated salt: %s \n",salt);
    //cmeFree(salt);
    cmeCipherByteString(ciphertext,&deciphertext,&salt,written,&written,cmeDefaultEncAlg, "Password", 'd');
    printf("Decrypted text: %s  \n",deciphertext);
    cmeFree (salt);
    cmeFree (ciphertext);
    cmeFree (deciphertext);
    salt=NULL;
    ciphertext=NULL;
    deciphertext=NULL;
    {
        unsigned char legacySaltBytes[evpSaltBufferSize];
        unsigned char legacyKeyIv[128];
        unsigned char legacyCiphertext[128];
        unsigned char legacyCombined[144];
        unsigned char legacyTag[cmeGCMTagLen];
        const unsigned char legacyPlaintext[]="Legacy PBKDF2 fallback text.";
        int legacyCiphertextLen=0;
        int legacyCombinedLen=0;
        int legacyWritten=0;

        memset(legacySaltBytes,0,sizeof(legacySaltBytes));
        memset(legacyKeyIv,0,sizeof(legacyKeyIv));
        memset(legacyCiphertext,0,sizeof(legacyCiphertext));
        memset(legacyCombined,0,sizeof(legacyCombined));
        memset(legacyTag,0,sizeof(legacyTag));
        for (cont=0;cont<evpSaltBufferSize;cont++)
        {
            legacySaltBytes[cont]=(unsigned char)cont;
        }
        cmeBytesToHexstr(legacySaltBytes,&legacySaltHex,evpSaltBufferSize);
        if (PKCS5_PBKDF2_HMAC_SHA1((const char *)password,8,legacySaltBytes,evpSaltBufferSize,
                                   cmeLegacyPBKDFCount,keyLen+ivLen,legacyKeyIv))
        {
            legacyCiphertextLen=aes_gcm_encrypt(legacyPlaintext,strlen((const char *)legacyPlaintext),
                                                NULL,0,legacyKeyIv,legacyKeyIv+keyLen,ivLen,
                                                legacyCiphertext,legacyTag);
        }
        if (legacyCiphertextLen>0)
        {
            memcpy(legacyCombined,legacyCiphertext,legacyCiphertextLen);
            memcpy(legacyCombined+legacyCiphertextLen,legacyTag,cmeGCMTagLen);
            legacyCombinedLen=legacyCiphertextLen+cmeGCMTagLen;
        }
        if (legacyCombinedLen>0 &&
            !cmeCipherByteString(legacyCombined,&legacyDeciphertext,&legacySaltHex,legacyCombinedLen,
                                 &legacyWritten,cmeDefaultEncAlg,(const char *)password,'d') &&
            legacyWritten==(int)strlen((const char *)legacyPlaintext) &&
            !memcmp(legacyDeciphertext,legacyPlaintext,legacyWritten))
        {
            printf("TESTS: testCryptoSymmetric(), PASS: legacy PBKDF profile v%d decrypt fallback preserved old data.\n",
                   cmeLegacyPBKDFVersion);
        }
        else
        {
            printf("TESTS: testCryptoSymmetric(), FAIL: legacy PBKDF decrypt fallback failed.\n");
        }
        OPENSSL_cleanse(legacyKeyIv,sizeof(legacyKeyIv));
        cmeFree(legacySaltHex);
        if (legacyDeciphertext)
        {
            OPENSSL_cleanse(legacyDeciphertext,legacyWritten);
            cmeFree(legacyDeciphertext);
            legacyDeciphertext=NULL;
        }
    }
    cmeProtectByteString((const char*)cleartext,(char **)&ciphertext,cmeDefaultEncAlg,(char **)&salt,"Password",&written,strlen((char *)cleartext));
    cmeUnprotectByteString((const char *)ciphertext,(char **)&deciphertext,cmeDefaultEncAlg,(char **)&salt,"Password",&written,written);
    printf("Unprotected text: %s  \n",deciphertext);
    cmeFree (salt);
    cmeFree (ciphertext);
    cmeFree (deciphertext);
    cmeFree(expectedKeyIv);
}

void testCryptoReprotectDBValue(void)
{
    const char *value="CaumeDSE explicit re-protect test value.";
    const char *oldKey="OldRotationPassword";
    const char *newKey="NewRotationPassword";
    char *sourceSalt=NULL;
    char *rotatedSalt=NULL;
    char *dryRunSalt=NULL;
    char *protectedValue=NULL;
    char *rotatedValue=NULL;
    char *readbackValue=NULL;
    char *wrongKeyValue=NULL;
    int protectedValueLen=0;
    int rotatedValueLen=0;
    int readbackValueLen=0;
    int dryRunValueLen=0;

    if (!cmeProtectDBSaltedValue(value,&protectedValue,cmeOpenSSLLegacyStorageProfile,
                                 &sourceSalt,oldKey,&protectedValueLen) &&
        !cmeReprotectDBSaltedValue(protectedValue,&rotatedValue,cmeOpenSSLLegacyStorageProfile,
                                   cmeOpenSSLLegacyStorageProfile,&sourceSalt,&rotatedSalt,
                                   oldKey,newKey,&rotatedValueLen,0) &&
        rotatedSalt && strcmp(sourceSalt,rotatedSalt) &&
        !cmeUnprotectDBSaltedValue(rotatedValue,&readbackValue,cmeOpenSSLLegacyStorageProfile,
                                   &rotatedSalt,newKey,&readbackValueLen) &&
        readbackValueLen==(int)strlen(value) && !strcmp(value,readbackValue))
    {
        printf("TESTS: testCryptoReprotectDBValue(), PASS: DB value re-protect rotates key with AES profile.\n");
    }
    else
    {
        printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB value AES key rotation failed.\n");
    }
    cmeFree(readbackValue);
    readbackValue=NULL;
    readbackValueLen=0;

    if (!cmeReprotectDBSaltedValue(protectedValue,NULL,cmeOpenSSLLegacyStorageProfile,
                                   cmeOpenSSLLegacyStorageProfile,&sourceSalt,&dryRunSalt,
                                   oldKey,newKey,&dryRunValueLen,1) &&
        dryRunValueLen==(int)strlen(value) && dryRunSalt==NULL)
    {
        printf("TESTS: testCryptoReprotectDBValue(), PASS: DB value dry-run re-protect reports plaintext length without writing.\n");
    }
    else
    {
        printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB value dry-run re-protect failed.\n");
    }
    fflush(stdout);

    if (cmeReprotectDBSaltedValue(protectedValue,&wrongKeyValue,cmeOpenSSLLegacyStorageProfile,
                                  cmeOpenSSLLegacyStorageProfile,&sourceSalt,&dryRunSalt,
                                  "WrongRotationPassword",newKey,&rotatedValueLen,0))
    {
        printf("TESTS: testCryptoReprotectDBValue(), PASS: DB value re-protect rejects wrong source key.\n");
    }
    else
    {
        printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB value re-protect accepted wrong source key.\n");
    }
    cmeFree(wrongKeyValue);
    wrongKeyValue=NULL;

    if (cmeUseHerraduraKEx)
    {
        char *hkxSalt=NULL;
        char *hkxValue=NULL;
        char *hkxReadback=NULL;
        char *rollbackSalt=NULL;
        char *rollbackValue=NULL;
        char *rollbackReadback=NULL;
        int hkxValueLen=0;
        int hkxReadbackLen=0;
        int rollbackValueLen=0;
        int rollbackReadbackLen=0;

        if (!cmeReprotectDBSaltedValue(protectedValue,&hkxValue,cmeOpenSSLLegacyStorageProfile,
                                       cmeHerraduraKExProfileHSKENLA1AEAD256,&sourceSalt,&hkxSalt,
                                       oldKey,newKey,&hkxValueLen,0) &&
            !cmeUnprotectDBSaltedValue(hkxValue,&hkxReadback,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                       &hkxSalt,newKey,&hkxReadbackLen) &&
            hkxReadbackLen==(int)strlen(value) && !strcmp(value,hkxReadback))
        {
            printf("TESTS: testCryptoReprotectDBValue(), PASS: DB value re-protect migrates AES to Herradura profile.\n");
        }
        else
        {
            printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB value AES to Herradura re-protect failed.\n");
        }
        if (hkxValue &&
            !cmeReprotectDBSaltedValue(hkxValue,&rollbackValue,cmeHerraduraKExProfileHSKENLA1AEAD256,
                                       cmeOpenSSLLegacyStorageProfile,&hkxSalt,&rollbackSalt,
                                       newKey,oldKey,&rollbackValueLen,0) &&
            !cmeUnprotectDBSaltedValue(rollbackValue,&rollbackReadback,cmeOpenSSLLegacyStorageProfile,
                                       &rollbackSalt,oldKey,&rollbackReadbackLen) &&
            rollbackReadbackLen==(int)strlen(value) && !strcmp(value,rollbackReadback))
        {
            printf("TESTS: testCryptoReprotectDBValue(), PASS: DB value re-protect rolls Herradura back to AES profile.\n");
        }
        else
        {
            printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB value Herradura rollback re-protect failed.\n");
        }
        cmeFree(hkxSalt);
        cmeFree(hkxValue);
        cmeFree(hkxReadback);
        cmeFree(rollbackSalt);
        cmeFree(rollbackValue);
        cmeFree(rollbackReadback);
    }
    else
    {
        printf("TESTS: testCryptoReprotectDBValue(), SKIP: HerraduraKEx provider is not compiled in.\n");
    }

    cmeFree(sourceSalt);
    cmeFree(rotatedSalt);
    cmeFree(dryRunSalt);
    cmeFree(protectedValue);
    cmeFree(rotatedValue);
    cmeFree(readbackValue);

    {
        sqlite3 *memDB=NULL;
        cmeReprotectDBInventory inventory;
        cmeReprotectDBReport report;
        char **readbackTable=NULL;
        int readbackRows=0;
        int readbackCols=0;
        int inventoryOK=0;
        int dryRunOK=0;
        int wrongKeyOK=0;
        int rotationOK=0;
        int readbackOK=0;

        memset(&inventory,0,sizeof(inventory));
        memset(&report,0,sizeof(report));
        if (!sqlite3_open(":memory:",&memDB) &&
            !cmeSQLRows(memDB,
                        "BEGIN TRANSACTION;"
                        "CREATE TABLE data (id INTEGER PRIMARY KEY,userId TEXT,orgId TEXT,salt TEXT,value TEXT,rowOrder TEXT,MAC TEXT,sign TEXT,MACProtected TEXT,signProtected TEXT,otphDKey TEXT);"
                        "CREATE TABLE meta (id INTEGER PRIMARY KEY,userId TEXT,orgId TEXT,salt TEXT,attribute TEXT,attributeData TEXT);"
                        "INSERT INTO data VALUES (1,'userA','orgA','','alpha','1','','','','','');"
                        "INSERT INTO data VALUES (2,'userA','orgA','','beta','2','','','','','');"
                        "INSERT INTO meta VALUES (1,'userA','orgA','','protect','aes-256-gcm');"
                        "COMMIT;",NULL,NULL) &&
            !cmeMemSecureDBProtect(memDB,oldKey) &&
            !cmeInventoryMemSecureDBReprotect(memDB,oldKey,cmeOpenSSLLegacyStorageProfile,&inventory) &&
            inventory.dataRows==2 && inventory.metaRows==1 && inventory.protectMetaRows==1 &&
            inventory.protectedValueRows==2 && inventory.targetProfileRows==1 &&
            inventory.legacyAESValueRows==2 && inventory.herraduraValueRows==0 &&
            !strcmp(inventory.sourceProfile,cmeOpenSSLLegacyStorageProfile))
        {
            inventoryOK=1;
        }
        if (inventoryOK &&
            !cmeReprotectMemSecureDB(memDB,oldKey,newKey,cmeOpenSSLLegacyStorageProfile,&report,1) &&
            report.dryRun==1 && report.dataRowsReprotected==2 && report.metaRowsReprotected==1 &&
            report.before.protectedValueRows==2)
        {
            dryRunOK=1;
        }
        memset(&report,0,sizeof(report));
        if (inventoryOK &&
            cmeReprotectMemSecureDB(memDB,"WrongRotationPassword",newKey,
                                    cmeOpenSSLLegacyStorageProfile,&report,0))
        {
            wrongKeyOK=1;
        }
        memset(&report,0,sizeof(report));
        if (inventoryOK &&
            !cmeReprotectMemSecureDB(memDB,oldKey,newKey,cmeOpenSSLLegacyStorageProfile,&report,0) &&
            report.dryRun==0 && report.dataRowsReprotected==2 && report.metaRowsReprotected==1 &&
            report.after.protectedValueRows==2 && report.after.targetProfileRows==1 &&
            report.after.legacyAESValueRows==2)
        {
            rotationOK=1;
        }
        if (rotationOK &&
            !cmeMemSecureDBUnprotect(memDB,newKey) &&
            !cmeMemTable(memDB,"SELECT value,userId,orgId FROM data ORDER BY id;",
                         &readbackTable,&readbackRows,&readbackCols) &&
            readbackRows==2 && readbackCols==3 &&
            !strcmp(readbackTable[readbackCols],"alpha") &&
            !strcmp(readbackTable[readbackCols+1],"userA") &&
            !strcmp(readbackTable[(2*readbackCols)],"beta") &&
            !strcmp(readbackTable[(2*readbackCols)+2],"orgA"))
        {
            readbackOK=1;
        }
        if (inventoryOK)
        {
            printf("TESTS: testCryptoReprotectDBValue(), PASS: DB re-protect inventory reports AES protected row scope.\n");
        }
        else
        {
            printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB re-protect inventory failed AES protected row scope.\n");
        }
        if (dryRunOK)
        {
            printf("TESTS: testCryptoReprotectDBValue(), PASS: DB-level re-protect dry-run reports row scope without mutation.\n");
        }
        else
        {
            printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB-level re-protect dry-run failed.\n");
        }
        if (wrongKeyOK)
        {
            printf("TESTS: testCryptoReprotectDBValue(), PASS: DB-level re-protect rejects wrong source key.\n");
        }
        else
        {
            printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB-level re-protect accepted wrong source key.\n");
        }
        if (rotationOK && readbackOK)
        {
            printf("TESTS: testCryptoReprotectDBValue(), PASS: DB-level re-protect rotates protected rows and reads back with new key.\n");
        }
        else
        {
            printf("TESTS: testCryptoReprotectDBValue(), FAIL: DB-level re-protect rotation/readback failed.\n");
        }
        if (readbackTable)
        {
            cmeMemTableFinal(readbackTable);
        }
        if (memDB)
        {
            sqlite3_close(memDB);
        }
    }
}

void testCryptoSymmetricGCM()
{
    const unsigned char cleartext[] = "This is cleartext for GCM.";
    unsigned char ciphertext[128];
    unsigned char decrypted[128];
    unsigned char tag[16];
    unsigned char key[32];
    unsigned char iv[12];
    unsigned char combo[144];
    unsigned char *b64=NULL;
    unsigned char *decoded=NULL;
    int enc_len, dec_len, written, combo_len;

