import test from 'node:test';
import assert from 'node:assert/strict';
import { createHash, generateKeyPairSync, sign } from 'node:crypto';
import {
  domainManifestSigningBytes,
  evaluateDomainAccess,
  parseDomainAccessHandoff,
  verifyDomainAccessHandoffFromSnapshot,
} from './domain-access.js';
import {
  parseTrustedManifestSignerRegistry,
  resolveTrustedManifestSigner,
  type TrustedManifestSigner,
} from './trusted-signer-registry.js';
import { TrustedSignerSnapshotLoader } from './trusted-signer-snapshot.js';

const NOW = 1_786_291_200_000;
const COMMIT = 'b'.repeat(40);
const NODE_TYPE = 'local-terminal' as const;
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
function trustedSignerFromRegistry(overrides: Record<string, unknown> = {}): TrustedManifestSigner {
  const parsed = parseTrustedManifestSignerRegistry({
    registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
    schema: 'gh-aios.trusted-domain-manifest-signers/v1',
    signers: [{
      algorithm: 'Ed25519',
      domainIds: ['DOM-FIFTH-0001'],
      publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
      repositoryId: 'REPO-014',
      signerId: 'GH-LIGHTHOUSE-001',
      status: 'ACTIVE',
      ...overrides,
    }],
    state: 'CURRENT',
    version: '1.0.0',
  }, {
    repositoryId: 'REPO-012',
    sourceCommit: 'a'.repeat(40),
    sourceUrl: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
  });
  const signer = resolveTrustedManifestSigner(parsed, {
    domainId: 'DOM-FIFTH-0001',
    repositoryId: String(overrides.repositoryId ?? 'REPO-014'),
    signerId: 'GH-LIGHTHOUSE-001',
  });
  if (!signer) throw new Error('test_trusted_signer_missing');
  return signer;
}
const trustedSigner = trustedSignerFromRegistry();
const manifestPayload = {
  domainId: 'DOM-FIFTH-0001',
  repositoryId: 'REPO-014',
  schema: 'gh-aios.domain-manifest/v1',
  signerId: 'GH-LIGHTHOUSE-001',
  sourceCommit: COMMIT,
} as const;
const signedBytes = domainManifestSigningBytes(manifestPayload);
const DIGEST = createHash('sha256').update(signedBytes).digest('hex');

const validHandoff = {
  connectionReceipt: {
    connectionId: 'CONN-001',
    domainId: 'DOM-FIFTH-0001',
    manifestDigest: DIGEST,
    nodeId: 'LOCAL-001',
    nodeType: NODE_TYPE,
    receiptId: 'RECEIPT-001',
    state: 'online',
  },
  manifest: {
    digest: DIGEST,
    ...manifestPayload,
    signature: sign(null, signedBytes, privateKey).toString('base64'),
  },
  sessionCapability: {
    capabilityId: 'CAP-001',
    domainId: 'DOM-FIFTH-0001',
    expiresAt: NOW + 60_000,
    nodeId: 'LOCAL-001',
    nodeType: NODE_TYPE,
    scopes: ['domain:enter'],
  },
} as const;
const verifiedHandoff = parseDomainAccessHandoff(
  validHandoff,
  'DOM-FIFTH-0001',
  'LOCAL-001',
  NODE_TYPE,
  trustedSigner,
  NOW,
);

const SNAPSHOT_COMMIT = 'a'.repeat(40);
const SNAPSHOT_ANCHOR_URL = 'https://guanghulab.com/api/ai/v1/anchor';
const SNAPSHOT_REGISTRY_URL = `https://guanghulab.com/code/bingshuo/guanghu-ice-heart/raw/commit/${SNAPSHOT_COMMIT}/routing/trusted-domain-manifest-signers.json`;

function snapshotAnchor() {
  return {
    schema: 'guanghu.public-navigation-anchor/v1',
    anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
    state: 'CURRENT_CANONICAL',
    repository_id: 'REPO-012',
    branch: 'main',
    public_entry: SNAPSHOT_ANCHOR_URL,
    code_entry: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
    maps: {
      trusted_domain_manifest_signers: {
        path: 'routing/trusted-domain-manifest-signers.json',
        id: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
        version: '1.0.0',
      },
    },
    navigation_source: {
      anchor_id: 'GLW-PUBLIC-NAV-ANCHOR-001',
      source_commit: SNAPSHOT_COMMIT,
      source_mode: 'REPO-012_MAIN_GIT_SNAPSHOT',
      source_degraded: false,
    },
  };
}

function snapshotRegistry(signers: unknown[] = [{
  algorithm: 'Ed25519',
  domainIds: ['DOM-FIFTH-0001'],
  publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
  repositoryId: 'REPO-014',
  signerId: 'GH-LIGHTHOUSE-001',
  status: 'ACTIVE',
}]) {
  return {
    registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
    schema: 'gh-aios.trusted-domain-manifest-signers/v1',
    signers,
    state: 'CURRENT',
    version: '1.0.0',
  };
}

