import assert from "node:assert/strict";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { createRequire } from "node:module";
import { fileURLToPath } from "node:url";
import ts from "../../web/node_modules/typescript/lib/typescript.js";

const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "scripting-isolation-"));
const require = createRequire(import.meta.url);

try {
  for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
    const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
    const result = ts.transpileModule(source, {
      compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
      fileName: `${name}.ts`,
    });
    const output = result.outputText
      .replace('require("./asset-path")', 'require("./asset-path.cjs")')
      .replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
    fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
  }

  const { createScriptExecutionAudit, gateScriptExecution, gateServerScriptJob } = require(path.join(temporary, "scripting-platform.cjs"));
  const digest = "a".repeat(64);
  const manifest = {
    schemaVersion: 1,
    scripts: [{
      id: "clean",
      name: "Clean",
      entryPath: "scripts/clean.py",
      sourceSha256: digest,
      publisher: "local",
      signature: "b".repeat(128),
      keyId: "approved-key",
      permissions: ["READ_MAIN"],
      dependencies: [],
      cpuMs: 1000,
      memoryBytes: 64 * 1024 * 1024,
      wallMs: 2000,
      network: false,
      autorun: false,
      driverExpressions: false,
      addonInstall: false,
    }],
  };

  const unsigned = gateScriptExecution(manifest, "clean", new Set());
  const approved = gateScriptExecution(manifest, "clean", new Set(["approved-key"]));
  const server = gateServerScriptJob({ scriptId: "clean", sourceSha256: digest }, manifest, digest);
  assert.equal(unsigned.status, "BLOCKED");
  assert.equal(unsigned.issues[0]?.code, "SCRIPT_SIGNATURE_INVALID");
  assert.equal(approved.status, "BLOCKED");
  assert.equal(approved.issues[0]?.code, "SCRIPT_SANDBOX_UNAVAILABLE");
  assert.equal(server.status, "BLOCKED");
  assert.equal(server.issues[0]?.code, "SERVER_JOB_UNAVAILABLE");
  const audit = await createScriptExecutionAudit(manifest, "clean", new Set(["approved-key"]), { requestId: "isolation-check", requestedAt: "2026-08-12T12:00:00.000Z" });
  assert.equal(audit.decision, "DENY");
  assert.equal(audit.reason, "SCRIPT_SANDBOX_UNAVAILABLE");
  assert.equal(audit.approvedKey, true);
  assert.match(audit.manifestSha256, /^[a-f0-9]{64}$/);
  assert.match(audit.requestSha256, /^[a-f0-9]{64}$/);
  process.stdout.write("scripting-isolation-ok status=BLOCKED audit=DENY approved-key=sandbox-unavailable server=unavailable execution=disabled\n");
}
finally {
  fs.rmSync(temporary, { recursive: true, force: true });
}