    RAND_bytes(key, sizeof(key));
    RAND_bytes(iv, sizeof(iv));

    enc_len = aes_gcm_encrypt(cleartext, strlen((const char *)cleartext),
                              NULL, 0, key, iv, sizeof(iv),
                              ciphertext, tag);
    printf("GCM ciphertext size: %d\n", enc_len);

    memcpy(combo, ciphertext, enc_len);
    memcpy(combo + enc_len, tag, sizeof(tag));
    combo_len = enc_len + sizeof(tag);
    cmeStrToB64(combo, &b64, combo_len, &written);
    printf("GCM B64: %s\n", b64);

    cmeB64ToStr(b64, &decoded, written, &written);
    combo_len = written;
    memcpy(ciphertext, decoded, combo_len - sizeof(tag));
    memcpy(tag, decoded + combo_len - sizeof(tag), sizeof(tag));
    enc_len = combo_len - sizeof(tag);
    cmeFree(b64);
    cmeFree(decoded);

    dec_len = aes_gcm_decrypt(ciphertext, enc_len, NULL, 0, tag,
                              key, iv, sizeof(iv), decrypted);
    decrypted[dec_len] = '\0';
    printf("GCM decrypted text: %s\n", decrypted);
}

void testCryptoSymmetricGCM_ByteString()
{
    const unsigned char cleartext[] = "This is cleartext for GCM via cmeCipherByteString.";
    unsigned char *ciphertext = NULL;
    unsigned char *deciphertext = NULL;
    unsigned char *salt = NULL;
    int written = 0;
    int result;

    result = cmeCipherByteString(cleartext, &ciphertext, &salt,
                                 strlen((const char *)cleartext), &written,
                                 "aes-256-gcm", "Password", 'e');
    if (result || !ciphertext)
    {
        printf("TESTS: testCryptoSymmetricGCM_ByteString(), cmeCipherByteString() encrypt failed! result=%d\n", result);
        cmeFree(salt);
        return;
    }
    printf("TESTS: testCryptoSymmetricGCM_ByteString(), encrypted %d bytes (incl. 16-byte tag). salt: %s\n",
           written, salt);

    result = cmeCipherByteString(ciphertext, &deciphertext, &salt,
                                 written, &written,
                                 "aes-256-gcm", "Password", 'd');
    if (result || !deciphertext)
    {
        printf("TESTS: testCryptoSymmetricGCM_ByteString(), cmeCipherByteString() decrypt failed! result=%d\n", result);
    }
    else
    {
        printf("TESTS: testCryptoSymmetricGCM_ByteString(), decrypted: %s\n", deciphertext);
        if (strcmp((const char *)deciphertext, (const char *)cleartext) == 0)
            printf("TESTS: testCryptoSymmetricGCM_ByteString(), PASS: plaintext matches.\n");
        else
            printf("TESTS: testCryptoSymmetricGCM_ByteString(), FAIL: plaintext mismatch!\n");
    }
    cmeFree(salt);
    cmeFree(ciphertext);
    cmeFree(deciphertext);
}

void testCryptoDigest_Str(unsigned char *bufIn)
{
    int cont,cont2,cont3,written,ctSize;
    unsigned char *digest_bytes=NULL;
    unsigned char *digest_str=NULL;
    EVP_MD_CTX *ctx2=NULL;
    EVP_MD *digest=NULL;
    const unsigned char cleartext[] = "This is cleartext This is cleartext This is cleartext This is cleartext.\n";
    const unsigned char b64str[] =  "UmVtYXJrcw0KVGhlIGNsZWFyZXJyIGZ1bmN0aW9uIHJlc2V0cyB0aGUgZXJyb3Ig\n"
                                    "aW5kaWNhdG9yIGFuZCBlbmQtb2YtZmlsZSBpbmRpY2F0b3IgZm9yIHN0cmVhbS4g\n"
                                    "RXJyb3IgaW5kaWNhdG9ycyBhcmUgbm90IGF1dG9tYXRpY2FsbHkgY2xlYXJlZDsg\n"
                                    "b25jZSB0aGUgZXJyb3IgaW5kaWNhdG9yIGZvciBhIHNwZWNpZmllZCBzdHJlYW0g\n"
                                    "aXMgc2V0LCBvcGVyYXRpb25zIG9uIHRoYXQgc3RyZWFtIGNvbnRpbnVlIHRvIHJl\n"
                                    "dHVybiBhbiBlcnJvciB2YWx1ZSB1bnRpbCBjbGVhcmVyciwgZnNlZWssIGZzZXRw\n"
                                    "b3MsIG9yIHJld2luZCBpcyBjYWxsZWQuDQoNCklmIHN0cmVhbSBpcyBOVUxMLCB0\n"
                                    "aGUgaW52YWxpZCBwYXJhbWV0ZXIgDQoNCg0KDQo=\n";
    const char algorithm2[] = cmeDefaultHshAlg;
    char *resultStr=NULL;
    unsigned char *bufOut=NULL;

    digest_bytes=(unsigned char *)malloc(EVP_MAX_MD_SIZE);
    cmeGetDigest(&digest,algorithm2);
    cmeDigestInit(&ctx2,NULL,digest);
    cont2=0;
    ctSize=strlen((char *)cleartext);
    printf ("--- HASH parameters - algorithm: %s\n",cmeDefaultHshAlg);
    printf ("--- HASH cleartext Size: %d\n",ctSize);
    for (cont=0; cont<(ctSize/evpBufferSize); cont++)
    {
        memcpy(bufIn,&cleartext[cont2],evpBufferSize);
        cmeDigestUpdate(ctx2,bufIn,evpBufferSize);
        cont2 += evpBufferSize;
    }
    if (ctSize % evpBufferSize)
    {
        memcpy(bufIn,&cleartext[cont2],ctSize % evpBufferSize);
        cmeDigestUpdate(ctx2,bufIn,ctSize % evpBufferSize);
        cont2 += (ctSize % evpBufferSize);
    }
    cmeDigestFinal(&ctx2,digest_bytes,(unsigned int *)&written);
    cont3 = written;
    printf ("--- HASH digest Size (bytes): %d\n",cont3);

    cmeBytesToHexstr(digest_bytes,&digest_str,cont3);
    printf ("HASH digest: \n%s\n",digest_str);

    cmeFree(digest_str); //Now we repeat the process with the integrated function in 1 step
    cmeDigestByteString(cleartext,&digest_str,strlen((const char *)cleartext),&written,algorithm2);
    printf ("--- HASH digest Size (chars) with integrated function: %d\n",written);
    printf ("HASH digest with integrated function: \n%s\n",digest_str);

    memset(bufIn,0,evpBufferSize);
    memcpy(bufIn,digest_bytes,cont3);
    cmeStrToB64(bufIn,&bufOut,cont3,&written);
    printf ("StrToB64:\n%s\n",bufOut);

    cont3=strlen((char *)cleartext);
    memset(bufIn,0,evpBufferSize);
    memcpy(bufIn,cleartext,strlen((char *)cleartext));
    cmeFree(bufOut);
    cmeStrToB64(bufIn,&bufOut,cont3,&written);
    printf ("StrToB64:\n%s\n",bufOut);

    cont3=strlen((char *)bufOut);
    memset(bufIn,0,evpBufferSize);
    memcpy(bufIn,bufOut,strlen((char *)bufOut));
    cmeFree(bufOut);
    cmeB64ToStr(bufIn,&bufOut,cont3,&written);
    printf ("B64ToStr:\n%s\n",bufOut);

    cont3=strlen((char *)b64str);
    memset(bufIn,0,evpBufferSize);
    memcpy(bufIn,b64str,strlen((char *)b64str));
    cmeFree(bufOut);
    cmeB64ToStr(bufIn,&bufOut,cont3,&written);
    printf ("B64ToStr:\n%s\n",bufOut);

    cont3=strlen((char *)bufOut);
    memset(bufIn,0,evpBufferSize);
    memcpy(bufIn,bufOut,strlen((char *)bufOut));
    cmeFree(bufOut);
    cmeStrToB64(bufIn,&bufOut,cont3,&written);
    printf ("StrToB64:\n%s\n",bufOut);

    cont3=strlen((char *)bufOut);
    memset(bufIn,0,evpBufferSize);
    memcpy(bufIn,bufOut,strlen((char *)bufOut));
    cmeFree(bufOut);
    cmeB64ToStr(bufIn,&bufOut,cont3,&written);
    printf ("B64ToStr:\n%s\n",bufOut);

    cmeStrConstrAppend (&resultStr, "Hello %d",2);
    cmeStrConstrAppend (&resultStr, " World!\n %s\n","Goodbye World");
    printf("cmeStrConstrAppend () test: %s",resultStr);
    cmeFree (resultStr);

    cmeFree(bufOut);
    cmeFree(digest_bytes);
    cmeFree(digest_str);
}

void testCryptoHMAC ()
{
    int cont,cont2,written,ctSize;
    int localBuferSize=10;                  //Set local buffer size smaller than cleartext length to test HMAC iteration.
    unsigned char localBuffer[10];
    unsigned char *HMACBytes=NULL;
    unsigned char *HMACStr=NULL;
    CME_HMAC_CTX *ctx=NULL;
    EVP_MD *digest=NULL;
    const unsigned char cleartext[] = "This is cleartext This is cleartext This is cleartext This is cleartext.\n";
    const char dgstAlg[] = cmeDefaultMACAlg;
    const char key[] = "HMAC test key";
    const char *salt = "C02002FD232CCA6809840668C26DB385";

    HMACBytes=(unsigned char *)malloc(EVP_MAX_MD_SIZE);
    if (cmeGetDigest(&digest,dgstAlg))
    {
        printf ("TESTS: testCryptoHMAC (), Error in cmeGetDigest() with default MAC algorithm %s!\n",cmeDefaultMACAlg);
        return;
    }
    cmeHMACInit(&ctx,NULL,digest,key,strlen(key));
    cont2=0;
    ctSize=strlen((char *)cleartext);
    printf ("--- HMAC parameters - algorithm: %s, user key: %s\n",cmeDefaultMACAlg,key);
    printf ("--- HMAC Cleartext Size: %d\n",ctSize);
    for (cont=0; cont<(ctSize/localBuferSize); cont++)
    {
        memcpy(localBuffer,&cleartext[cont2],localBuferSize);
        cmeHMACUpdate(ctx,localBuffer,localBuferSize);
        cont2 += localBuferSize;
    }
    if (ctSize % localBuferSize)
    {
        memcpy(localBuffer,&cleartext[cont2],ctSize % localBuferSize);
        cmeHMACUpdate(ctx,localBuffer,ctSize % localBuferSize);
        cont2 += (ctSize % localBuferSize);
    }
    cmeHMACFinal(&ctx,HMACBytes,(unsigned int *)&written);
    printf ("--- HMAC MAC Size (bytes): %d\n",written);

    cmeBytesToHexstr(HMACBytes,&HMACStr,written);
    printf ("HMAC MAC: %s\n",HMACStr);

    printf ("--- HMAC parameters - algorithm: %s, password (PBKDF): %s, salt (PBKDF): %s\n",cmeDefaultMACAlg,key,salt);
    cmeFree(HMACStr); //Now we repeat the process with the integrated function in 1 step
    cmeHMACByteString(cleartext,&HMACStr,strlen((const char *)cleartext),&written,dgstAlg,(char **)&salt,key);
    printf ("--- HMAC MAC Size (chars) with integrated function: %d\n",written);
    printf ("HMAC MAC with integrated function (derives key from PBKDF): %s\n",HMACStr);

    cmeFree(HMACBytes);
    cmeFree(HMACStr);
}

void testPerl (PerlInterpreter *myPerl)
{
    int result __attribute__((unused))=0;
    int cont=0;
    char *ilist[2];
    char *rlist[2];
    char *testScriptPath=NULL;
    char ilist_1[]="This is string 1.\n";
    char ilist_2[]="This is string 2.\n";

    cmePerlParserInstruction ("print \"this is a single line instruction test\\n\";",myPerl);
    cmePerlParserRun(myPerl);

    testScriptPath=cmeTestPath("testfiles/test.pl");
    ilist[0]="cdse";
    ilist[1]=testScriptPath;
    result=cmePerlParserCmdLineInit(2,ilist,myPerl);    //initialize Parser and script's global variables
    ilist[0]=ilist_1;
    ilist[1]=ilist_2;
    result=cmePerlParserScriptFunction("function",myPerl,ilist,2,rlist,2,&cont);
    printf ("perl function result 1: %s",rlist[0]);
    printf ("perl function result 2: %s",rlist[1]);
    ilist[0]=ilist_1;
    ilist[1]=ilist_2;
    result=cmePerlParserScriptFunction("iterate",myPerl,ilist,2,rlist,2,&cont);
    printf ("perl function result 1: %s",rlist[0]);
    printf ("perl function result 2: %s",rlist[1]);


    ilist[0]="cdse";
    ilist[1]=testScriptPath;
    result=cmePerlParserCmdLineInit(2,ilist,myPerl);    //initialize Parser and script's global variables
    ilist[0]=ilist_1;
    ilist[1]=ilist_2;
    result=cmePerlParserScriptFunction("iterate",myPerl,ilist,2,rlist,2,&cont);
    printf ("perl function result 1: %s",rlist[0]);
    printf ("perl function result 2: %s",rlist[1]);
    cmeFree(testScriptPath);
}

void testDB (PerlInterpreter* myPerl)
{
    int cont,cont2,result __attribute__((unused));
    char *ilist[2];
    char *testScriptPath=NULL;
    int numRows=0;
    int numColumns=0;
    sqlite3 *DB;
    char **pQueryResult;        //Important: do not declare it as char ***

