import test from 'node:test';
import assert from 'node:assert/strict';
import { createHash, generateKeyPairSync, sign } from 'node:crypto';
import { domainManifestSigningBytes } from './domain-access.js';
import { DomainAccessOrchestrator } from './domain-access-orchestrator.js';
import { nodeRegistrationClaimSigningBytes } from './node-registration.js';
import { NodeRegistrationSnapshotLoader } from './node-registration-snapshot.js';
import { TrustedSignerSnapshotLoader } from './trusted-signer-snapshot.js';

const NOW = 1_786_291_200_000;
const DOMAIN_ID = 'DOM-FIFTH-0001';
const NODE_ID = 'LOCAL-001';
const NODE_TYPE = 'local-terminal' as const;
const ACCOUNT_ID = 'bingshuo';
const COMMIT = 'a'.repeat(40);
const ANCHOR_URL = 'https://guanghulab.com/api/ai/v1/anchor';
const SIGNER_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/trusted-domain-manifest-signers.json`;
const NODE_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/node-registration-endpoints.json`;
const manifestKeys = generateKeyPairSync('ed25519');
const registrationKeys = generateKeyPairSync('ed25519');

function anchor() {
  return {
    schema: 'guanghu.public-navigation-anchor/v1',
    anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
    state: 'CURRENT_CANONICAL',
    repository_id: 'REPO-012',
    branch: 'main',
    public_entry: ANCHOR_URL,
    code_entry: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
    maps: {
      trusted_domain_manifest_signers: {
        path: 'routing/trusted-domain-manifest-signers.json',
        id: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
        version: '1.0.0',
      },
      node_registration_endpoints: {
        path: 'routing/node-registration-endpoints.json',
        id: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
        version: '1.0.0',
      },
    },
    navigation_source: {
      anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
      source_commit: COMMIT,
      source_mode: 'REPO-012_MAIN_GIT_SNAPSHOT',
      source_degraded: false,
    },
  };
}

function signerRegistry(signers: unknown[] = []) {
  return {
    registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
    schema: 'gh-aios.trusted-domain-manifest-signers/v1',
    signers,
    state: 'CURRENT',
    version: '1.0.0',
  };
}

function activeSigner() {
  return {
    algorithm: 'Ed25519',
    domainIds: [DOMAIN_ID],
    publicKeyPem: manifestKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString(),
    repositoryId: 'REPO-014',
    signerId: 'GH-LIGHTHOUSE-001',
    status: 'ACTIVE',
  };
}

function nodeRegistry(version = '1.0.0') {
  return {
    endpoints: [{
      algorithm: 'Ed25519',
      domainIds: [DOMAIN_ID],
      endpointId: 'GH-NODE-REG-001',
      nodeTypes: [NODE_TYPE],
      publicKeyPem: registrationKeys.publicKey.export({ format: 'pem', type: 'spki' }).toString(),
      signerId: 'GH-NODE-REG-SIGNER-001',
      status: 'ACTIVE',
      url: 'https://guanghulab.com/api/ai/v1/node-registrations/claims',
    }],
    registryId: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
    schema: 'gh-aios.node-registration-endpoints/v1',
    state: 'CURRENT',
    version,
  };
}

function signerLoader(readRegistry: () => unknown = () => signerRegistry()) {
  return new TrustedSignerSnapshotLoader({
    async fetchJson(url) {
      if (url === ANCHOR_URL) return anchor();
      if (url === SIGNER_REGISTRY_URL) return readRegistry();
      throw new Error('unexpected_url');
    },
  });
}

function registrationLoader(readRegistry: () => unknown = () => nodeRegistry()) {
  return new NodeRegistrationSnapshotLoader({
    async fetchJson(url) {
      if (url === ANCHOR_URL) return anchor();
      if (url === NODE_REGISTRY_URL) return readRegistry();
      throw new Error('unexpected_url');
    },
  });
}

function validRegistrationClaim() {
  const payload = {
    accountId: ACCOUNT_ID,
    claimId: 'NODE-CLAIM-001',
    domainId: DOMAIN_ID,
    endpointId: 'GH-NODE-REG-001',
    expiresAt: NOW + 60_000,
    issuedAt: NOW - 1_000,
    nodeId: NODE_ID,
    nodeKeyFingerprint: 'c'.repeat(64),
    nodeType: NODE_TYPE,
    schema: 'gh-aios.node-registration-claim/v1' as const,
    signerId: 'GH-NODE-REG-SIGNER-001',
  };
  return {
    ...payload,
    signature: sign(null, nodeRegistrationClaimSigningBytes(payload), registrationKeys.privateKey).toString('base64'),
  };
}

function validHandoff() {
  const payload = {
    domainId: DOMAIN_ID,
    repositoryId: 'REPO-014',
    schema: 'gh-aios.domain-manifest/v1',
    signerId: 'GH-LIGHTHOUSE-001',
    sourceCommit: 'b'.repeat(40),
  } as const;
  const bytes = domainManifestSigningBytes(payload);
  const digest = createHash('sha256').update(bytes).digest('hex');
  return {
    connectionReceipt: {
      connectionId: 'CONN-001',
      domainId: DOMAIN_ID,
      manifestDigest: digest,
      nodeId: NODE_ID,
      nodeType: NODE_TYPE,
      receiptId: 'RECEIPT-001',
      state: 'online',
    },
    manifest: {
      digest,
      ...payload,
      signature: sign(null, bytes, manifestKeys.privateKey).toString('base64'),
    },
    sessionCapability: {
      capabilityId: 'CAP-001',
      domainId: DOMAIN_ID,
      expiresAt: NOW + 60_000,
      nodeId: NODE_ID,
      nodeType: NODE_TYPE,
      scopes: ['domain:enter'],
    },
  };
}

const loggedOutIdentity = { async read() { return { accountId: '', accountVerified: false, nodeId: '' }; } };
const loggedInIdentity = { async read() { return { accountId: ACCOUNT_ID, accountVerified: true, nodeId: NODE_ID }; } };
const validRegistrationSource = { async read() { return validRegistrationClaim(); } };

test('projects both trust-source states without asking for claims or handoff before login', async () => {
  let claimReads = 0;
  let handoffReads = 0;
  const orchestrator = new DomainAccessOrchestrator(
    signerLoader(),
    registrationLoader(),
    loggedOutIdentity,
    { async read() { claimReads += 1; return null; } },
    { async read() { handoffReads += 1; return null; } },
  );

