import test from 'node:test';
import assert from 'node:assert/strict';
import { generateKeyPairSync } from 'node:crypto';
import {
  assertRegisteredTrustedManifestSigner,
  parseTrustedManifestSignerRegistry,
  resolveTrustedManifestSigner,
} from './trusted-signer-registry.js';

const COMMIT = 'd'.repeat(40);
const SOURCE = {
  repositoryId: 'REPO-012',
  sourceCommit: COMMIT,
  sourceUrl: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
} as const;
const publicKeyPem = generateKeyPairSync('ed25519').publicKey
  .export({ format: 'pem', type: 'spki' }).toString();

function registry(signers: unknown[] = []) {
  return {
    registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
    schema: 'gh-aios.trusted-domain-manifest-signers/v1',
    signers,
    state: 'CURRENT',
    version: '1.0.0',
  };
}

function signer(overrides: Record<string, unknown> = {}) {
  return {
    algorithm: 'Ed25519',
    domainIds: ['DOM-FIFTH-0001'],
    publicKeyPem,
    repositoryId: 'REPO-014',
    signerId: 'GH-LIGHTHOUSE-001',
    status: 'ACTIVE',
    ...overrides,
  };
}

test('an empty current registry is safe and trusts no signer', () => {
  const parsed = parseTrustedManifestSignerRegistry(registry(), SOURCE);
  assert.equal(parsed.signers.length, 0);
  assert.equal(resolveTrustedManifestSigner(parsed, {
    domainId: 'DOM-FIFTH-0001',
    repositoryId: 'REPO-014',
    signerId: 'GH-LIGHTHOUSE-001',
  }), null);
});

test('an active Ed25519 SPKI signer resolves only for its exact domain and repository', () => {
  const parsed = parseTrustedManifestSignerRegistry(registry([signer()]), SOURCE);
  const trusted = resolveTrustedManifestSigner(parsed, {
    domainId: 'DOM-FIFTH-0001',
    repositoryId: 'REPO-014',
    signerId: 'GH-LIGHTHOUSE-001',
  });
  assert.ok(trusted);
  assert.equal(assertRegisteredTrustedManifestSigner(trusted), trusted);
  assert.equal(resolveTrustedManifestSigner(parsed, {
    domainId: 'DOMAIN-OTHER',
    repositoryId: 'REPO-014',
    signerId: 'GH-LIGHTHOUSE-001',
  }), null);
});

test('copied signer fields do not cross the parsed-registry trust boundary', () => {
  const parsed = parseTrustedManifestSignerRegistry(registry([signer()]), SOURCE);
  const trusted = resolveTrustedManifestSigner(parsed, {
    domainId: 'DOM-FIFTH-0001',
    repositoryId: 'REPO-014',
    signerId: 'GH-LIGHTHOUSE-001',
  });
  assert.ok(trusted);
  assert.throws(() => assertRegisteredTrustedManifestSigner({ ...trusted }), /trusted_manifest_signer_unregistered/);
});

test('revoked signers stay parseable for history but never resolve', () => {
  const parsed = parseTrustedManifestSignerRegistry(registry([signer({ status: 'REVOKED' })]), SOURCE);
  assert.equal(resolveTrustedManifestSigner(parsed, {
    domainId: 'DOM-FIFTH-0001',
    repositoryId: 'REPO-014',
    signerId: 'GH-LIGHTHOUSE-001',
  }), null);
});

test('duplicates, unknown fields and unsupported algorithms fail closed', () => {
  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer(), signer()]), SOURCE), /trusted_signer_registry_invalid/);
  assert.throws(() => parseTrustedManifestSignerRegistry({ ...registry(), extra: true }, SOURCE), /trusted_signer_registry_invalid/);
  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ algorithm: 'RSA' })]), SOURCE), /trusted_signer_registry_invalid/);
});

test('private keys and malformed public keys fail closed', () => {
  const privateKeyPem = generateKeyPairSync('ed25519').privateKey
    .export({ format: 'pem', type: 'pkcs8' }).toString();
  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ publicKeyPem: privateKeyPem })]), SOURCE), /trusted_signer_registry_invalid/);
  assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ publicKeyPem: 'not-a-key' })]), SOURCE), /trusted_signer_registry_invalid/);
});

test('registry source provenance requires exact Guanghu HTTPS and a full commit', () => {
  assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceCommit: 'short' }), /trusted_signer_registry_source_invalid/);
  assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceUrl: 'https://example.com/registry.json' }), /trusted_signer_registry_source_invalid/);
  assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceUrl: 'https://user:pass@guanghulab.com/registry.json' }), /trusted_signer_registry_source_invalid/);
});