    cmeMemDBCreateOpen(&DB);       //Create memory DB
    cmeSQLRows(DB,"BEGIN TRANSACTION; CREATE TABLE table1 (key INTEGER PRIMARY KEY,"
               "nombre TEXT, apellido TEXT, salario FLOAT);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Enrique','Sorcia',10011);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Omar','Herrera',6500.90);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Antonio','Lugo',12100.50);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Dante','Ferrini',10014);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Joaquín','González',7800);"
               "COMMIT;",NULL,NULL); //Create a table

    cmeMemTable(DB,"SELECT * FROM table1;",&pQueryResult,&numRows,&numColumns);
    for (cont=0;cont<=numRows;cont++)
    {
        for (cont2=0;cont2<numColumns;cont2++)
        {
            printf("[%s]",pQueryResult[(cont*numColumns)+cont2]);
        }
        printf("\n");
    }
    cmeMemTableFinal(pQueryResult);
    cmeDBClose(DB);

    testScriptPath=cmeTestPath("testfiles/test.pl");
    ilist[0]="cdse";
    ilist[1]=testScriptPath;
    result=cmePerlParserCmdLineInit(2,ilist,myPerl);    //initialize Parser and script's global variables
    cmeMemDBCreateOpen(&DB);       //Create memory DB
    cmeSQLRows(DB,"BEGIN TRANSACTION; CREATE TABLE table1 (key INTEGER PRIMARY KEY,"
               "nombre TEXT, apellido TEXT, salario FLOAT);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Enrique','Sorcia',10011);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Omar','Herrera',6500.90);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Antonio','Lugo',12100.50);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Dante','Ferrini',10014);"
               "INSERT INTO table1 (nombre,apellido,salario) VALUES('Joaquín','González',7800);"
               "COMMIT;","iterate",myPerl); //Create a table
               //Callback function is called only when results are available, so the
               //above is also safe. Otherwise use:
               //"COMMIT;",NULL,NULL,&pErrmsg); //Create a table

    cmeResultMemTableClean();
    cmeSQLRows(DB,"BEGIN TRANSACTION; SELECT * FROM table1 WHERE salario > 10000;"
               " COMMIT;","iterate",myPerl); //Select
    cmeResultMemTableClean();
    cmeDBClose(DB);
    cmeFree(testScriptPath);
    testInternalDBSchemaVersioning();
}

static int cmeTestCreateLogsSchema(sqlite3 *db, int wrongType, int missingColumn)
{
    char *sql=NULL;
    int result;

    cmeStrConstrAppend(&sql,
                       "BEGIN TRANSACTION;"
                       "CREATE TABLE transactions (id %s PRIMARY KEY,"
                       " userId TEXT, orgId TEXT, salt TEXT,"
                       " requestMethod TEXT, requestUrl TEXT, requestHeaders TEXT, startTimestamp TEXT,"
                       " endTimestamp TEXT, requestDataSize TEXT, responseDataSize TEXT, orgResourceId TEXT,"
                       " requestIPAddress TEXT, responseCode %s%s);"
                       "COMMIT;",
                       wrongType?"TEXT":"INTEGER",
                       wrongType?"INTEGER":"TEXT",
                       missingColumn?"":", authenticated TEXT");
    result=cmeSQLRows(db,sql,NULL,NULL);
    cmeFree(sql);
    return(result);
}

static int cmeTestCreateColumnFileSchema(sqlite3 *db)
{
    return(cmeSQLRows(db,
                      "BEGIN TRANSACTION;"
                      "CREATE TABLE data (id INTEGER PRIMARY KEY,userId TEXT,orgId TEXT,salt TEXT,value TEXT,rowOrder TEXT,MAC TEXT,sign TEXT,MACProtected TEXT,signProtected TEXT,otphDKey TEXT);"
                      "CREATE TABLE meta (id INTEGER PRIMARY KEY,userId TEXT,orgId TEXT,salt TEXT,attribute TEXT,attributeData TEXT);"
                      "COMMIT;",NULL,NULL));
}

void testInternalDBSchemaVersioning(void)
{
    int errors=0;
    sqlite3 *db=NULL;

    printf("--- Testing internal database schema versioning and migration checks:\n");
    setenv("CDSE_SUPPRESS_SCHEMA_ERROR_LOG","1",1);
    if (!cmeMemDBCreateOpen(&db) &&
        !cmeTestCreateLogsSchema(db,0,0) &&
        !cmeSetInternalDBSchemaVersion(db,cmeInternalDBSchemaClassLogs) &&
        !cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassLogs,0))
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: current schema metadata accepted.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: current schema metadata rejected.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (!cmeMemDBCreateOpen(&db) &&
        !cmeTestCreateLogsSchema(db,0,0) &&
        !cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassLogs,1) &&
        cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassLogs,0))
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: legacy missing-version policy enforced.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: legacy missing-version policy not enforced.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (!cmeMemDBCreateOpen(&db) &&
        !cmeTestCreateLogsSchema(db,0,0) &&
        !cmeSetInternalDBSchemaVersion(db,cmeInternalDBSchemaClassLogs) &&
        !cmeSQLRows(db,"UPDATE schema_meta SET value='999' WHERE key='schemaVersion';",NULL,NULL) &&
        cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassLogs,1))
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: future schema version rejected.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: future schema version accepted.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (!cmeMemDBCreateOpen(&db) &&
        !cmeTestCreateLogsSchema(db,0,1) &&
        !cmeSetInternalDBSchemaVersion(db,cmeInternalDBSchemaClassLogs) &&
        cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassLogs,1))
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: missing-column schema rejected.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: missing-column schema accepted.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (!cmeMemDBCreateOpen(&db) &&
        !cmeTestCreateLogsSchema(db,1,0) &&
        !cmeSetInternalDBSchemaVersion(db,cmeInternalDBSchemaClassLogs) &&
        cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassLogs,1))
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: wrong-type schema rejected.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: wrong-type schema accepted.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (!cmeMemDBCreateOpen(&db) &&
        !cmeTestCreateLogsSchema(db,0,0) &&
        !cmeSetInternalDBSchemaVersion(db,cmeInternalDBSchemaClassLogs) &&
        !cmeSQLRows(db,"UPDATE schema_meta SET value='pending' WHERE key='migrationState';",NULL,NULL) &&
        cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassLogs,1))
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: partial migration state rejected.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: partial migration state accepted.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (!cmeMemDBCreateOpen(&db) &&
        !cmeTestCreateColumnFileSchema(db) &&
        !cmeSetInternalDBSchemaVersion(db,cmeInternalDBSchemaClassColumnFile) &&
        !cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassColumnFile,0))
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: ColumnFile schema metadata accepted.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: ColumnFile schema metadata rejected.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (errors)
    {
        printf("TESTS: testInternalDBSchemaVersioning(), FAIL: %d schema cases failed.\n",errors);
    }
    else
    {
        printf("TESTS: testInternalDBSchemaVersioning(), PASS: current, legacy, future, missing-column, wrong-type, partial-migration, and ColumnFile cases verified.\n");
    }
    unsetenv("CDSE_SUPPRESS_SCHEMA_ERROR_LOG");
}

static int cmeTestCreateSecureDBTamperFixture(sqlite3 **db, const char *profile)
{
    int result;
    char *sql=NULL;

    *db=NULL;
    if (cmeMemDBCreateOpen(db))
    {
        return(1);
    }
    cmeStrConstrAppend(&sql,
                       "BEGIN TRANSACTION;"
                       "CREATE TABLE data (id INTEGER PRIMARY KEY,userId TEXT,orgId TEXT,salt TEXT,value TEXT,rowOrder TEXT,MAC TEXT,sign TEXT,MACProtected TEXT,signProtected TEXT,otphDKey TEXT);"
                       "CREATE TABLE meta (id INTEGER PRIMARY KEY,userId TEXT,orgId TEXT,salt TEXT,attribute TEXT,attributeData TEXT);"
                       "INSERT INTO data VALUES (1,'UserTamper','OrgTamper','','alpha','1','','','','','');"
                       "INSERT INTO data VALUES (2,'UserTamper','OrgTamper','','beta','2','','','','','');"
                       "INSERT INTO meta VALUES (1,'UserTamper','OrgTamper','','protect','%s');"
                       "INSERT INTO meta VALUES (2,'UserTamper','OrgTamper','','MAC','%s');"
                       "INSERT INTO meta VALUES (3,'UserTamper','OrgTamper','','MACProtected','%s');"
                       "INSERT INTO meta VALUES (4,'UserTamper','OrgTamper','','sign','%s');"
                       "INSERT INTO meta VALUES (5,'UserTamper','OrgTamper','','signProtected','%s');"
                       "COMMIT;",
                       profile,cmeDefaultMACAlg,cmeDefaultMACAlg,cmeDefaultMACAlg,cmeDefaultMACAlg);
    result=cmeSQLRows(*db,sql,NULL,NULL);
    cmeFree(sql);
    if (!result)
    {
        result=cmeSetInternalDBSchemaVersion(*db,cmeInternalDBSchemaClassColumnFile);
    }
    if (!result)
    {
        result=cmeMemSecureDBProtect(*db,"tamper-key");
    }
    if (result)
    {
        cmeDBClose(*db);
        *db=NULL;
        return(2);
    }
    return(0);
}

static int cmeTestSecureDBTamperCase(const char *marker, const char *tamperSQL)
{
    int result;
    int savedStderr=-1;
    int suppressResult;
    sqlite3 *db=NULL;

    result=cmeTestCreateSecureDBTamperFixture(&db,cmeDefaultEncAlg);
    if (result)
    {
        printf("TESTS: testSecureDBTamperFixtures(), FAIL: %s fixture setup result=%d.\n",marker,result);
        return(1);
    }
    result=cmeSQLRows(db,tamperSQL,NULL,NULL);
    if (!result)
    {
        suppressResult=cmeTestSuppressStderrBegin(&savedStderr);
        result=cmeMemSecureDBUnprotect(db,"tamper-key");
        if (!suppressResult)
        {
            cmeTestSuppressStderrEnd(savedStderr);
        }
    }
    if (result)
    {
        printf("TESTS: testSecureDBTamperFixtures(), PASS: %s rejected.\n",marker);
        cmeDBClose(db);
        return(0);
    }
    printf("TESTS: testSecureDBTamperFixtures(), FAIL: %s accepted.\n",marker);
    cmeDBClose(db);
    return(1);
}

void testSecureDBTamperFixtures(void)
{
    int errors=0;
    int result;
    int savedStderr=-1;
    int rows=0;
    int cols=0;
    char **table=NULL;
    sqlite3 *db=NULL;

    printf("--- Testing secure DB tamper fixtures:\n");
    result=cmeTestCreateSecureDBTamperFixture(&db,cmeDefaultEncAlg);
    if (!result &&
        !cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassColumnFile,0) &&
        !cmeMemSecureDBUnprotect(db,"tamper-key") &&
        !cmeMemTable(db,"SELECT value FROM data ORDER BY id;",&table,&rows,&cols) &&
        rows==2 && cols==1 &&
        !strcmp(table[1],"alpha") &&
        !strcmp(table[2],"beta"))
    {
        printf("TESTS: testSecureDBTamperFixtures(), PASS: baseline secure DB read succeeded.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testSecureDBTamperFixtures(), FAIL: baseline secure DB read failed.\n");
    }
    if (table) { cmeMemTableFinal(table); table=NULL; }
    if (db) { cmeDBClose(db); db=NULL; }

    errors+=cmeTestSecureDBTamperCase("row salt tamper",
                                      "UPDATE data SET salt=(CASE substr(salt,1,2) WHEN '00' THEN '01' ELSE '00' END)||substr(salt,3) WHERE id=1;");
    errors+=cmeTestSecureDBTamperCase("protected value tamper",
                                      "UPDATE data SET value=(CASE substr(value,1,1) WHEN 'A' THEN 'B' ELSE 'A' END)||substr(value,2) WHERE id=1;");
    errors+=cmeTestSecureDBTamperCase("MAC tamper",
                                      "UPDATE data SET MAC=(CASE substr(MAC,1,1) WHEN '0' THEN '1' ELSE '0' END)||substr(MAC,2) WHERE id=1;");
    errors+=cmeTestSecureDBTamperCase("MACProtected tamper",
                                      "UPDATE data SET MACProtected=(CASE substr(MACProtected,1,1) WHEN '0' THEN '1' ELSE '0' END)||substr(MACProtected,2) WHERE id=1;");
    errors+=cmeTestSecureDBTamperCase("sign tamper",
                                      "UPDATE data SET sign=(CASE substr(sign,1,1) WHEN '0' THEN '1' ELSE '0' END)||substr(sign,2) WHERE id=1;");
    errors+=cmeTestSecureDBTamperCase("signProtected tamper",
                                      "UPDATE data SET signProtected=(CASE substr(signProtected,1,1) WHEN '0' THEN '1' ELSE '0' END)||substr(signProtected,2) WHERE id=1;");
    errors+=cmeTestSecureDBTamperCase("missing metadata tamper",
                                      "DELETE FROM meta WHERE id=1;");

    if (!cmeTestSuppressStderrBegin(&savedStderr))
    {
        result=cmeTestCreateSecureDBTamperFixture(&db,"unsupported-profile");
        cmeTestSuppressStderrEnd(savedStderr);
    }
    else
    {
        result=cmeTestCreateSecureDBTamperFixture(&db,"unsupported-profile");
    }
    if (result)
    {
        printf("TESTS: testSecureDBTamperFixtures(), PASS: malformed profile id rejected.\n");
    }
    else
    {
        errors++;
        printf("TESTS: testSecureDBTamperFixtures(), FAIL: malformed profile id accepted.\n");
        cmeDBClose(db);
        db=NULL;
    }

