import assert from 'node:assert/strict'
import fs from 'node:fs'
import path from 'node:path'
import test from 'node:test'
import { fileURLToPath } from 'node:url'

const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
const audit = JSON.parse(fs.readFileSync(path.join(root, 'audit/donor-audit.json'), 'utf8'))

test('all donors remain read-only and source copying stays blocked', () => {
  assert.equal(audit.complete, false)
  assert.equal(audit.donors.length, 3)
  for (const donor of audit.donors) {
    assert.match(donor.role, /^READ_ONLY_/)
    assert.match(donor.code_reuse, /^BLOCKED_/)
  }
})

test('audit preserves security and secret migration prohibitions', () => {
  assert.ok(audit.prohibited_transplants.includes('UNAUTHENTICATED_LOOPBACK_CONTROL_API_OR_NULL_ORIGIN_CORS'))
  assert.ok(audit.prohibited_transplants.includes('ELECTRON_PRIVILEGED_PRELOAD_WITHOUT_NAVIGATION_AND_SENDER_ORIGIN_LOCK'))
  const secretData = audit.data_classes.find((entry) => entry.class === 'MODEL_AND_SERVER_CREDENTIALS')
  assert.match(secretData.migration, /NEVER_COPY_AS_PLAIN_DATA/)
})

test('visual implementation cannot start while audit gates remain open', () => {
  assert.ok(audit.open_gates.includes('VISUAL_DIRECTION_SELECTION'))
  assert.ok(audit.open_gates.includes('LEGACY_TAURI_SECURITY_SCAN'))
  assert.ok(audit.open_gates.includes('REVERSIBLE_DATA_MIGRATION_REHEARSAL'))
})