"use strict";
const assert = require("node:assert/strict");
const crypto = require("node:crypto");
const test = require("node:test");
const { canonicalRequest, evaluateWriteAdmission } = require("./write-admission");

function rawPublic(key) {
  return key.export({ format: "der", type: "spki" }).subarray(-32).toString("hex");
}

function fixture() {
  const keys = crypto.generateKeyPairSync("ed25519");
  const nodeRegistry = { nodes: [{
    node_id: "TEST-NODE-001", state: "ACTIVE", persona_ids: ["ICE-P-ZY001"],
    allowed_targets: ["BS-TCS-SYSTEM-BODY-ORGAN-MAP-001"], allowed_actions: ["UPDATE_REGISTERED_RULE"],
    transport_keys: [{ key_id: "TEST-KEY-001", state: "ACTIVE", algorithm: "Ed25519", public_key_hex: rawPublic(keys.publicKey) }]
  }] };
  const request = {
    schema: "guanghu.bingshuo-system-node-write-request/v1",
    node_id: "TEST-NODE-001", key_id: "TEST-KEY-001", issued_at_unix: 1786363200,
    nonce: "0123456789abcdef0123456789abcdef", persona_id: "ICE-P-ZY001",
    authorization_receipt_id: "LANG-AUTH-TEST-001", language_event_id: "LANG-EVENT-TEST-001",
    target: "BS-TCS-SYSTEM-BODY-ORGAN-MAP-001", action: "UPDATE_REGISTERED_RULE",
    sealed_payload_sha256: "ab".repeat(32)
  };
  const envelope = {
    schema: "guanghu.bingshuo-system-node-write-envelope/v1",
    request,
    node_signature_base64url: crypto.sign(null, canonicalRequest(request), keys.privateKey).toString("base64url")
  };
  return { envelope, keys, nodeRegistry };
}

test("a registered node signature is the first admission fact", () => {
  const { envelope, nodeRegistry } = fixture();
  const allowed = evaluateWriteAdmission(envelope, { nodeRegistry, nowUnix: 1786363200 });
  assert.equal(allowed.decision, "ENTER_WHOLE_BODY_REVIEW");
  assert.equal(allowed.origin_node_id, "TEST-NODE-001");
  assert.match(allowed.next_gate, /VALIDATE_LANGUAGE_AUTHORIZATION_RECEIPT/);
  assert.equal(evaluateWriteAdmission(envelope, { nodeRegistry: { nodes: [] }, nowUnix: 1786363200 }).error_code, "ORIGIN_NODE_NOT_REGISTERED");
});

test("root-like possession without the node protocol key is noise", () => {
  const { envelope, nodeRegistry } = fixture();
  envelope.node_signature_base64url = "A".repeat(86);
  const decision = evaluateWriteAdmission(envelope, { nodeRegistry, nowUnix: 1786363200 });
  assert.equal(decision.error_code, "ORIGIN_NODE_SIGNATURE_INVALID");
  assert.equal(decision.invoke_model, false);
  assert.equal(decision.activate_protocols, false);
  assert.equal(decision.open_sealed_payload, false);
  assert.equal(decision.persist_request_body, false);
});

test("registered persona, node binding, authorization receipt and replay gate all fail closed", () => {
  const first = fixture();
  first.envelope.request.persona_id = "CHENGLU-AGENT-001";
  first.envelope.node_signature_base64url = crypto.sign(null, canonicalRequest(first.envelope.request), first.keys.privateKey).toString("base64url");
  assert.equal(evaluateWriteAdmission(first.envelope, { nodeRegistry: first.nodeRegistry, nowUnix: 1786363200 }).error_code, "PERSONA_NOT_BOUND_TO_ORIGIN_NODE");
  const second = fixture();
  const replay = new Set();
  assert.equal(evaluateWriteAdmission(second.envelope, { nodeRegistry: second.nodeRegistry, replayCache: replay, nowUnix: 1786363200 }).decision, "ENTER_WHOLE_BODY_REVIEW");
  assert.equal(evaluateWriteAdmission(second.envelope, { nodeRegistry: second.nodeRegistry, replayCache: replay, nowUnix: 1786363200 }).error_code, "NODE_REQUEST_REPLAYED");
});