    result=cmeTestCreateSecureDBTamperFixture(&db,cmeDefaultEncAlg);
    if (!result &&
        !cmeSQLRows(db,"UPDATE schema_meta SET value='999' WHERE key='schemaVersion';",NULL,NULL))
    {
        if (!cmeTestSuppressStderrBegin(&savedStderr))
        {
            result=cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassColumnFile,0);
            cmeTestSuppressStderrEnd(savedStderr);
        }
        else
        {
            result=cmeCheckInternalDBSchema(db,cmeInternalDBSchemaClassColumnFile,0);
        }
        if (result)
        {
            printf("TESTS: testSecureDBTamperFixtures(), PASS: schema metadata tamper rejected.\n");
        }
        else
        {
            errors++;
            printf("TESTS: testSecureDBTamperFixtures(), FAIL: schema metadata tamper accepted.\n");
        }
    }
    else
    {
        errors++;
        printf("TESTS: testSecureDBTamperFixtures(), FAIL: schema metadata tamper setup failed.\n");
    }
    if (db) { cmeDBClose(db); db=NULL; }

    if (errors)
    {
        printf("TESTS: testSecureDBTamperFixtures(), FAIL: %d tamper cases failed.\n",errors);
    }
    else
    {
        printf("TESTS: testSecureDBTamperFixtures(), PASS: salt, value, MAC, MACProtected, sign, signProtected, metadata, profile, and schema tamper cases rejected.\n");
    }
}

void testCSV ()
{
    int cont, cont2, result __attribute__((unused));
    int numCols=0;
    int numRows=0;
    int processedRows=0;
    int deleteNumResultRegisterCols=0;
    int deleteNumResultRegisters=0;
    int oldColumnFilesRemoved=1;
    char *fName=NULL;
    char *fName2=NULL;
    char *resourcesDBPath=NULL;
    char *deleteStoragePath=NULL;
    char **deleteResultRegisterCols=NULL;
    char **deleteColumnFilePaths=NULL;
    char **elements=NULL;
    char **pQueryResult=NULL;
    char **pQueryResult2=NULL;
    const char *attributes[]={"shuffle","protect"};
    const char *attributesData[]={cmeDefaultEncAlg,cmeDefaultEncAlg};
    const char *attributesMAC[]={"protect","sign","signProtected","MAC","MACProtected"};
    const char *attributesMACData[]={cmeDefaultEncAlg,cmeDefaultMACAlg,cmeDefaultMACAlg,cmeDefaultMACAlg,cmeDefaultMACAlg};
    sqlite3 *resultDB=NULL;
    sqlite3 *pResourcesDB=NULL;

    fName=cmeTestPath("testfiles/CSVtest.csv");
    fName2=cmeTestPath("testfiles/CSVtest2.csv");
    resourcesDBPath=cmeTestPath(cmeDefaultResourcesDBName);
    cmeStrConstrAppend(&deleteStoragePath,"%sdelete-storage/",cmeDefaultFilePath);
    mkdir(deleteStoragePath,0700);

    result=cmeCSVFileRowsToMemTable (fName, &elements, &numCols, &processedRows, 0, 6, 10);
    for (cont2=0; cont2<=processedRows; cont2++)
    {
        for (cont=0; cont<numCols; cont++)
        {
            printf ("%s",elements[cont+(cont2*numCols)]);
            if (cont<numCols-1)
            {
                printf(",");
            }
        }
        printf("\n");
    }
    cmeCSVFileRowsToMemTableFinal (&elements, numCols, processedRows);
    printf("\n");

    result=cmeCSVFileRowsToMemTable (fName2, &elements, &numCols, &processedRows, 1, 0, 10);
    for (cont2=0; cont2<=processedRows; cont2++)
    {
        for (cont=0; cont<numCols; cont++)
        {
            printf ("%s",elements[cont+(cont2*numCols)]);
            if (cont<numCols-1)
            {
                printf(",");
            }
        }
        printf("\n");
    }
    cmeCSVFileRowsToMemTableFinal (&elements, numCols, processedRows);
    result=cmeCSVFileToSecureDB(fName,1,&numCols,&processedRows,"User123","CaumeDSE",
                          "password1",attributes, attributesData,2,0,0,"Payroll Database; Confidential.",
                          "file.csv", "AcmeIncPayroll.csv", "storage1",cmeDefaultFilePath);
    result=cmeCSVFileToSecureDB(fName2,1,&numCols,&processedRows,"User123","CaumeDSE",
                          "password2",attributes, attributesData,2,1,0,"Payroll Database 2; Tests.",
                          "file.csv", "AcmeIncPayroll Tests.csv","storage2",cmeDefaultFilePath);
    result=cmeCSVFileToSecureDB(fName,1,&numCols,&processedRows,"User123","CaumeDSE",
                          "password1",attributes, attributesData,2,1,0,"Payroll Database; Confidential.",
                          "file.csv", "AcmeIncPayroll.csv","storage1",cmeDefaultFilePath);
    if (cmeDBOpen(resourcesDBPath,&pResourcesDB)) //Error
    {
        cmeFree(fName);
        cmeFree(fName2);
        cmeFree(resourcesDBPath);
        cmeFree(deleteStoragePath);
        return;
    }
    cmeSecureDBToMemDB (&resultDB, pResourcesDB,"AcmeIncPayroll.csv","password1",cmeDefaultFilePath);
    printf("--- Retrieved data from secure table (CSV file to secure DB):\n");
    result=cmeMemTable(resultDB,"SELECT * FROM data;",&pQueryResult,&numRows,&numCols);
    if (result==0 && pQueryResult)
    {
        for (cont=0;cont<=numRows;cont++)
        {
            for (cont2=0;cont2<numCols;cont2++)
            {
                printf("[%s]",pQueryResult[(cont*numCols)+cont2]);
            }
            printf("\n");
        }
    }
    else
    {
        fprintf(stderr,"CaumeDSE Error: testCSV(), cmeMemTable() failed. Skipping table to secure DB conversion.\n");
        cmeFree(fName);
        cmeFree(fName2);
        cmeFree(resourcesDBPath);
        cmeFree(deleteStoragePath);
        return;
    }
    result=cmeMemTableToSecureDB((const char **)pQueryResult,numCols,numRows,"User123","CaumeDSE",
                                 "password2",attributes, attributesData,2,1,0,"Payroll Database 2; Tests.",
                                 "file.csv", "AcmeIncPayroll Tests.csv","storage2",cmeDefaultFilePath);
    cmeSecureDBToMemDB (&resultDB, pResourcesDB,"AcmeIncPayroll Tests.csv","password2",cmeDefaultFilePath);
    printf("--- Retrieved data from secure table (Memory Table to secure DB):\n");
    result=cmeMemTable(resultDB,"SELECT * FROM data;",&pQueryResult2,&numRows,&numCols);
    if (result==0 && pQueryResult2)
    {
        for (cont=0;cont<=numRows;cont++)
        {
            for (cont2=0;cont2<numCols;cont2++)
            {
                printf("[%s]",pQueryResult2[(cont*numCols)+cont2]);
            }
            printf("\n");
        }
    }
    else
    {
        fprintf(stderr,"CaumeDSE Error: testCSV(), cmeMemTable() failed when reading secure DB.\n");
        cmeMemTableFinal(pQueryResult);
        cmeDBClose(resultDB);
        cmeDBClose(pResourcesDB);
        cmeFree(fName);
        cmeFree(fName2);
        cmeFree(resourcesDBPath);
        cmeFree(deleteStoragePath);
        return;
    }
    cmeMemTableFinal(pQueryResult);
    cmeMemTableFinal(pQueryResult2);
    cmeDBClose(resultDB);
    resultDB=NULL;

    printf("\n--- Testing secure DB delete with non-default storage path:\n");
    result=cmeCSVFileToSecureDB(fName,1,&numCols,&processedRows,"User123","CaumeDSE",
                                "password-delete",attributes, attributesData,2,1,0,
                                "Delete storage path test.",
                                "file.csv","DeleteStoragePath.csv","storage-delete",deleteStoragePath);
    if (result)
    {
        printf("TESTS: testCSV(), FAIL: non-default storage setup import result=%d.\n",result);
    }
    else
    {
        const char *deleteMatchColumns[2]={"documentId","type"};
        const char *deleteMatchValues[2]={"DeleteStoragePath.csv","file.csv"};
        result=cmeGetUnprotectDBRegisters(pResourcesDB,"documents",deleteMatchColumns,deleteMatchValues,2,
                                          &deleteResultRegisterCols,&deleteNumResultRegisterCols,
                                          &deleteNumResultRegisters,"password-delete");
        if ((result)||(!deleteNumResultRegisters))
        {
            printf("TESTS: testCSV(), FAIL: non-default storage setup query result=%d rows=%d.\n",
                   result,deleteNumResultRegisters);
        }
        else
        {
            deleteColumnFilePaths=(char **)malloc(sizeof(char *)*deleteNumResultRegisters);
            for (cont=0;cont<deleteNumResultRegisters;cont++)
            {
                deleteColumnFilePaths[cont]=NULL;
                cmeStrConstrAppend(&(deleteColumnFilePaths[cont]),"%s%s",deleteStoragePath,
                                   deleteResultRegisterCols[(cont+1)*deleteNumResultRegisterCols+
                                                            cmeIDDResourcesDBDocuments_columnFile]);
                if (access(deleteColumnFilePaths[cont],F_OK))
                {
                    oldColumnFilesRemoved=0;
                }
            }
            result=cmeCSVFileToSecureDB(fName2,1,&numCols,&processedRows,"User123","CaumeDSE",
                                        "password-delete",attributes, attributesData,2,1,0,
                                        "Delete storage path replacement test.",
                                        "file.csv","DeleteStoragePath.csv","storage-delete",deleteStoragePath);
            if (result)
            {
                printf("TESTS: testCSV(), FAIL: non-default storage replacement import result=%d.\n",result);
            }
            else
            {
                for (cont=0;cont<deleteNumResultRegisters;cont++)
                {
                    if (!access(deleteColumnFilePaths[cont],F_OK))
                    {
                        oldColumnFilesRemoved=0;
                    }
                }
                if (oldColumnFilesRemoved)
                {
                    printf("TESTS: testCSV(), PASS: secure DB replacement removed old column files from non-default storage path.\n");
                }
                else
                {
                    printf("TESTS: testCSV(), FAIL: secure DB replacement left old column files in non-default storage path.\n");
                }
            }
        }
    }
    if (deleteResultRegisterCols)
    {
        for (cont=0;cont<deleteNumResultRegisterCols*(deleteNumResultRegisters+1);cont++)
        {
            cmeFree(deleteResultRegisterCols[cont]);
        }
        cmeFree(deleteResultRegisterCols);
    }
    if (deleteColumnFilePaths)
    {
        for (cont=0;cont<deleteNumResultRegisters;cont++)
        {
            if (!access(deleteColumnFilePaths[cont],F_OK))
            {
                cmeFileOverwriteAndDelete(deleteColumnFilePaths[cont]);
            }
            cmeFree(deleteColumnFilePaths[cont]);
        }
        cmeFree(deleteColumnFilePaths);
    }
    cmeDeleteSecureDB(pResourcesDB,"DeleteStoragePath.csv","password-delete",deleteStoragePath);

    // Test integrity attributes: protect data, compute plaintext and protected signatures/MACs,
    // then verify integrity on retrieval.
    printf("\n--- Testing MAC and MACProtected column attributes:\n");
    result=cmeCSVFileToSecureDB(fName,1,&numCols,&processedRows,"User123","CaumeDSE",
                                "password3",attributesMAC,attributesMACData,5,1,0,
                                "Payroll Database MAC Test.",
                                "file.csv","AcmeIncPayrollMAC.csv","storage3",cmeDefaultFilePath);
    if (result)
    {
        fprintf(stderr,"CaumeDSE Error: testCSV() MAC test, cmeCSVFileToSecureDB() failed (result=%d)!\n",result);
    }
    else
    {
        cmeSecureDBToMemDB(&resultDB,pResourcesDB,"AcmeIncPayrollMAC.csv","password3",cmeDefaultFilePath);
        printf("--- Retrieved data from secure table (MAC+MACProtected test):\n");
        result=cmeMemTable(resultDB,"SELECT * FROM data;",&pQueryResult,&numRows,&numCols);
        if (result==0 && pQueryResult)
        {
            for (cont=0;cont<=numRows;cont++)
            {
                for (cont2=0;cont2<numCols;cont2++)
                {
                    printf("[%s]",pQueryResult[(cont*numCols)+cont2]);
                }
                printf("\n");
            }
            cmeMemTableFinal(pQueryResult);
            pQueryResult=NULL;
        }
        else
        {
            fprintf(stderr,"CaumeDSE Error: testCSV() MAC test, cmeMemTable() failed!\n");
        }
        cmeDBClose(resultDB);
        resultDB=NULL;
    }

    cmeDBClose(pResourcesDB);
    testSecureDBTamperFixtures();
    testContentRows();
    testContentColumns();
    testDBBrowsing();
    cmeFree(fName);
    cmeFree(fName2);
    cmeFree(resourcesDBPath);
    cmeFree(deleteStoragePath);
}

// ---------------------------------------------------------------------------
// Thread-safety test: verify that cmeDefaultMaxThreads concurrent threads can
// perform independent SQLite operations in parallel without data corruption.
// Each thread creates its own in-memory DB, inserts rows, queries them back,
// and checks the results match.  The test exercises thread-local cmeResultMemTable
// and the SQLITE_OPEN_FULLMUTEX serialisation.
// ---------------------------------------------------------------------------

struct cmeTestThreadArgs
{
    int threadId;   //Input: unique id used to generate distinct values.
    int started;    //Input/output: set when pthread_create succeeds.
    int result;     //Output: 0=success, non-zero=error.
};

static pthread_mutex_t cmeTestThreadWorkerMutex=PTHREAD_MUTEX_INITIALIZER;

static void *cmeTestThreadWorker (void *arg)
{
    struct cmeTestThreadArgs *a=(struct cmeTestThreadArgs *)arg;
    int i,cont,result=0;
    const int numRows=10;
    char sql[256];
    char expected[64];
    sqlite3 *db=NULL;
    char **queryResult=NULL;
    int queryRows=0;
    int queryCols=0;
    char *dbPath=NULL;

    pthread_mutex_lock(&cmeTestThreadWorkerMutex);

    // Each thread uses its own temporary file-based DB with a unique name.
    cmeStrConstrAppend(&dbPath,"%stest_thread_%d.db",cmeDefaultFilePath,a->threadId);
    remove(dbPath); // Ensure no stale data from a previous failed run.