  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);

  assert.equal(claimReads, 0);
  assert.equal(handoffReads, 0);
  assert.equal(status.stage, 'login-required');
  assert.equal(status.runtimeReady, false);
  assert.equal(status.nodeRegistrationSource.status, 'CURRENT');
  assert.equal(status.trustSource.status, 'CURRENT');
});

test('a signed node registration without a handoff remains identity-only', async () => {
  let observedEndpointId = '';
  const orchestrator = new DomainAccessOrchestrator(
    signerLoader(),
    registrationLoader(),
    loggedInIdentity,
    { async read(request) {
      observedEndpointId = request.endpoint.endpointId;
      return validRegistrationClaim();
    } },
    { async read() { return null; } },
  );

  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);

  assert.equal(status.stage, 'identity-verified');
  assert.equal(status.runtimeReady, false);
  assert.equal(observedEndpointId, 'GH-NODE-REG-001');
  assert.equal(status.blockers.includes('verified_node_registration_missing'), false);
  assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
});

test('a code-channel account cannot supply registration and never contacts a handoff route', async () => {
  let handoffReads = 0;
  const orchestrator = new DomainAccessOrchestrator(
    signerLoader(),
    registrationLoader(),
    loggedInIdentity,
    { async read() { return null; } },
    { async read() { handoffReads += 1; return validHandoff() as never; } },
  );

  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);

  assert.equal(handoffReads, 0);
  assert.equal(status.stage, 'login-required');
  assert.ok(status.blockers.includes('verified_node_registration_missing'));
});

test('current registries, signed node claim and verified handoff project runtime-ready', async () => {
  const orchestrator = new DomainAccessOrchestrator(
    signerLoader(() => signerRegistry([activeSigner()])),
    registrationLoader(),
    loggedInIdentity,
    validRegistrationSource,
    { async read() {
      return {
        handoff: validHandoff(),
        signerLookup: { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
      };
    } },
  );

  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);

  assert.equal(status.stage, 'runtime-ready');
  assert.equal(status.runtimeReady, true);
  assert.deepEqual(status.blockers, []);
});

test('source failures are reduced to safe status without raw details', async () => {
  let claimReads = 0;
  const unavailableSigner = new TrustedSignerSnapshotLoader({ async fetchJson() { throw new Error('secret signer detail'); } });
  const unavailableRegistration = new NodeRegistrationSnapshotLoader({ async fetchJson() { throw new Error('secret registration detail'); } });
  const orchestrator = new DomainAccessOrchestrator(
    unavailableSigner,
    unavailableRegistration,
    loggedInIdentity,
    { async read() { claimReads += 1; throw new Error('secret claim detail'); } },
    { async read() { throw new Error('secret handoff detail'); } },
  );

  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);

  assert.equal(status.stage, 'login-required');
  assert.equal(status.runtimeReady, false);
  assert.equal(status.nodeRegistrationSource.status, 'UNAVAILABLE');
  assert.equal(status.trustSource.status, 'UNAVAILABLE');
  assert.equal(claimReads, 0);
  assert.equal(JSON.stringify(status).includes('secret'), false);
});

test('a degraded signer may preserve handoff verification while node registration must be current', async () => {
  let currentSignerRegistry: unknown = signerRegistry([activeSigner()]);
  const currentSignerLoader = signerLoader(() => currentSignerRegistry);
  await currentSignerLoader.refresh();
  currentSignerRegistry = { ...signerRegistry([activeSigner()]), version: 'invalid' };
  const orchestrator = new DomainAccessOrchestrator(
    currentSignerLoader,
    registrationLoader(),
    loggedInIdentity,
    validRegistrationSource,
    { async read() {
      return {
        handoff: validHandoff(),
        signerLookup: { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
      };
    } },
  );

  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
  assert.equal(status.runtimeReady, true);
  assert.equal(status.trustSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
  assert.equal(status.nodeRegistrationSource.status, 'CURRENT');
});

test('a degraded node-registration registry cannot authorize a claim', async () => {
  let currentNodeRegistry: unknown = nodeRegistry();
  const currentNodeLoader = registrationLoader(() => currentNodeRegistry);
  await currentNodeLoader.refresh();
  currentNodeRegistry = nodeRegistry('2.0.0');
  let claimReads = 0;
  let handoffReads = 0;
  const orchestrator = new DomainAccessOrchestrator(
    signerLoader(() => signerRegistry([activeSigner()])),
    currentNodeLoader,
    loggedInIdentity,
    { async read() { claimReads += 1; return validRegistrationClaim(); } },
    { async read() { handoffReads += 1; return null; } },
  );

  const status = await orchestrator.domainAccess(DOMAIN_ID, NODE_TYPE, NOW);
  assert.equal(status.nodeRegistrationSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
  assert.equal(status.runtimeReady, false);
  assert.ok(status.blockers.includes('verified_node_registration_missing'));
  assert.equal(claimReads, 0);
  assert.equal(handoffReads, 0);
});