import assert from 'node:assert/strict'
import test from 'node:test'

import {
  validateCredentialEnvironment,
  validateReleaseInput,
  validateReleaseTrust,
} from './release-pipeline.mjs'

const readyTrust = () => ({
  schema: 'hololake.release-trust/v1',
  state: 'PROVISIONED',
  endpoints: ['https://release.guanghu.test/latest.json'],
  publicKey: 'A'.repeat(64),
  allowedReleaseHosts: ['release.guanghu.test'],
  automaticCheckOnStartup: false,
  automaticDownload: false,
  humanOptInInstallRequired: true,
  automaticRestart: false,
})

const readyInput = () => ({
  schema: 'hololake.release-pipeline-input/v1',
  releaseId: 'GH-HOLOLAKE-RELEASE-0.2.0',
  version: '0.2.0',
  previousVersion: '0.1.0',
  minimumVersion: '0.1.0',
  releaseTag: 'v0.2.0',
  sourceCommit: 'a'.repeat(40),
  platformCode: 'darwin-aarch64',
  packageUrl: 'https://release.guanghu.test/releases/0.2.0/HoloLake.app.tar.gz',
  appleTeamIdentifier: '825A9L3G7Q',
  notes: 'Signed release',
  features: ['Persistent direct connection'],
  fixes: [],
  dataMigrationRequired: false,
  restartMessage: 'Restart manually',
})

test('release pipeline refuses an unprovisioned or upstream-owned trust document', () => {
  const unprovisioned = readyTrust()
  unprovisioned.state = 'UNPROVISIONED_FAIL_CLOSED'
  assert.throws(() => validateReleaseTrust(unprovisioned), /TRUST_UNPROVISIONED/)

  const upstream = readyTrust()
  upstream.endpoints = ['https://updates.vendor.test/latest.json']
  assert.throws(() => validateReleaseTrust(upstream), /ENDPOINT_NOT_HOLOLAKE_HTTPS/)
})

test('release package must use the exact registered HoloLake HTTPS host and immutable tag', () => {
  const trust = validateReleaseTrust(readyTrust())
  const wrongHost = readyInput()
  wrongHost.packageUrl = 'https://github.com/example/HoloLake.app.tar.gz'
  assert.throws(() => validateReleaseInput(wrongHost, trust), /PACKAGE_HOST_NOT_TRUSTED/)

  const wrongTag = readyInput()
  wrongTag.releaseTag = 'latest'
  assert.throws(() => validateReleaseInput(wrongTag, trust), /IMMUTABLE_TAG_INVALID/)
  assert.equal(validateReleaseInput(readyInput(), trust).version, '0.2.0')
})

test('release pipeline requires updater signing, Developer ID and Apple notarization credentials together', () => {
  assert.throws(() => validateCredentialEnvironment({}), /CREDENTIALS_MISSING/)
  assert.doesNotThrow(() => validateCredentialEnvironment({
    APPLE_SIGNING_IDENTITY: 'Developer ID Application: HoloLake (TEAM)',
    TAURI_SIGNING_PRIVATE_KEY: 'runtime-secret-material',
    TAURI_SIGNING_PRIVATE_KEY_PASSWORD: 'provided-at-runtime',
    APPLE_ID: 'release@example.test',
    APPLE_PASSWORD: 'provided-at-runtime',
    APPLE_TEAM_ID: 'TEAM',
  }))
})