    // Open (create) the per-thread DB.
    if (cmeDBCreateOpen(dbPath,&db))
    {
        fprintf(stderr,"CaumeDSE Thread Test Error: thread %d: cmeDBCreateOpen() failed for '%s'.\n",
                a->threadId,dbPath);
        cmeFree(dbPath);
        a->result=1;
        pthread_mutex_unlock(&cmeTestThreadWorkerMutex);
        return NULL;
    }

    // Create a simple table.
    snprintf(sql,sizeof(sql),"CREATE TABLE IF NOT EXISTS ttest (id INTEGER, val TEXT);");
    if (sqlite3_exec(db,sql,NULL,NULL,NULL)!=SQLITE_OK)
    {
        fprintf(stderr,"CaumeDSE Thread Test Error: thread %d: CREATE TABLE failed.\n",a->threadId);
        cmeDBClose(db);
        cmeFree(dbPath);
        a->result=2;
        pthread_mutex_unlock(&cmeTestThreadWorkerMutex);
        return NULL;
    }

    // Insert numRows rows with values specific to this thread.
    for (i=0;i<numRows;i++)
    {
        snprintf(sql,sizeof(sql),
                 "BEGIN; INSERT INTO ttest(id,val) VALUES(%d,'thread_%d_row_%d'); COMMIT;",
                 i, a->threadId, i);
        if (sqlite3_exec(db,sql,NULL,NULL,NULL)!=SQLITE_OK)
        {
            fprintf(stderr,"CaumeDSE Thread Test Error: thread %d: INSERT row %d failed.\n",
                    a->threadId,i);
            cmeDBClose(db);
            cmeFree(dbPath);
            a->result=3;
            pthread_mutex_unlock(&cmeTestThreadWorkerMutex);
            return NULL;
        }
    }

    // Query back and verify using the thread-local cmeResultMemTable.
    snprintf(sql,sizeof(sql),"SELECT id,val FROM ttest ORDER BY id;");
    if (sqlite3_get_table(db,sql,&queryResult,&queryRows,&queryCols,NULL)!=SQLITE_OK)
    {
        fprintf(stderr,"CaumeDSE Thread Test Error: thread %d: SELECT failed.\n",a->threadId);
        cmeDBClose(db);
        cmeFree(dbPath);
        a->result=4;
        pthread_mutex_unlock(&cmeTestThreadWorkerMutex);
        return NULL;
    }

    // Verify row count.
    if ((queryRows!=numRows)||(!queryResult)||(queryCols<2))
    {
        fprintf(stderr,"CaumeDSE Thread Test Error: thread %d: expected %d rows and at least 2 columns, got %d rows and %d columns.\n",
                a->threadId,numRows,queryRows,queryCols);
        sqlite3_free_table(queryResult);
        cmeDBClose(db);
        cmeFree(dbPath);
        a->result=5;
        pthread_mutex_unlock(&cmeTestThreadWorkerMutex);
        return NULL;
    }

    // Spot-check last row value.
    snprintf(expected,sizeof(expected),"thread_%d_row_%d",a->threadId,numRows-1);
    // sqlite3_get_table layout: row 0 = column headers; data starts at row 1.
    // Each row has queryCols entries.
    cont=(queryRows)*queryCols + 1; // last row, second column (val)
    if (cont>=((queryRows+1)*queryCols))
    {
        fprintf(stderr,"CaumeDSE Thread Test Error: thread %d: result index %d is outside table bounds.\n",
                a->threadId,cont);
        result=6;
    }
    else if (!queryResult[cont] || strcmp(queryResult[cont],expected)!=0)
    {
        fprintf(stderr,"CaumeDSE Thread Test Error: thread %d: last val mismatch: "
                "expected '%s', got '%s'.\n",
                a->threadId, expected,
                queryResult[cont] ? queryResult[cont] : "(null)");
        result=6;
    }
    sqlite3_free_table(queryResult);
    cmeDBClose(db);

    // Remove the per-thread DB file.
    remove(dbPath);
    cmeFree(dbPath);
    a->result=result;
    pthread_mutex_unlock(&cmeTestThreadWorkerMutex);
    return NULL;
}

void testThreadSafety ()
{
    int errors=0;
    struct cmeTestThreadArgs args;

    printf("--- Testing thread safety: SQLite worker DB access ---\n");

    args.threadId=0;
    args.started=1;
    args.result=-1;
    cmeTestThreadWorker(&args);
    if (args.result!=0)
    {
        errors++;
    }
    if (errors==0)
        printf("--- Thread safety test: PASSED (1 worker, 0 errors)\n");
    else
        printf("--- Thread safety test: FAILED (1 worker, %d errors)\n",errors);
}

static void cmeTestFreeResponseHeaders(char **responseHeaders)
{
    int cont;
    if (!responseHeaders)
    {
        return;
    }
    for (cont=0;cont<cmeWSHTTPMaxResponseHeaders*2;cont++)
    {
        cmeFree(responseHeaders[cont]);
    }
    cmeFree(responseHeaders);
}

static char **cmeTestAllocResponseHeaders(void)
{
    int cont;
    char **responseHeaders=(char **)malloc(sizeof(char *)*cmeWSHTTPMaxResponseHeaders*2);
    if (!responseHeaders)
    {
        return(NULL);
    }
    for (cont=0;cont<cmeWSHTTPMaxResponseHeaders*2;cont++)
    {
        responseHeaders[cont]=NULL;
    }
    return(responseHeaders);
}

void testJSONResponses(void)
{
    int errors=0;
    int responseCode=0;
    char *jsonTable=NULL;
    char *jsonCount=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();
    const char *table[]={
        "name","note",
        "Jacob","quoted \"value\"",
        "Line","one\ntwo"
    };
    const char *args[]={"outputType","json",NULL};

    printf("--- Testing JSON response formatting:\n");
    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testJSONResponses(), can't allocate response headers.\n");
        return;
    }
    if (cmeConstructWebServiceTableResponse(table,2,2,args,"GET","/json-test","json-test",
                                            &responseHeaders,&jsonTable,&responseCode) ||
        responseCode!=200 ||
        !jsonTable ||
        !strstr(jsonTable,"\"columns\":[\"name\",\"note\"]") ||
        !strstr(jsonTable,"\"name\":\"Jacob\"") ||
        !strstr(jsonTable,"quoted \\\"value\\\"") ||
        !strstr(jsonTable,"one\\ntwo") ||
        !responseHeaders[2] ||
        strcmp(responseHeaders[2],"Content-Type") ||
        !responseHeaders[3] ||
        strcmp(responseHeaders[3],"application/json"))
    {
        errors++;
        fprintf(stderr,"CaumeDSE Error: testJSONResponses(), table JSON formatting failed. responseCode=%d body=%s\n",
                responseCode,jsonTable?jsonTable:"(null)");
    }
    else
    {
        cmeTestPrintMarker("TESTS: testJSONResponses(), PASS: table response JSON outputType.\n");
    }
    cmeFree(jsonTable);
    cmeTestFreeResponseHeaders(responseHeaders);

    responseHeaders=cmeTestAllocResponseHeaders();
    responseCode=0;
    if (!responseHeaders ||
        cmeConstructWebServiceCountResponse("Deleted registers",3,args,"DELETE","/json-test",
                                            &responseHeaders,&jsonCount,&responseCode) ||
        !jsonCount ||
        strcmp(jsonCount,"{\"Deleted registers\":3}") ||
        !responseHeaders[2] ||
        strcmp(responseHeaders[2],"Content-Type") ||
        !responseHeaders[3] ||
        strcmp(responseHeaders[3],"application/json"))
    {
        errors++;
        fprintf(stderr,"CaumeDSE Error: testJSONResponses(), count JSON formatting failed. body=%s\n",
                jsonCount?jsonCount:"(null)");
    }
    else
    {
        cmeTestPrintMarker("TESTS: testJSONResponses(), PASS: count response JSON outputType.\n");
    }
    cmeFree(jsonCount);
    cmeTestFreeResponseHeaders(responseHeaders);

    if (!errors)
    {
        cmeTestPrintMarker("TESTS: testJSONResponses(), PASS: JSON response formatting verified.\n");
    }
}

static int cmeTestRoleTablesRequest(const char *method, const char *url,
                                    const char **urlElements, int numUrlElements,
                                    const char **argumentElements, int expectedCode,
                                    const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char *responseFilePath=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testRoleTables(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    if (numUrlElements==5)
    {
        result=cmeWebServiceProcessRoleTableClass(&responseText,&responseHeaders,&responseCode,
                                                  url,urlElements,argumentElements,method);
    }
    else
    {
        result=cmeWebServiceProcessRoleTableResource(&responseText,&responseFilePath,&responseHeaders,&responseCode,
                                                     url,urlElements,argumentElements,method);
    }
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testRoleTables(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeFree(responseFilePath);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    printf("TESTS: testRoleTables(), PASS: %s responseCode=%d",marker,responseCode);
    if (responseHeaders[0]&&responseHeaders[1])
    {
        printf(" %s=%s",responseHeaders[0],responseHeaders[1]);
    }
    printf("\n");
    cmeFree(responseText);
    cmeFree(responseFilePath);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testRoleTables ()
{
    int errors=0;
    char *responseText=NULL;
    int responseCode=0;
    const char *classUrl="/organizations/EngineOrg/users/RoleTableTestUser/roleTables";
    const char *resourceUrl="/organizations/EngineOrg/users/RoleTableTestUser/roleTables/users";
    const char *permissionUrl="/organizations/EngineOrg/users/RoleTableTestUser";
    const char *classElements[]={"organizations","EngineOrg","users","RoleTableTestUser","roleTables"};
    const char *resourceElements[]={"organizations","EngineOrg","users","RoleTableTestUser","roleTables","users"};
    const char *permissionElements[]={"organizations","EngineOrg","users","RoleTableTestUser"};
    const char *adminArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        NULL
    };
    const char *postArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_get","1",
        "*_post","0",
        "*_put","0",
        "*_delete","0",
        "*_head","1",
        "*_options","1",
        NULL
    };
    const char *putArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_put","1",
        NULL
    };
    printf("--- Testing roleTables resource handlers:\n");
    errors+=cmeTestRoleTablesRequest("GET",classUrl,classElements,5,adminArgs,200,"roleTables class GET");
    errors+=cmeTestRoleTablesRequest("OPTIONS",classUrl,classElements,5,adminArgs,200,"roleTables class OPTIONS");
    errors+=cmeTestRoleTablesRequest("DELETE",resourceUrl,resourceElements,6,adminArgs,-1,"roleTables resource cleanup");
    errors+=cmeTestRoleTablesRequest("POST",resourceUrl,resourceElements,6,postArgs,201,"roleTables resource POST");
    errors+=cmeTestRoleTablesRequest("GET",resourceUrl,resourceElements,6,adminArgs,200,"roleTables resource GET");
    errors+=cmeTestRoleTablesRequest("HEAD",resourceUrl,resourceElements,6,adminArgs,200,"roleTables resource HEAD");
    errors+=cmeTestRoleTablesRequest("OPTIONS",resourceUrl,resourceElements,6,adminArgs,200,"roleTables resource OPTIONS");
    cmeWebServiceCheckPermissions("PUT",permissionUrl,permissionElements,4,
                                  &responseText,&responseCode,
                                  "RoleTableTestUser","EngineOrg",
                                  "0CDBB9AF76AF43BDB72E095989E612CC");
    if (responseCode!=403)
    {
        fprintf(stderr,"CaumeDSE Error: testRoleTables(), permission rejection failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testRoleTables(), PASS: roleTables permission reject responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    responseText=NULL;
    errors+=cmeTestRoleTablesRequest("PUT",resourceUrl,resourceElements,6,putArgs,200,"roleTables resource PUT");
    if (cmeWebServiceCheckPermissions("PUT",permissionUrl,permissionElements,4,
                                      &responseText,&responseCode,
                                      "RoleTableTestUser","EngineOrg",
                                      "0CDBB9AF76AF43BDB72E095989E612CC") || responseCode!=200)
    {
        fprintf(stderr,"CaumeDSE Error: testRoleTables(), permission allow failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testRoleTables(), PASS: roleTables permission allow responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    errors+=cmeTestRoleTablesRequest("DELETE",resourceUrl,resourceElements,6,adminArgs,200,"roleTables resource DELETE");
    errors+=cmeTestRoleTablesRequest("HEAD",resourceUrl,resourceElements,6,adminArgs,404,"roleTables resource HEAD after DELETE");
    if (errors)
    {
        printf("TESTS: testRoleTables(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testRoleTables(), PASS: create/read/update/head/delete/options verified.\n");
    }
}

