import assert from "node:assert/strict";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { createRequire } from "node:module";
import test from "node:test";
import ts from "typescript";

const root = path.resolve(import.meta.dirname, "../../..");
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-manifest-canonical-"));
const require = createRequire(import.meta.url);
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
  const output = ts.transpileModule(source, {
    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
    fileName: `${name}.ts`,
  }).outputText
    .replace('require("./asset-path")', 'require("./asset-path.cjs")')
    .replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
}
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
const digest = "a".repeat(64);
const signature = "b".repeat(128);
const script = (id, overrides = {}) => ({
  id,
  name: id,
  entryPath: `scripts/${id}.py`,
  sourceByteLength: 128,
  sourceSha256: digest,
  publisher: "local",
  signature,
  keyId: "key:local",
  permissions: ["READ_MAIN"],
  dependencies: [],
  module: false,
  cpuMs: 1000,
  memoryBytes: 1024 * 1024,
  wallMs: 5000,
  network: false,
  autorun: false,
  driverExpressions: false,
  addonInstall: false,
  ...overrides,
});

test("M13-02B canonical serialization is invariant to manifest/script array order", () => {
  const base = {
    schemaVersion: 1,
    scripts: [
      script("zeta", { permissions: ["WRITE_ASSET", "READ_MAIN"], dependencies: [{ id: "alpha", sourceSha256: digest, sourcePath: "deps/alpha.py" }, { id: "beta", sourceSha256: digest, sourcePath: "deps/beta.py" }] }),
      script("alpha", { permissions: ["SUBMIT_SERVER_JOB", "READ_ASSET"] }),
      script("beta"),
    ],
  };
  const reordered = {
    schemaVersion: 1,
    scripts: [
      { ...base.scripts[1], permissions: [...base.scripts[1].permissions].reverse(), ignored: "removed" },
      { ...base.scripts[0], permissions: [...base.scripts[0].permissions].reverse(), dependencies: [...base.scripts[0].dependencies].reverse() },
      base.scripts[2],
    ],
  };
  const first = protocol.serializeScriptingManifest(base);
  const second = protocol.serializeScriptingManifest(reordered);
  assert.equal(first, second);
  assert.match(first, /^\{"schemaVersion":1,"scripts":\[/);
  assert.equal(Object.keys(protocol.canonicalizeScriptingManifest(reordered).scripts[0]).includes("ignored"), false);
});

test("M13-02B canonical serialization includes security-relevant declaration fields", () => {
  const base = { schemaVersion: 1, scripts: [script("clean")] };
  const changedBytes = { schemaVersion: 1, scripts: [script("clean", { sourceByteLength: 129 })] };
  const changedPermission = { schemaVersion: 1, scripts: [script("clean", { permissions: ["READ_ASSET"] })] };
  assert.notEqual(protocol.serializeScriptingManifest(base), protocol.serializeScriptingManifest(changedBytes));
  assert.notEqual(protocol.serializeScriptingManifest(base), protocol.serializeScriptingManifest(changedPermission));
  assert.throws(() => protocol.serializeScriptingManifest({ ...base, schemaVersion: 2 }), /PROTOCOL_MISMATCH/);
});

test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));