function snapshotLoader(readRegistry: () => unknown) {
  return new TrustedSignerSnapshotLoader({
    async fetchJson(url) {
      if (url === SNAPSHOT_ANCHOR_URL) return snapshotAnchor();
      if (url === SNAPSHOT_REGISTRY_URL) return readRegistry();
      throw new Error('unexpected_url');
    },
  });
}

test('a local workspace remains available without claiming domain runtime access', () => {
  const status = evaluateDomainAccess({ accountVerified: false, domainId: 'DOM-FIFTH-0001', nodeId: '', nodePossessionVerified: false, nodeRegistrationVerified: false, nodeType: NODE_TYPE }, NOW);
  assert.equal(status.localWorkspaceAllowed, true);
  assert.equal(status.runtimeReady, false);
  assert.equal(status.stage, 'login-required');
});

test('a code-channel account cannot substitute for verified node registration', () => {
  const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY', nodePossessionVerified: false, nodeRegistrationVerified: false, nodeType: NODE_TYPE }, NOW);
  assert.equal(status.stage, 'login-required');
  assert.equal(status.blockers.includes('account_identity_missing'), false);
  assert.ok(status.blockers.includes('verified_node_registration_missing'));
});

test('a separately verified node is still not a domain runtime session', () => {
  const status = evaluateDomainAccess({ accountVerified: true, domainId: 'DOM-FIFTH-0001', nodeId: 'JD-FD-PRIMARY', nodePossessionVerified: true, nodeRegistrationVerified: true, nodeType: NODE_TYPE }, NOW);
  assert.equal(status.stage, 'identity-verified');
  assert.deepEqual(status.blockers, [
    'verified_domain_manifest_missing',
    'scoped_session_capability_missing',
    'matching_connection_receipt_missing',
  ]);
});

test('a signed registration without a current private-key proof remains login-required', () => {
  const status = evaluateDomainAccess({
    accountVerified: true,
    domainId: 'DOM-FIFTH-0001',
    nodeId: 'JD-FD-PRIMARY',
    nodePossessionVerified: false,
    nodeRegistrationVerified: true,
    nodeType: NODE_TYPE,
  }, NOW);
  assert.equal(status.stage, 'login-required');
  assert.ok(status.blockers.includes('verified_node_possession_missing'));
});

test('runtime access requires matching manifest, scoped capability and online receipt', () => {
  const handoff = parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW);
  const status = evaluateDomainAccess({
    accountVerified: true,
    domainId: 'DOM-FIFTH-0001',
    nodeId: 'LOCAL-001',
    nodePossessionVerified: true,
    nodeRegistrationVerified: true,
    nodeType: NODE_TYPE,
    ...handoff,
  }, NOW);
  assert.equal(status.runtimeReady, true);
  assert.equal(status.stage, 'runtime-ready');
  assert.deepEqual(status.blockers, []);
});

test('the runtime handoff entry resolves its signer only from a loaded snapshot', async () => {
  const snapshot = await snapshotLoader(() => snapshotRegistry()).refresh();
  const verified = verifyDomainAccessHandoffFromSnapshot(
    validHandoff,
    'DOM-FIFTH-0001',
    'LOCAL-001',
    NODE_TYPE,
    { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
    snapshot,
    NOW,
  );

  assert.equal(verified.trustSource.status, 'CURRENT');
  assert.equal(verified.trustSource.sourceCommit, SNAPSHOT_COMMIT);
  assert.equal(evaluateDomainAccess({
    accountVerified: true,
    domainId: 'DOM-FIFTH-0001',
    nodeId: 'LOCAL-001',
    nodePossessionVerified: true,
    nodeRegistrationVerified: true,
    nodeType: NODE_TYPE,
    ...verified.handoff,
  }, NOW).runtimeReady, true);
});

test('an empty, forged or mismatched snapshot cannot open the runtime handoff', async () => {
  const empty = await snapshotLoader(() => snapshotRegistry([])).refresh();
  assert.throws(() => verifyDomainAccessHandoffFromSnapshot(
    validHandoff,
    'DOM-FIFTH-0001',
    'LOCAL-001',
    NODE_TYPE,
    { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
    empty,
    NOW,
  ), /domain_access_handoff_invalid/);

  const loaded = await snapshotLoader(() => snapshotRegistry()).refresh();
  assert.throws(() => verifyDomainAccessHandoffFromSnapshot(
    validHandoff,
    'DOM-FIFTH-0001',
    'LOCAL-001',
    NODE_TYPE,
    { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
    { ...loaded },
    NOW,
  ), /domain_access_handoff_invalid/);
  assert.throws(() => verifyDomainAccessHandoffFromSnapshot(
    validHandoff,
    'DOM-FIFTH-0001',
    'LOCAL-001',
    NODE_TYPE,
    { repositoryId: 'REPO-OTHER', signerId: 'GH-LIGHTHOUSE-001' },
    loaded,
    NOW,
  ), /domain_access_handoff_invalid/);
});