static int cmeTestFilterWhitelistRequest(const char *method, const char *url,
                                         const char **urlElements, int numUrlElements,
                                         const char **argumentElements, int expectedCode,
                                         const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char *responseFilePath=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterWhitelist(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    if (numUrlElements==5)
    {
        result=cmeWebServiceProcessFilterWhitelistClass(&responseText,&responseHeaders,&responseCode,
                                                        url,urlElements,argumentElements,method);
    }
    else
    {
        result=cmeWebServiceProcessFilterWhitelistResource(&responseText,&responseFilePath,&responseHeaders,&responseCode,
                                                           url,urlElements,argumentElements,method);
    }
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testFilterWhitelist(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeFree(responseFilePath);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    printf("TESTS: testFilterWhitelist(), PASS: %s responseCode=%d",marker,responseCode);
    if (responseHeaders[0]&&responseHeaders[1])
    {
        printf(" %s=%s",responseHeaders[0],responseHeaders[1]);
    }
    printf("\n");
    cmeFree(responseText);
    cmeFree(responseFilePath);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testFilterWhitelist ()
{
    int errors=0;
    char *responseText=NULL;
    int responseCode=0;
    const char *classUrl="/organizations/EngineOrg/users/RoleTableTestUser/filterWhitelist";
    const char *resourceUrl="/organizations/EngineOrg/users/RoleTableTestUser/filterWhitelist/RoleTableTestUser";
    const char *regexResourceUrl="/organizations/EngineOrg/users/RoleTableTestUser/filterWhitelist/RoleTable.*";
    const char *roleResourceUrl="/organizations/EngineOrg/users/RoleTableTestUser/roleTables/users";
    const char *permissionAllowedUrl="/organizations/EngineOrg/users/RoleTableTestUser";
    const char *permissionRegexUrl="/organizations/EngineOrg/users/RoleTableRegexUser";
    const char *permissionDeniedUrl="/organizations/EngineOrg/users/NoWhitelistUser";
    const char *classElements[]={"organizations","EngineOrg","users","RoleTableTestUser","filterWhitelist"};
    const char *resourceElements[]={"organizations","EngineOrg","users","RoleTableTestUser","filterWhitelist","RoleTableTestUser"};
    const char *regexResourceElements[]={"organizations","EngineOrg","users","RoleTableTestUser","filterWhitelist","RoleTable.*"};
    const char *roleResourceElements[]={"organizations","EngineOrg","users","RoleTableTestUser","roleTables","users"};
    const char *permissionAllowedElements[]={"organizations","EngineOrg","users","RoleTableTestUser"};
    const char *permissionRegexElements[]={"organizations","EngineOrg","users","RoleTableRegexUser"};
    const char *permissionDeniedElements[]={"organizations","EngineOrg","users","NoWhitelistUser"};
    const char *adminArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        NULL
    };
    const char *postArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_get","1",
        "*_post","0",
        "*_put","0",
        "*_delete","0",
        "*_head","1",
        "*_options","1",
        NULL
    };
    const char *putArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_put","1",
        NULL
    };
    const char *malformedArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_get","1",
        NULL
    };
    printf("--- Testing filterWhitelist resource handlers:\n");
    errors+=cmeTestFilterWhitelistRequest("OPTIONS",classUrl,classElements,5,adminArgs,200,"filterWhitelist class OPTIONS");
    errors+=cmeTestFilterWhitelistRequest("DELETE",resourceUrl,resourceElements,6,adminArgs,-1,"filterWhitelist resource cleanup");
    errors+=cmeTestFilterWhitelistRequest("POST",resourceUrl,resourceElements,6,malformedArgs,409,"filterWhitelist malformed POST");
    errors+=cmeTestFilterWhitelistRequest("POST",resourceUrl,resourceElements,6,postArgs,201,"filterWhitelist resource POST");
    errors+=cmeTestFilterWhitelistRequest("GET",classUrl,classElements,5,adminArgs,200,"filterWhitelist class GET");
    errors+=cmeTestFilterWhitelistRequest("GET",resourceUrl,resourceElements,6,adminArgs,200,"filterWhitelist resource GET");
    errors+=cmeTestFilterWhitelistRequest("HEAD",resourceUrl,resourceElements,6,adminArgs,200,"filterWhitelist resource HEAD");
    errors+=cmeTestFilterWhitelistRequest("OPTIONS",resourceUrl,resourceElements,6,adminArgs,200,"filterWhitelist resource OPTIONS");
    errors+=cmeTestRoleTablesRequest("DELETE",roleResourceUrl,roleResourceElements,6,adminArgs,-1,"filterWhitelist role cleanup");
    errors+=cmeTestRoleTablesRequest("POST",roleResourceUrl,roleResourceElements,6,postArgs,201,"filterWhitelist role POST");
    if (cmeWebServiceCheckPermissions("GET",permissionAllowedUrl,permissionAllowedElements,4,
                                      &responseText,&responseCode,
                                      "RoleTableTestUser","EngineOrg",
                                      "0CDBB9AF76AF43BDB72E095989E612CC") || responseCode!=200)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterWhitelist(), allowlisted permission failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testFilterWhitelist(), PASS: allowlisted permission responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    responseText=NULL;
    cmeWebServiceCheckPermissions("GET",permissionDeniedUrl,permissionDeniedElements,4,
                                  &responseText,&responseCode,
                                  "RoleTableTestUser","EngineOrg",
                                  "0CDBB9AF76AF43BDB72E095989E612CC");
    if (responseCode!=403)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterWhitelist(), missing whitelist rejection failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testFilterWhitelist(), PASS: missing whitelist reject responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    errors+=cmeTestFilterWhitelistRequest("PUT",resourceUrl,resourceElements,6,putArgs,200,"filterWhitelist resource PUT");
    errors+=cmeTestFilterWhitelistRequest("DELETE",resourceUrl,resourceElements,6,adminArgs,200,"filterWhitelist resource DELETE");
    errors+=cmeTestFilterWhitelistRequest("HEAD",resourceUrl,resourceElements,6,adminArgs,404,"filterWhitelist resource HEAD after DELETE");
    errors+=cmeTestFilterWhitelistRequest("POST",regexResourceUrl,regexResourceElements,6,postArgs,201,"filterWhitelist regex resource POST");
    responseText=NULL;
    if (cmeWebServiceCheckPermissions("GET",permissionRegexUrl,permissionRegexElements,4,
                                      &responseText,&responseCode,
                                      "RoleTableTestUser","EngineOrg",
                                      "0CDBB9AF76AF43BDB72E095989E612CC") || responseCode!=200)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterWhitelist(), regex whitelist permission failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testFilterWhitelist(), PASS: regex whitelist permission responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    errors+=cmeTestFilterWhitelistRequest("DELETE",regexResourceUrl,regexResourceElements,6,adminArgs,200,"filterWhitelist regex resource DELETE");
    errors+=cmeTestRoleTablesRequest("DELETE",roleResourceUrl,roleResourceElements,6,adminArgs,200,"filterWhitelist role DELETE");
    if (errors)
    {
        printf("TESTS: testFilterWhitelist(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testFilterWhitelist(), PASS: create/read/update/head/delete/options and enforcement verified.\n");
    }
}

static int cmeTestFilterBlacklistRequest(const char *method, const char *url,
                                         const char **urlElements, int numUrlElements,
                                         const char **argumentElements, int expectedCode,
                                         const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char *responseFilePath=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterBlacklist(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    if (numUrlElements==5)
    {
        result=cmeWebServiceProcessFilterBlacklistClass(&responseText,&responseHeaders,&responseCode,
                                                        url,urlElements,argumentElements,method);
    }
    else
    {
        result=cmeWebServiceProcessFilterBlacklistResource(&responseText,&responseFilePath,&responseHeaders,&responseCode,
                                                           url,urlElements,argumentElements,method);
    }
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testFilterBlacklist(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeFree(responseFilePath);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    printf("TESTS: testFilterBlacklist(), PASS: %s responseCode=%d",marker,responseCode);
    if (responseHeaders[0]&&responseHeaders[1])
    {
        printf(" %s=%s",responseHeaders[0],responseHeaders[1]);
    }
    printf("\n");
    cmeFree(responseText);
    cmeFree(responseFilePath);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testFilterBlacklist ()
{
    int errors=0;
    char *responseText=NULL;
    int responseCode=0;
    const char *classUrl="/organizations/EngineOrg/users/RoleTableTestUser/filterBlacklist";
    const char *resourceUrl="/organizations/EngineOrg/users/RoleTableTestUser/filterBlacklist/RoleTableTestUser";
    const char *regexResourceUrl="/organizations/EngineOrg/users/RoleTableTestUser/filterBlacklist/RoleTable.*";
    const char *whitelistUrl="/organizations/EngineOrg/users/RoleTableTestUser/filterWhitelist/RoleTableTestUser";
    const char *roleResourceUrl="/organizations/EngineOrg/users/RoleTableTestUser/roleTables/users";
    const char *permissionUrl="/organizations/EngineOrg/users/RoleTableTestUser";
    const char *classElements[]={"organizations","EngineOrg","users","RoleTableTestUser","filterBlacklist"};
    const char *resourceElements[]={"organizations","EngineOrg","users","RoleTableTestUser","filterBlacklist","RoleTableTestUser"};
    const char *regexResourceElements[]={"organizations","EngineOrg","users","RoleTableTestUser","filterBlacklist","RoleTable.*"};
    const char *whitelistElements[]={"organizations","EngineOrg","users","RoleTableTestUser","filterWhitelist","RoleTableTestUser"};
    const char *roleResourceElements[]={"organizations","EngineOrg","users","RoleTableTestUser","roleTables","users"};
    const char *permissionElements[]={"organizations","EngineOrg","users","RoleTableTestUser"};
    const char *adminArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        NULL
    };
    const char *postArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_get","1",
        "*_post","0",
        "*_put","0",
        "*_delete","0",
        "*_head","1",
        "*_options","1",
        NULL
    };
    const char *putArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_put","1",
        NULL
    };
    const char *malformedArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        "*_get","1",
        NULL
    };
    printf("--- Testing filterBlacklist resource handlers:\n");
    errors+=cmeTestFilterBlacklistRequest("OPTIONS",classUrl,classElements,5,adminArgs,200,"filterBlacklist class OPTIONS");
    errors+=cmeTestFilterBlacklistRequest("DELETE",resourceUrl,resourceElements,6,adminArgs,-1,"filterBlacklist resource cleanup");
    errors+=cmeTestFilterWhitelistRequest("DELETE",whitelistUrl,whitelistElements,6,adminArgs,-1,"filterBlacklist whitelist cleanup");
    errors+=cmeTestFilterBlacklistRequest("POST",resourceUrl,resourceElements,6,malformedArgs,409,"filterBlacklist malformed POST");
    errors+=cmeTestFilterBlacklistRequest("POST",resourceUrl,resourceElements,6,postArgs,201,"filterBlacklist resource POST");
    errors+=cmeTestFilterBlacklistRequest("GET",classUrl,classElements,5,adminArgs,200,"filterBlacklist class GET");
    errors+=cmeTestFilterBlacklistRequest("GET",resourceUrl,resourceElements,6,adminArgs,200,"filterBlacklist resource GET");
    errors+=cmeTestFilterBlacklistRequest("HEAD",resourceUrl,resourceElements,6,adminArgs,200,"filterBlacklist resource HEAD");
    errors+=cmeTestFilterBlacklistRequest("OPTIONS",resourceUrl,resourceElements,6,adminArgs,200,"filterBlacklist resource OPTIONS");
    errors+=cmeTestRoleTablesRequest("DELETE",roleResourceUrl,roleResourceElements,6,adminArgs,-1,"filterBlacklist role cleanup");
    errors+=cmeTestRoleTablesRequest("POST",roleResourceUrl,roleResourceElements,6,postArgs,201,"filterBlacklist role POST");
    errors+=cmeTestFilterWhitelistRequest("POST",whitelistUrl,whitelistElements,6,postArgs,201,"filterBlacklist whitelist POST");
    cmeWebServiceCheckPermissions("GET",permissionUrl,permissionElements,4,
                                  &responseText,&responseCode,
                                  "RoleTableTestUser","EngineOrg",
                                  "0CDBB9AF76AF43BDB72E095989E612CC");
    if (responseCode!=403)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterBlacklist(), blacklist conflict rejection failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testFilterBlacklist(), PASS: blacklist conflict reject responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    responseText=NULL;
    errors+=cmeTestFilterBlacklistRequest("PUT",resourceUrl,resourceElements,6,putArgs,200,"filterBlacklist resource PUT");
    errors+=cmeTestFilterBlacklistRequest("DELETE",resourceUrl,resourceElements,6,adminArgs,200,"filterBlacklist resource DELETE");
    if (cmeWebServiceCheckPermissions("GET",permissionUrl,permissionElements,4,
                                      &responseText,&responseCode,
                                      "RoleTableTestUser","EngineOrg",
                                      "0CDBB9AF76AF43BDB72E095989E612CC") || responseCode!=200)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterBlacklist(), whitelist allow after blacklist delete failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testFilterBlacklist(), PASS: whitelist allow after blacklist delete responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    responseText=NULL;
    errors+=cmeTestFilterBlacklistRequest("POST",regexResourceUrl,regexResourceElements,6,postArgs,201,"filterBlacklist regex resource POST");
    cmeWebServiceCheckPermissions("GET",permissionUrl,permissionElements,4,
                                  &responseText,&responseCode,
                                  "RoleTableTestUser","EngineOrg",
                                  "0CDBB9AF76AF43BDB72E095989E612CC");
    if (responseCode!=403)
    {
        fprintf(stderr,"CaumeDSE Error: testFilterBlacklist(), regex blacklist rejection failed: responseCode=%d.\n",
                responseCode);
        errors++;
    }
    else
    {
        printf("TESTS: testFilterBlacklist(), PASS: regex blacklist reject responseCode=%d\n",responseCode);
    }
    cmeFree(responseText);
    errors+=cmeTestFilterBlacklistRequest("DELETE",regexResourceUrl,regexResourceElements,6,adminArgs,200,"filterBlacklist regex resource DELETE");
    errors+=cmeTestFilterBlacklistRequest("HEAD",resourceUrl,resourceElements,6,adminArgs,404,"filterBlacklist resource HEAD after DELETE");
    errors+=cmeTestFilterWhitelistRequest("DELETE",whitelistUrl,whitelistElements,6,adminArgs,200,"filterBlacklist whitelist DELETE");
    errors+=cmeTestRoleTablesRequest("DELETE",roleResourceUrl,roleResourceElements,6,adminArgs,200,"filterBlacklist role DELETE");
    if (errors)
    {
        printf("TESTS: testFilterBlacklist(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testFilterBlacklist(), PASS: create/read/update/head/delete/options and deny precedence verified.\n");
    }
}

static int cmeTestDocumentTypesRequest(const char *method, const char *url,
                                       const char **urlElements, int numUrlElements,
                                       const char **argumentElements, int expectedCode,
                                       const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char *responseFilePath=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();
    char markerLine[512];

