import assert from "node:assert/strict";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { createRequire } from "node:module";
import test from "node:test";
import ts from "typescript";

const root = path.resolve(import.meta.dirname, "../../..");
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-host-call-"));
const require = createRequire(import.meta.url);
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
  const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
    .replace('require("./asset-path")', 'require("./asset-path.cjs")').replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
}
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
const digest = "a".repeat(64);
const permissions = new Set(protocol.SCRIPT_PERMISSIONS);
const call = (name, parameters) => ({ schemaVersion: 1, requestId: `host:${name.toLowerCase()}`, scriptId: "clean", call: name, permission: name, parameters });

test("M13-03C parses all allowlisted host calls with structured parameters", () => {
  const inputs = [
    call("READ_MAIN", { revision: 3 }),
    call("READ_ASSET", { path: "//assets/model.bin", expectedSha256: digest }),
    call("WRITE_MAIN", { revision: 3, operation: "object.transform", payload: { objectId: "obj:1", x: 1 } }),
    call("WRITE_ASSET", { path: "assets/out.bin", byteLength: 4, sha256: digest }),
    call("SUBMIT_SERVER_JOB", { inputBlendSha256: digest, settingsSha256: digest }),
  ];
  const parsed = inputs.map((input) => protocol.parseScriptHostCall(input, permissions));
  assert.deepEqual(parsed.map((item) => item.call), ["READ_MAIN", "READ_ASSET", "WRITE_MAIN", "WRITE_ASSET", "SUBMIT_SERVER_JOB"]);
  assert.equal(parsed[1].parameters.path, "assets/model.bin");
  assert.equal(parsed[2].execution, "DISABLED");
});

test("M13-03C rejects non-allowlisted calls, permission confusion and unknown fields", () => {
  assert.throws(() => protocol.parseScriptHostCall(call("EXECUTE", {}), permissions), /SCRIPT_POLICY_DENIED/);
  assert.throws(() => protocol.parseScriptHostCall({ ...call("READ_MAIN", { revision: 3 }), permission: "WRITE_MAIN" }, permissions), /SCRIPT_POLICY_DENIED/);
  assert.throws(() => protocol.parseScriptHostCall(call("READ_MAIN", { revision: 3, extra: true }), permissions), /SCRIPT_MANIFEST_INVALID/);
  assert.throws(() => protocol.parseScriptHostCall(call("READ_ASSET", { path: "../escape", expectedSha256: digest }), permissions), /SCRIPT_MANIFEST_INVALID/);
  assert.throws(() => protocol.parseScriptHostCall(call("WRITE_MAIN", { revision: 3, operation: "x", payload: [] }), permissions), /SCRIPT_MANIFEST_INVALID/);
});

test("M13-03C requires the declared permission set", () => {
  assert.throws(() => protocol.parseScriptHostCall(call("WRITE_MAIN", { revision: 0, operation: "x", payload: {} }), new Set(["READ_MAIN"])), /SCRIPT_POLICY_DENIED/);
});

test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));