test('a clearly degraded last-known-good snapshot remains usable without claiming freshness', async () => {
  let registry: unknown = snapshotRegistry();
  const loader = snapshotLoader(() => registry);
  await loader.refresh();
  registry = { ...snapshotRegistry(), version: 'invalid' };
  const degraded = await loader.refresh();

  const verified = verifyDomainAccessHandoffFromSnapshot(
    validHandoff,
    'DOM-FIFTH-0001',
    'LOCAL-001',
    NODE_TYPE,
    { repositoryId: 'REPO-014', signerId: 'GH-LIGHTHOUSE-001' },
    degraded,
    NOW,
  );
  assert.equal(verified.trustSource.status, 'DEGRADED_LAST_KNOWN_GOOD');
  assert.equal(verified.trustSource.reason, 'REGISTRY_INVALID');
  assert.equal(verified.trustSource.sourceCommit, SNAPSHOT_COMMIT);
});

test('mismatched or expired evidence fails closed', () => {
  const status = evaluateDomainAccess({
    accountVerified: true,
    connectionReceipt: { connectionId: 'CONN-001', domainId: 'DOMAIN-OTHER', manifestDigest: DIGEST, nodeId: 'LOCAL-001', nodeType: NODE_TYPE, receiptId: 'RECEIPT-001', state: 'online' },
    domainId: 'DOM-FIFTH-0001',
    manifest: verifiedHandoff.manifest,
    nodeId: 'LOCAL-001',
    nodePossessionVerified: true,
    nodeRegistrationVerified: true,
    nodeType: NODE_TYPE,
    sessionCapability: { capabilityId: 'CAP-001', domainId: 'DOM-FIFTH-0001', expiresAt: NOW, nodeId: 'LOCAL-001', nodeType: NODE_TYPE, scopes: ['domain:enter'] },
  }, NOW);
  assert.equal(status.runtimeReady, false);
  assert.ok(status.blockers.includes('scoped_session_capability_missing'));
  assert.ok(status.blockers.includes('matching_connection_receipt_missing'));
});

test('the input cannot supply its own verifier receipt', () => {
  assert.throws(() => parseDomainAccessHandoff({
    ...validHandoff,
    manifest: {
      ...validHandoff.manifest,
      verifierReceipt: { state: 'verified' },
    },
  }, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});

test('unknown fields and malformed digests fail closed', () => {
  assert.throws(() => parseDomainAccessHandoff({
    ...validHandoff,
    manifest: { ...validHandoff.manifest, digest: 'not-a-digest' },
    trusted: true,
  }, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});

test('the handoff is bound to the requested domain, node and manifest digest', () => {
  assert.throws(() => parseDomainAccessHandoff({
    ...validHandoff,
    connectionReceipt: { ...validHandoff.connectionReceipt, manifestDigest: 'c'.repeat(64) },
  }, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
  assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'OTHER-NODE', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
  assert.throws(() => parseDomainAccessHandoff(validHandoff, 'DOM-FIFTH-0001', 'LOCAL-001', 'cloud-resident', trustedSigner, NOW), /domain_access_handoff_invalid/);
});

test('manifest tampering and signatures from another key fail closed', () => {
  assert.throws(() => parseDomainAccessHandoff({
    ...validHandoff,
    manifest: { ...validHandoff.manifest, sourceCommit: 'c'.repeat(40) },
  }, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);

  const other = generateKeyPairSync('ed25519');
  assert.throws(() => parseDomainAccessHandoff({
    ...validHandoff,
    manifest: {
      ...validHandoff.manifest,
      signature: sign(null, signedBytes, other.privateKey).toString('base64'),
    },
  }, 'DOM-FIFTH-0001', 'LOCAL-001', NODE_TYPE, trustedSigner, NOW), /domain_access_handoff_invalid/);
});

test('trusted signer identity and repository are external inputs, not payload authority', () => {
  assert.throws(() => parseDomainAccessHandoff(
    validHandoff,
    'DOM-FIFTH-0001',
    'LOCAL-001',
    NODE_TYPE,
    trustedSignerFromRegistry({ repositoryId: 'REPO-OTHER' }),
    NOW,
  ), /domain_access_handoff_invalid/);
});

test('copying verified-looking fields cannot bypass the in-process verifier boundary', () => {
  const status = evaluateDomainAccess({
    accountVerified: true,
    connectionReceipt: verifiedHandoff.connectionReceipt,
    domainId: 'DOM-FIFTH-0001',
    manifest: {
      ...verifiedHandoff.manifest,
      verifierReceipt: { ...verifiedHandoff.manifest.verifierReceipt },
    },
    nodeId: 'LOCAL-001',
    nodePossessionVerified: true,
    nodeRegistrationVerified: true,
    nodeType: NODE_TYPE,
    sessionCapability: verifiedHandoff.sessionCapability,
  }, NOW);
  assert.equal(status.runtimeReady, false);
  assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
});