import assert from "node:assert/strict";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import test from "node:test";
import {
  ExecutionObserver,
  REQUIRED_PROTOCOL_CHAIN,
} from "./execution-observer.mjs";

test("observes allowlisted Linux services through typed read-only requests", async () => {
  const stateRoot = fs.mkdtempSync(
    path.join(os.tmpdir(), "guanghu-execution-observer-"),
  );
  const calls = [];
  const observer = new ExecutionObserver({
    binaryPath: "/opt/guanghu/execution-bridge/current/guanghu-execution-bridge",
    policyPath: "/opt/guanghu/execution-bridge/current/policy.json",
    stateRoot,
    services: ["guanghu-ai-discovery.service", "lake-lamp-authz.service"],
    execute: async (program, argv) => {
      const request = JSON.parse(
        fs.readFileSync(argv[1], "utf8"),
      );
      calls.push({ program, argv, request });
      return {
        stdout: JSON.stringify({
          schema: "guanghu.execution-receipt/v1",
          request_id: request.request_id,
          subject_id: request.subject_id,
          target_node_id: request.target_node_id,
          policy_id: "JD-FD-PRIMARY-READONLY-20260807",
          action: request.action,
          adapter: "LINUX_SYSTEMD_V1",
          accepted: true,
          command_exit_code: 0,
          target_state_verified: true,
          final_state: "PASS_100",
          stdout: "active",
          stderr: "",
          rollback_checkpoint_id: null,
        }),
        stderr: "",
      };
    },
  });

  const projection = await observer.observe();
  assert.equal(projection.state, "PASS_100");
  assert.equal(projection.bridge_bound, 100);
  assert.equal(projection.target_state_verified, 100);
  assert.equal(projection.restart_allowed, false);
  assert.equal(projection.arbitrary_shell, false);
  assert.equal(calls.length, 2);
  assert.equal(calls[0].argv[0], "execute");
  assert.deepEqual(calls[0].request.protocol_chain, REQUIRED_PROTOCOL_CHAIN);
  assert.equal(calls[0].request.action.kind, "service_status");
  assert.equal(calls[0].request.authorization, null);
  assert.equal(calls[0].request.rollback, null);
});

test("fails closed when the native receipt does not match the requested service", async () => {
  const stateRoot = fs.mkdtempSync(
    path.join(os.tmpdir(), "guanghu-execution-observer-"),
  );
  const observer = new ExecutionObserver({
    binaryPath: "/bridge",
    policyPath: "/policy",
    stateRoot,
    services: ["guanghu-ai-discovery.service"],
    execute: async () => ({
      stdout: JSON.stringify({
        schema: "guanghu.execution-receipt/v1",
        target_node_id: "JD-FD-PRIMARY",
        action: {
          kind: "service_status",
          resource: "different.service",
        },
        adapter: "LINUX_SYSTEMD_V1",
      }),
      stderr: "",
    }),
  });

  await assert.rejects(
    () => observer.observe(),
    /execution_receipt_contract_mismatch/,
  );
});