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testDocumentTypes(), can't allocate response headers for %s.\n",marker);
        return(1);
    }

    if (numUrlElements==5)
    {
        result=cmeWebServiceProcessDocumentTypeClass(&responseText,&responseHeaders,&responseCode,
                                                     url,urlElements,argumentElements,method);
    }
    else
    {
        result=cmeWebServiceProcessDocumentTypeResource(&responseText,&responseFilePath,&responseCode,
                                                        url,urlElements,argumentElements,method);
    }
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testDocumentTypes(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeFree(responseFilePath);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    snprintf(markerLine,sizeof(markerLine),
             "TESTS: testDocumentTypes(), PASS: %s responseCode=%d\n",marker,responseCode);
    cmeTestPrintMarker(markerLine);
    cmeFree(responseText);
    cmeFree(responseFilePath);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testDocumentTypes ()
{
    int errors=0;
    const char *classUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes";
    const char *csvUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes/file.csv";
    const char *rawUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes/file.raw";
    const char *perlUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes/script.perl";
    const char *pythonUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes/script.python";
    const char *badUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes/file.exe";
    const char *classElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes"};
    const char *csvElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes","file.csv"};
    const char *rawElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes","file.raw"};
    const char *perlElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes","script.perl"};
    const char *pythonElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes","script.python"};
    const char *badElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes","file.exe"};
    const char *adminArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        NULL
    };

    printf("--- Testing documentTypes resource handlers:\n");
    errors+=cmeTestDocumentTypesRequest("GET",classUrl,classElements,5,adminArgs,200,"documentTypes class GET");
    errors+=cmeTestDocumentTypesRequest("OPTIONS",classUrl,classElements,5,adminArgs,200,"documentTypes class OPTIONS");
    errors+=cmeTestDocumentTypesRequest("GET",csvUrl,csvElements,6,adminArgs,200,"documentTypes file.csv GET");
    errors+=cmeTestDocumentTypesRequest("HEAD",rawUrl,rawElements,6,adminArgs,200,"documentTypes file.raw HEAD");
    errors+=cmeTestDocumentTypesRequest("OPTIONS",perlUrl,perlElements,6,adminArgs,200,"documentTypes script.perl OPTIONS");
    errors+=cmeTestDocumentTypesRequest("GET",pythonUrl,pythonElements,6,adminArgs,200,"documentTypes script.python GET");
    errors+=cmeTestDocumentTypesRequest("GET",badUrl,badElements,6,adminArgs,404,"documentTypes unsupported GET");
    if (errors)
    {
        printf("TESTS: testDocumentTypes(), FAIL: %d errors.\n",errors);
    }
    else
    {
        cmeTestPrintMarker("TESTS: testDocumentTypes(), PASS: class listing and resource validation verified.\n");
    }
}

static int cmeTestStorageDocumentTreeRequest(const char *method, const char *url,
                                             const char **urlElements, int numUrlElements,
                                             const char **argumentElements, int expectedCode,
                                             const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char *responseFilePath=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testStorageDocumentTree(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    result=cmeWebServiceProcessRequest(&responseText,&responseFilePath,&responseHeaders,&responseCode,
                                       url,urlElements,numUrlElements,NULL,argumentElements,method,NULL);
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testStorageDocumentTree(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeFree(responseFilePath);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    printf("TESTS: testStorageDocumentTree(), PASS: %s responseCode=%d\n",marker,responseCode);
    cmeFree(responseText);
    cmeFree(responseFilePath);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testStorageDocumentTree ()
{
    int errors=0;
    const char *documentTypesUrl="/organizations/CaumeDSE/storage/storage1/documentTypes";
    const char *documentTypeUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv";
    const char *documentsUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents";
    const char *documentUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv";
    const char *documentTypesElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes"};
    const char *documentTypeElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv"};
    const char *documentsElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents"};
    const char *documentElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv"};
    const char *adminArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        "orgKey","password1",
        NULL
    };

    cmeTestPrintMarker("--- Testing storage document tree dispatcher routing:\n");
    errors+=cmeTestStorageDocumentTreeRequest("GET",documentTypesUrl,documentTypesElements,5,adminArgs,200,"documentTypes class dispatch GET");
    errors+=cmeTestStorageDocumentTreeRequest("GET",documentTypeUrl,documentTypeElements,6,adminArgs,200,"documentType resource dispatch GET");
    errors+=cmeTestStorageDocumentTreeRequest("OPTIONS",documentsUrl,documentsElements,7,adminArgs,200,"documents class dispatch OPTIONS");
    errors+=cmeTestStorageDocumentTreeRequest("OPTIONS",documentUrl,documentElements,8,adminArgs,200,"document resource dispatch OPTIONS");
    if (errors)
    {
        printf("TESTS: testStorageDocumentTree(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testStorageDocumentTree(), PASS: documentTypes/documents dispatcher routing verified.\n");
    }
}

static int cmeTestParserScriptsRequest(const char *method, const char *url,
                                       const char **urlElements, int numUrlElements,
                                       const char **argumentElements, int expectedCode,
                                       const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();
    char markerLine[512];

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testParserScripts(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    if (numUrlElements==9)
    {
        result=cmeWebServiceProcessParserScriptClass(&responseText,&responseHeaders,&responseCode,
                                                     url,urlElements,argumentElements,method);
    }
    else
    {
        result=cmeWebServiceProcessParserScriptResource(&responseText,&responseHeaders,&responseCode,
                                                        url,urlElements,argumentElements,method,cmeDefaultFilePath);
    }
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testParserScripts(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    if (responseHeaders[0]&&responseHeaders[1])
    {
        snprintf(markerLine,sizeof(markerLine),
                 "TESTS: testParserScripts(), PASS: %s responseCode=%d %s=%s\n",
                 marker,responseCode,responseHeaders[0],responseHeaders[1]);
    }
    else
    {
        snprintf(markerLine,sizeof(markerLine),
                 "TESTS: testParserScripts(), PASS: %s responseCode=%d\n",marker,responseCode);
    }
    cmeTestPrintMarker(markerLine);
    cmeFree(responseText);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testParserScripts ()
{
    int errors=0;
    const char *classUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes/file.csv/documents/payroll.csv/parserScripts";
    const char *resourceUrl="/organizations/EngineOrg/storage/EngineStorage/documentTypes/file.csv/documents/payroll.csv/parserScripts/missing.pl";
    const char *classElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes","file.csv","documents","payroll.csv","parserScripts"};
    const char *resourceElements[]={"organizations","EngineOrg","storage","EngineStorage","documentTypes","file.csv","documents","payroll.csv","parserScripts","missing.pl"};
    const char *adminArgs[]={
        "userId","EngineAdmin",
        "orgId","EngineOrg",
        "orgKey","0CDBB9AF76AF43BDB72E095989E612CC",
        NULL
    };

    printf("--- Testing parserScripts resource handlers:\n");
    errors+=cmeTestParserScriptsRequest("OPTIONS",classUrl,classElements,9,adminArgs,200,"parserScripts class OPTIONS");
    errors+=cmeTestParserScriptsRequest("GET",classUrl,classElements,9,adminArgs,405,"parserScripts class GET not allowed");
    errors+=cmeTestParserScriptsRequest("OPTIONS",resourceUrl,resourceElements,10,adminArgs,200,"parserScripts resource OPTIONS");
    errors+=cmeTestParserScriptsRequest("HEAD",resourceUrl,resourceElements,10,adminArgs,404,"parserScripts missing script HEAD");
    errors+=cmeTestParserScriptsRequest("GET",resourceUrl,resourceElements,10,adminArgs,404,"parserScripts missing script GET");
    if (errors)
    {
        printf("TESTS: testParserScripts(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testParserScripts(), PASS: class options and missing script handling verified.\n");
    }
}

void testParserTempFiles(void)
{
    int errors=0;
    int result;
    char *path1=NULL;
    char *path2=NULL;
    char *targetDir=NULL;
    char *linkDir=NULL;
    char *badPath=NULL;
    FILE *fp1=NULL;
    FILE *fp2=NULL;
    FILE *badFile=NULL;
    struct stat st;

    printf("--- Testing parser temporary file hardening:\n");
    result=cmeCreateParserSecureTmpFile(&path1,&fp1,"debug-parser");
    if (result)
    {
        printf("TESTS: testParserTempFiles(), FAIL: first parser temp create result=%d.\n",result);
        errors++;
    }
    else
    {
        fwrite("x",1,1,fp1);
        cmeStorageFileClose(fp1);
        fp1=NULL;
        if ((lstat(path1,&st))||(!S_ISREG(st.st_mode))||((st.st_mode&0777)!=0600)||(st.st_nlink!=1))
        {
            printf("TESTS: testParserTempFiles(), FAIL: parser temp file mode/type/link check failed.\n");
            errors++;
        }
        else
        {
            cmeTestPrintMarker("TESTS: testParserTempFiles(), PASS: parser temp file created as 0600 regular file.\n");
        }
    }
    if ((stat(CDSE_PARSER_TMP_FILE_PATH,&st))||(!S_ISDIR(st.st_mode))||((st.st_mode&0777)!=0700))
    {
        printf("TESTS: testParserTempFiles(), FAIL: parser temp directory mode check failed.\n");
        errors++;
    }
    else
    {
        printf("TESTS: testParserTempFiles(), PASS: parser temp directory is private.\n");
    }
    result=cmeCreateParserSecureTmpFile(&path2,&fp2,"debug-parser");
    if (result)
    {
        printf("TESTS: testParserTempFiles(), FAIL: second parser temp create result=%d.\n",result);
        errors++;
    }
    else
    {
        cmeStorageFileClose(fp2);
        fp2=NULL;
        if ((!path1)||(!path2)||(!strcmp(path1,path2)))
        {
            printf("TESTS: testParserTempFiles(), FAIL: exclusive temp names collided.\n");
            errors++;
        }
        else
        {
            cmeTestPrintMarker("TESTS: testParserTempFiles(), PASS: exclusive parser temp creation avoided collision.\n");
        }
    }
    cmeStrConstrAppend(&targetDir,"%sparser-symlink-target",cmeDefaultSecureTmpFilePath);
    cmeStrConstrAppend(&linkDir,"%sparser-symlink-link",cmeDefaultSecureTmpFilePath);
    if (targetDir&&linkDir)
    {
        unlink(linkDir);
        rmdir(targetDir);
        if ((!mkdir(targetDir,0700))&&(!symlink(targetDir,linkDir)))
        {
            result=cmeCreateSecureTmpFileInDir(&badPath,&badFile,linkDir,"bad-parser");
            if (!result)
            {
                printf("TESTS: testParserTempFiles(), FAIL: symlink temp directory was accepted.\n");
                errors++;
                cmeStorageFileClose(badFile);
                badFile=NULL;
                cmeFileOverwriteAndDelete(badPath);
            }
            else
            {
                printf("TESTS: testParserTempFiles(), PASS: symlink temp directory was refused.\n");
            }
        }
        else
        {
            printf("TESTS: testParserTempFiles(), FAIL: symlink refusal setup failed.\n");
            errors++;
        }
    }
    else
    {
        printf("TESTS: testParserTempFiles(), FAIL: symlink refusal path allocation failed.\n");
        errors++;
    }
    if (fp1)
    {
        cmeStorageFileClose(fp1);
    }
    if (fp2)
    {
        cmeStorageFileClose(fp2);
    }
    if (badFile)
    {
        cmeStorageFileClose(badFile);
    }
    if (path1)
    {
        cmeFileOverwriteAndDelete(path1);
    }
    if (path2)
    {
        cmeFileOverwriteAndDelete(path2);
    }
    if (badPath)
    {
        cmeFileOverwriteAndDelete(badPath);
    }
    if (linkDir)
    {
        unlink(linkDir);
    }
    if (targetDir)
    {
        rmdir(targetDir);
    }
    cmeFree(path1);
    cmeFree(path2);
    cmeFree(targetDir);
    cmeFree(linkDir);
    cmeFree(badPath);
    if (errors)
    {
        printf("TESTS: testParserTempFiles(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testParserTempFiles(), PASS: cleanup, collision handling, and symlink refusal verified.\n");
    }
}

static int cmeTestContentRowsRequest(const char *method, const char *url,
                                     const char **urlElements, int numUrlElements,
                                     const char **argumentElements, int expectedCode,
                                     const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testContentRows(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    if (numUrlElements==9)
    {
        result=cmeWebServiceProcessContentRowClass(&responseText,&responseHeaders,&responseCode,
                                                   url,urlElements,argumentElements,method);
    }
    else
    {
        result=cmeWebServiceProcessContentRowResource(&responseText,&responseHeaders,&responseCode,
                                                      url,urlElements,argumentElements,method,cmeDefaultFilePath);
    }
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testContentRows(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    printf("TESTS: testContentRows(), PASS: %s responseCode=%d",marker,responseCode);
    if (responseHeaders[0]&&responseHeaders[1])
    {
        printf(" %s=%s",responseHeaders[0],responseHeaders[1]);
    }
    printf("\n");
    cmeFree(responseText);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testContentRows ()
{
    int errors=0;
    const char *classUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv/contentRows";
    const char *row1Url="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv/contentRows/1";
    const char *appendUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv/contentRows/11";
    const char *row0Url="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv/contentRows/0";
    const char *missingUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/MissingPayroll.csv/contentRows/1";
    const char *nonCsvUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.raw/documents/AcmeIncPayroll.csv/contentRows/1";
    const char *classElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv","contentRows"};
    const char *row1Elements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv","contentRows","1"};
    const char *appendElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv","contentRows","11"};
    const char *row0Elements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv","contentRows","0"};
    const char *missingElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","MissingPayroll.csv","contentRows","1"};
    const char *nonCsvElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.raw","documents","AcmeIncPayroll.csv","contentRows","1"};
    const char *authArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        "orgKey","password1",
        NULL
    };
    const char *postArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        "orgKey","password1",
        "[nombre ]","Rosa",
        "[apellido]","Garcia",
        "[sueldo]","12345",
        NULL
    };
    const char *putArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        "orgKey","password1",
        "[sueldo]","54321",
        NULL
    };

    printf("--- Testing contentRows resource handlers:\n");
    errors+=cmeTestContentRowsRequest("OPTIONS",classUrl,classElements,9,authArgs,200,"contentRows class OPTIONS");
    errors+=cmeTestContentRowsRequest("GET",classUrl,classElements,9,authArgs,405,"contentRows class GET not allowed");
    errors+=cmeTestContentRowsRequest("GET",row1Url,row1Elements,10,authArgs,200,"contentRows row GET");
    errors+=cmeTestContentRowsRequest("HEAD",row1Url,row1Elements,10,authArgs,200,"contentRows row HEAD");
    errors+=cmeTestContentRowsRequest("POST",appendUrl,appendElements,10,postArgs,201,"contentRows append POST");
    errors+=cmeTestContentRowsRequest("GET",appendUrl,appendElements,10,authArgs,200,"contentRows appended GET");
    errors+=cmeTestContentRowsRequest("PUT",appendUrl,appendElements,10,putArgs,200,"contentRows appended PUT");
    errors+=cmeTestContentRowsRequest("DELETE",appendUrl,appendElements,10,authArgs,200,"contentRows appended DELETE");
    errors+=cmeTestContentRowsRequest("HEAD",appendUrl,appendElements,10,authArgs,404,"contentRows deleted HEAD");
    errors+=cmeTestContentRowsRequest("DELETE",row0Url,row0Elements,10,authArgs,403,"contentRows invalid row DELETE");
    errors+=cmeTestContentRowsRequest("GET",missingUrl,missingElements,10,authArgs,404,"contentRows missing document GET");
    errors+=cmeTestContentRowsRequest("GET",nonCsvUrl,nonCsvElements,10,authArgs,403,"contentRows non-CSV GET");
    if (errors)
    {
        printf("TESTS: testContentRows(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testContentRows(), PASS: row get/append/update/delete/options verified.\n");
    }
}

