import test from 'node:test';
import assert from 'node:assert/strict';
import { generateKeyPairSync, sign } from 'node:crypto';
import {
  nodeRegistrationClaimSigningBytes,
  parseNodeRegistrationEndpointRegistry,
  resolveNodeRegistrationEndpoint,
  verifyNodeRegistrationClaim,
} from './node-registration.js';

const NOW = 1_786_291_200_000;
const COMMIT = 'a'.repeat(40);
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
const source = {
  repositoryId: 'REPO-012' as const,
  sourceCommit: COMMIT,
  sourceUrl: `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${COMMIT}/routing/node-registration-endpoints.json`,
};

function endpoint(overrides: Record<string, unknown> = {}) {
  return {
    algorithm: 'Ed25519',
    domainIds: ['DOM-FIFTH-0001'],
    endpointId: 'GH-NODE-REG-001',
    nodeTypes: ['local-terminal', 'cloud-resident'],
    publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
    signerId: 'GH-NODE-REG-SIGNER-001',
    status: 'ACTIVE',
    url: 'https://guanghulab.com/api/ai/v1/node-registrations/claims',
    ...overrides,
  };
}

function registry(endpoints: unknown[] = [endpoint()]) {
  return parseNodeRegistrationEndpointRegistry({
    endpoints,
    registryId: 'GH-AIOS-NODE-REGISTRATION-ENDPOINTS-001',
    schema: 'gh-aios.node-registration-endpoints/v1',
    state: 'CURRENT',
    version: '1.0.0',
  }, source);
}

function signedClaim(overrides: Record<string, unknown> = {}) {
  const payload = {
    accountId: 'bingshuo',
    claimId: 'NODE-CLAIM-001',
    domainId: 'DOM-FIFTH-0001',
    endpointId: 'GH-NODE-REG-001',
    expiresAt: NOW + 60_000,
    issuedAt: NOW - 1_000,
    nodeId: 'JD-FD-PRIMARY',
    nodeKeyFingerprint: 'b'.repeat(64),
    nodeType: 'local-terminal' as const,
    schema: 'gh-aios.node-registration-claim/v1' as const,
    signerId: 'GH-NODE-REG-SIGNER-001',
    ...overrides,
  };
  return {
    ...payload,
    signature: sign(null, nodeRegistrationClaimSigningBytes(payload as never), privateKey).toString('base64'),
  };
}

test('resolves one active endpoint for a domain and node type', () => {
  const resolved = resolveNodeRegistrationEndpoint(registry(), {
    domainId: 'DOM-FIFTH-0001',
    nodeType: 'local-terminal',
  });
  assert.equal(resolved?.endpointId, 'GH-NODE-REG-001');
});

test('rejects credentials, arbitrary origins and ambiguous active scopes', () => {
  assert.throws(() => registry([endpoint({ url: 'https://user:secret@guanghulab.com/api/ai/v1/node-registrations' })]), /registry_invalid/);
  assert.throws(() => registry([endpoint({ url: 'https://example.com/api/ai/v1/node-registrations' })]), /registry_invalid/);
  assert.throws(() => registry([
    endpoint(),
    endpoint({ endpointId: 'GH-NODE-REG-002', signerId: 'GH-NODE-REG-SIGNER-002' }),
  ]), /registry_invalid/);
});

test('a signed registration binds account, domain, node, type, key and endpoint', () => {
  const resolved = resolveNodeRegistrationEndpoint(registry(), {
    domainId: 'DOM-FIFTH-0001',
    nodeType: 'local-terminal',
  });
  assert.ok(resolved);
  const verified = verifyNodeRegistrationClaim(signedClaim(), {
    accountId: 'bingshuo',
    domainId: 'DOM-FIFTH-0001',
    nodeId: 'JD-FD-PRIMARY',
    nodeType: 'local-terminal',
  }, resolved, NOW);
  assert.equal(verified.nodeKeyFingerprint, 'b'.repeat(64));
  assert.equal(verified.verifiedAt, NOW);
});

test('copied booleans, unknown fields, mismatches and expired claims fail closed', () => {
  const resolved = resolveNodeRegistrationEndpoint(registry(), {
    domainId: 'DOM-FIFTH-0001',
    nodeType: 'local-terminal',
  });
  assert.ok(resolved);
  const expected = {
    accountId: 'bingshuo',
    domainId: 'DOM-FIFTH-0001',
    nodeId: 'JD-FD-PRIMARY',
    nodeType: 'local-terminal' as const,
  };
  assert.throws(() => verifyNodeRegistrationClaim({ ...signedClaim(), verified: true }, expected, resolved, NOW), /claim_invalid/);
  assert.throws(() => verifyNodeRegistrationClaim(signedClaim(), { ...expected, accountId: 'other' }, resolved, NOW), /claim_invalid/);
  assert.throws(() => verifyNodeRegistrationClaim(signedClaim(), { ...expected, nodeType: 'cloud-resident' }, resolved, NOW), /claim_invalid/);
  assert.throws(() => verifyNodeRegistrationClaim(signedClaim({ expiresAt: NOW }), expected, resolved, NOW), /claim_invalid/);
});

test('tampering or signing with another key fails closed', () => {
  const resolved = resolveNodeRegistrationEndpoint(registry(), {
    domainId: 'DOM-FIFTH-0001',
    nodeType: 'local-terminal',
  });
  assert.ok(resolved);
  const expected = {
    accountId: 'bingshuo',
    domainId: 'DOM-FIFTH-0001',
    nodeId: 'JD-FD-PRIMARY',
    nodeType: 'local-terminal' as const,
  };
  assert.throws(() => verifyNodeRegistrationClaim({ ...signedClaim(), nodeKeyFingerprint: 'c'.repeat(64) }, expected, resolved, NOW), /claim_invalid/);
  const other = generateKeyPairSync('ed25519');
  const claim = signedClaim();
  const forged = {
    ...claim,
    signature: sign(null, nodeRegistrationClaimSigningBytes(claim), other.privateKey).toString('base64'),
  };
  assert.throws(() => verifyNodeRegistrationClaim(forged, expected, resolved, NOW), /claim_invalid/);
});