import test from 'node:test';
import assert from 'node:assert/strict';
import { evaluateDomainAccess } from './domain-access.js';

const NOW = 1_786_291_200_000;
const DIGEST = 'a'.repeat(64);

test('a local workspace remains available without claiming domain runtime access', () => {
  const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '' }, NOW);
  assert.equal(status.localWorkspaceAllowed, true);
  assert.equal(status.runtimeReady, false);
  assert.equal(status.stage, 'login-required');
});

test('a verified Forgejo account is not a domain runtime session', () => {
  const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY' }, NOW);
  assert.equal(status.stage, 'identity-verified');
  assert.deepEqual(status.blockers, [
    'verified_domain_manifest_missing',
    'scoped_session_capability_missing',
    'matching_connection_receipt_missing',
  ]);
});

test('runtime access requires matching manifest, scoped capability and online receipt', () => {
  const status = evaluateDomainAccess({
    accountVerified: true,
    connectionReceipt: { domainId: 'DOM-FIFTH-0001', manifestDigest: DIGEST, nodeId: 'LOCAL-001', state: 'online' },
    domainId: 'DOM-FIFTH-0001',
    manifest: { digest: DIGEST, domainId: 'DOM-FIFTH-0001', verified: true },
    nodeId: 'LOCAL-001',
    sessionCapability: { domainId: 'DOM-FIFTH-0001', expiresAt: NOW + 60_000, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
  }, NOW);
  assert.equal(status.runtimeReady, true);
  assert.equal(status.stage, 'runtime-ready');
  assert.deepEqual(status.blockers, []);
});

test('mismatched or expired evidence fails closed', () => {
  const status = evaluateDomainAccess({
    accountVerified: true,
    connectionReceipt: { domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', state: 'online' },
    domainId: 'DOM-FIFTH-0001',
    manifest: { digest: DIGEST, domainId: 'DOM-FIFTH-0001', verified: true },
    nodeId: 'LOCAL-001',
    sessionCapability: { domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', scopes: ['domain:enter'] },
  }, NOW);
  assert.equal(status.runtimeReady, false);
  assert.ok(status.blockers.includes('scoped_session_capability_missing'));
  assert.ok(status.blockers.includes('matching_connection_receipt_missing'));
});