static int cmeTestContentColumnsRequest(const char *method, const char *url,
                                        const char **urlElements, int numUrlElements,
                                        const char **argumentElements, int expectedCode,
                                        const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testContentColumns(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    if (numUrlElements==9)
    {
        result=cmeWebServiceProcessContentColumnClass(&responseText,&responseHeaders,&responseCode,
                                                      url,urlElements,argumentElements,method);
    }
    else
    {
        result=cmeWebServiceProcessContentColumnResource(&responseText,&responseHeaders,&responseCode,
                                                         url,urlElements,argumentElements,method,cmeDefaultFilePath);
    }
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testContentColumns(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    printf("TESTS: testContentColumns(), PASS: %s responseCode=%d",marker,responseCode);
    if (responseHeaders[0]&&responseHeaders[1])
    {
        printf(" %s=%s",responseHeaders[0],responseHeaders[1]);
    }
    printf("\n");
    cmeFree(responseText);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testContentColumns ()
{
    int errors=0;
    const char *classUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv/contentColumns";
    const char *nameUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv/contentColumns/nombre ";
    const char *emptyDocColumnUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/ContentColumnEmpty.csv/contentColumns/OnlyCol";
    const char *emptyDocMissingColumnUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/ContentColumnEmpty.csv/contentColumns/MissingCol";
    const char *reservedIdUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/AcmeIncPayroll.csv/contentColumns/id";
    const char *missingDocUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.csv/documents/MissingPayroll.csv/contentColumns/nombre ";
    const char *nonCsvUrl="/organizations/CaumeDSE/storage/storage1/documentTypes/file.raw/documents/AcmeIncPayroll.csv/contentColumns/nombre ";
    const char *classElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv","contentColumns"};
    const char *nameElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv","contentColumns","nombre "};
    const char *emptyDocColumnElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","ContentColumnEmpty.csv","contentColumns","OnlyCol"};
    const char *emptyDocMissingColumnElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","ContentColumnEmpty.csv","contentColumns","MissingCol"};
    const char *reservedIdElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","AcmeIncPayroll.csv","contentColumns","id"};
    const char *missingDocElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.csv","documents","MissingPayroll.csv","contentColumns","nombre "};
    const char *nonCsvElements[]={"organizations","CaumeDSE","storage","storage1","documentTypes","file.raw","documents","AcmeIncPayroll.csv","contentColumns","nombre "};
    const char *authArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        "orgKey","password1",
        NULL
    };
    const char *missingKeyArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        NULL
    };

    printf("--- Testing contentColumns resource handlers:\n");
    errors+=cmeTestContentColumnsRequest("OPTIONS",classUrl,classElements,9,authArgs,200,"contentColumns class OPTIONS");
    errors+=cmeTestContentColumnsRequest("GET",classUrl,classElements,9,authArgs,405,"contentColumns class GET not allowed");
    errors+=cmeTestContentColumnsRequest("GET",nameUrl,nameElements,10,authArgs,200,"contentColumns existing column GET");
    errors+=cmeTestContentColumnsRequest("POST",emptyDocColumnUrl,emptyDocColumnElements,10,authArgs,201,"contentColumns empty document POST");
    errors+=cmeTestContentColumnsRequest("POST",emptyDocColumnUrl,emptyDocColumnElements,10,authArgs,403,"contentColumns duplicate POST rejected");
    errors+=cmeTestContentColumnsRequest("GET",emptyDocColumnUrl,emptyDocColumnElements,10,authArgs,200,"contentColumns created column GET");
    errors+=cmeTestContentColumnsRequest("HEAD",emptyDocColumnUrl,emptyDocColumnElements,10,authArgs,200,"contentColumns empty document HEAD");
    errors+=cmeTestContentColumnsRequest("HEAD",emptyDocMissingColumnUrl,emptyDocMissingColumnElements,10,authArgs,404,"contentColumns missing column HEAD");
    errors+=cmeTestContentColumnsRequest("DELETE",emptyDocColumnUrl,emptyDocColumnElements,10,authArgs,200,"contentColumns last column DELETE");
    errors+=cmeTestContentColumnsRequest("HEAD",emptyDocColumnUrl,emptyDocColumnElements,10,authArgs,404,"contentColumns deleted document HEAD");
    errors+=cmeTestContentColumnsRequest("POST",reservedIdUrl,reservedIdElements,10,authArgs,403,"contentColumns reserved id POST rejected");
    errors+=cmeTestContentColumnsRequest("GET",missingDocUrl,missingDocElements,10,authArgs,404,"contentColumns missing document GET");
    errors+=cmeTestContentColumnsRequest("GET",nonCsvUrl,nonCsvElements,10,authArgs,403,"contentColumns non-CSV GET");
    errors+=cmeTestContentColumnsRequest("GET",nameUrl,nameElements,10,missingKeyArgs,409,"contentColumns missing key rejected");
    if (errors)
    {
        printf("TESTS: testContentColumns(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testContentColumns(), PASS: column get/create/delete/options and edge cases verified.\n");
    }
}

static int cmeTestDBBrowsingRequest(const char *method, const char *url,
                                    const char **urlElements, int numUrlElements,
                                    const char **argumentElements, int expectedCode,
                                    const char *marker)
{
    int result,responseCode=0;
    char *responseText=NULL;
    char **responseHeaders=cmeTestAllocResponseHeaders();

    if (!responseHeaders)
    {
        fprintf(stderr,"CaumeDSE Error: testDBBrowsing(), can't allocate response headers for %s.\n",marker);
        return(1);
    }
    result=cmeWebServiceProcessDBBrowseResource(&responseText,&responseHeaders,&responseCode,
                                                url,urlElements,numUrlElements,argumentElements,
                                                method,cmeDefaultFilePath);
    if (((expectedCode>=0)&&(responseCode!=expectedCode)) || (result && (expectedCode<400)))
    {
        fprintf(stderr,"CaumeDSE Error: testDBBrowsing(), %s failed: result=%d responseCode=%d expected=%d.\n",
                marker,result,responseCode,expectedCode);
        cmeFree(responseText);
        cmeTestFreeResponseHeaders(responseHeaders);
        return(1);
    }
    printf("TESTS: testDBBrowsing(), PASS: %s responseCode=%d",marker,responseCode);
    if (responseHeaders[0]&&responseHeaders[1])
    {
        printf(" %s=%s",responseHeaders[0],responseHeaders[1]);
    }
    printf("\n");
    cmeFree(responseText);
    cmeTestFreeResponseHeaders(responseHeaders);
    return(0);
}

void testDBBrowsing ()
{
    int errors=0;
    int numCols=2;
    int numRows=1;
    int result __attribute__((unused));
    const char *browseTable[]={"id","name","1","Ada"};
    const char *attributes[]={"shuffle","protect"};
    const char *attributesData[]={cmeDefaultEncAlg,cmeDefaultEncAlg};
    const char *dbNamesUrl="/organizations/CaumeDSE/storage/storage1/dbNames";
    const char *dbTablesUrl="/organizations/CaumeDSE/storage/storage1/dbNames/BrowseTest/dbTables";
    const char *badTableUrl="/organizations/CaumeDSE/storage/storage1/dbNames/BrowseTest/dbTables/sqlite_master";
    const char *tableRowUrl="/organizations/CaumeDSE/storage/storage1/dbNames/BrowseTest/dbTables/data/tableRows/1";
    const char *badRowUrl="/organizations/CaumeDSE/storage/storage1/dbNames/BrowseTest/dbTables/data/tableRows/0";
    const char *tableColumnUrl="/organizations/CaumeDSE/storage/storage1/dbNames/BrowseTest/dbTables/data/tableColumns/name";
    const char *dbNamesElements[]={"organizations","CaumeDSE","storage","storage1","dbNames"};
    const char *dbTablesElements[]={"organizations","CaumeDSE","storage","storage1","dbNames","BrowseTest","dbTables"};
    const char *badTableElements[]={"organizations","CaumeDSE","storage","storage1","dbNames","BrowseTest","dbTables","sqlite_master"};
    const char *tableRowElements[]={"organizations","CaumeDSE","storage","storage1","dbNames","BrowseTest","dbTables","data","tableRows","1"};
    const char *badRowElements[]={"organizations","CaumeDSE","storage","storage1","dbNames","BrowseTest","dbTables","data","tableRows","0"};
    const char *tableColumnElements[]={"organizations","CaumeDSE","storage","storage1","dbNames","BrowseTest","dbTables","data","tableColumns","name"};
    const char *authArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        "orgKey","password1",
        NULL
    };
    const char *missingKeyArgs[]={
        "userId","User123",
        "orgId","CaumeDSE",
        NULL
    };

    printf("--- Testing dbNames secure DB browsing resource handlers:\n");
    result=cmeMemTableToSecureDB(browseTable,numCols,numRows,"User123","CaumeDSE",
                                 "password1",attributes,attributesData,2,1,0,
                                 "DB browsing test.","file.csv","BrowseTest","storage1",
                                 cmeDefaultFilePath);
    if (result)
    {
        printf("TESTS: testDBBrowsing(), FAIL: setup failed result=%d.\n",result);
        return;
    }
    errors+=cmeTestDBBrowsingRequest("OPTIONS",dbNamesUrl,dbNamesElements,5,authArgs,200,"dbNames class OPTIONS");
    errors+=cmeTestDBBrowsingRequest("GET",dbNamesUrl,dbNamesElements,5,authArgs,200,"dbNames class GET");
    errors+=cmeTestDBBrowsingRequest("GET",dbTablesUrl,dbTablesElements,7,authArgs,200,"dbTables class GET");
    errors+=cmeTestDBBrowsingRequest("GET",badTableUrl,badTableElements,8,authArgs,404,"dbTable invalid selector rejected");
    errors+=cmeTestDBBrowsingRequest("GET",tableRowUrl,tableRowElements,10,authArgs,200,"tableRow resource GET");
    errors+=cmeTestDBBrowsingRequest("GET",badRowUrl,badRowElements,10,authArgs,403,"tableRow invalid selector rejected");
    errors+=cmeTestDBBrowsingRequest("GET",tableColumnUrl,tableColumnElements,10,authArgs,200,"tableColumn resource GET");
    errors+=cmeTestDBBrowsingRequest("GET",dbNamesUrl,dbNamesElements,5,missingKeyArgs,409,"dbNames missing key rejected");
    errors+=cmeTestDBBrowsingRequest("POST",dbNamesUrl,dbNamesElements,5,authArgs,405,"dbNames POST not allowed");
    if (errors)
    {
        printf("TESTS: testDBBrowsing(), FAIL: %d errors.\n",errors);
    }
    else
    {
        printf("TESTS: testDBBrowsing(), PASS: dbNames/dbTables/tableRows/tableColumns browsing verified.\n");
    }
}

void testEngMgmnt ()
{
    int result __attribute__((unused));
    result=cmeSetupEngineAdminDBs();
    testThreadSafety();
    testRoleTables();
    testFilterWhitelist();
    testFilterBlacklist();
    testDocumentTypes();
    testStorageDocumentTree();
    testParserScripts();
    testParserTempFiles();
}

void testWebServices ()
{
    const char *skipWebEnv = getenv("CDSE_DEBUG_TEST_SKIP_WEB");
    const char *httpEnv = getenv("CDSE_DEBUG_TEST_HTTP_PORT");
    const char *httpsEnv = getenv("CDSE_DEBUG_TEST_HTTPS_PORT");
    int httpPort = cmeDefaultWebservicePort;
    int httpsPort = cmeDefaultWebServiceSSLPort;
    int result;
    char marker[160];

    if (skipWebEnv && *skipWebEnv && strcmp(skipWebEnv,"0"))
    {
        printf("--- Testing Web server: skipped by CDSE_DEBUG_TEST_SKIP_WEB\n");
        return;
    }

    if (cmeDebugTestsNonInteractiveEnabled())
    {
        httpPort = 8080;
        httpsPort = 8443;
    }
    if (httpEnv && *httpEnv)
    {
        httpPort = atoi(httpEnv);
    }
    if (httpsEnv && *httpsEnv)
    {
        httpsPort = atoi(httpsEnv);
    }

    snprintf(marker,sizeof(marker),"--- Testing Web server HTTP port %d%s (thread pool: %d)\n",httpPort,
             cmeDebugTestsNonInteractiveEnabled() ? " (non-interactive)" : " (press enter to continue)",
             cmeDefaultMaxThreads);
    cmeTestPrintMarker(marker);
    result=cmeWebServiceSetup(httpPort,0,NULL,NULL,NULL,0);
    if (result)
    {
        printf("TESTS: testWebServices(), FAIL: HTTP startup failed on port %d result=%d\n",httpPort,result);
    }
    else
    {
        snprintf(marker,sizeof(marker),"TESTS: testWebServices(), PASS: HTTP startup and shutdown verified on port %d\n",httpPort);
        cmeTestPrintMarker(marker);
    }
    snprintf(marker,sizeof(marker),"--- Testing Web server HTTPS port %d%s (thread pool: %d)\n",httpsPort,
             cmeDebugTestsNonInteractiveEnabled() ? " (non-interactive)" : " (press enter to continue)",
             cmeDefaultMaxThreads);
    cmeTestPrintMarker(marker);
    result=cmeWebServiceSetup(httpsPort,1,cmeDefaultHTTPSKeyFile,cmeDefaultHTTPSCertFile,cmeDefaultCACertFile,0);
    if (result)
    {
        printf("TESTS: testWebServices(), FAIL: HTTPS startup failed on port %d result=%d\n",httpsPort,result);
    }
    else
    {
        snprintf(marker,sizeof(marker),"TESTS: testWebServices(), PASS: HTTPS startup and shutdown verified on port %d\n",httpsPort);
        cmeTestPrintMarker(marker);
    }
}