import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import test from "node:test";

import {
  explicitlyDistrustedAuthority,
  expiredLeafCertificate,
  hostnameMismatch,
  unknownLocalAuthority,
} from "../fixtures/tls.js";
import {
  createCommunityAdvicePlugin,
  createFirefoxValidationPlugin,
  createUserDecisionPlugin,
  createVillageCommunityPlugin,
} from "../plugins/demo-plugins.js";
import { TrustRunner } from "../src/index.js";
import { chainRows, flattenDerTree, smallestDerNodeAt, subjectName, verdictCopy } from "../ui/model.js";

test("UI model identifies the failed end of an unknown-authority chain", () => {
  const rows = chainRows(unknownLocalAuthority);
  assert.equal(rows.length, 2);
  assert.equal(rows[0].name, "library.village");
  assert.equal(rows.at(-1).failed, true);
  assert.match(rows.at(-1).edge, /Not anchored/);
});

test("UI model locates leaf and root policy failures precisely", () => {
  const expired = chainRows(expiredLeafCertificate);
  assert.equal(expired[0].failed, true);
  assert.match(expired[0].edge, /validity period/);
  assert.equal(expired.at(-1).failed, false);

  const mismatch = chainRows(hostnameMismatch);
  assert.equal(mismatch[0].failed, true);
  assert.match(mismatch[0].edge, /records\.village/);

  const distrusted = chainRows(explicitlyDistrustedAuthority);
  assert.equal(distrusted.at(-1).failed, true);
  assert.match(distrusted.at(-1).edge, /Explicitly distrusted/);
});

test("certificate display names prefer the common name", () => {
  assert.equal(subjectName("O=Village,CN=Library CA,C=GE"), "Library CA");
  assert.equal(subjectName("O=Village\nCN=Library CA\nC=GE"), "Library CA");
  assert.equal(subjectName("O=Nameless"), "O=Nameless");
});

test("DER byte selection resolves to the narrowest ASN.1 node", () => {
  const tree = {
    type: "SEQUENCE", offset: 0, endOffset: 12, children: [
      { type: "INTEGER", offset: 2, endOffset: 5, children: [] },
      { type: "OCTET STRING", offset: 5, endOffset: 12, children: [] },
    ],
  };
  assert.deepEqual(flattenDerTree(tree).map((item) => item.depth), [0, 1, 1]);
  assert.equal(smallestDerNodeAt(tree, 3).type, "INTEGER");
  assert.equal(smallestDerNodeAt(tree, 8).type, "OCTET STRING");
  assert.equal(smallestDerNodeAt(tree, 12), undefined);
});

test("UI plugins produce attributed evidence and a local Boolean verdict", async () => {
  const plugins = [
    configure(createFirefoxValidationPlugin(), "advisor"),
    configure(createVillageCommunityPlugin(), "advisor"),
    configure(createUserDecisionPlugin(true), "decision-authority"),
  ];
  const result = await new TrustRunner({ plugins }).evaluate(unknownLocalAuthority);

  assert.equal(result.verdict.trusted, true);
  assert.ok(result.journal.entries.some((entry) => entry.code === "unknown-issuer"));
  assert.ok(
    result.journal.entries.some((entry) => entry.code === "community-key-continuity"),
  );
  assert.equal(verdictCopy(result, true).title, "You trust this connection");
});

test("conflicting community advice remains visible without becoming a verdict", async () => {
  const plugins = [
    configure(createCommunityAdvicePlugin({
      id: "community.yes",
      name: "Community Yes",
      trusted: true,
      message: "Known key",
    }), "advisor"),
    configure(createCommunityAdvicePlugin({
      id: "community.no",
      name: "Community No",
      trusted: false,
      message: "Unexpected change",
    }), "advisor"),
  ];
  const result = await new TrustRunner({ plugins }).evaluate(unknownLocalAuthority);

  assert.equal(result.verdict.trusted, false);
  assert.deepEqual(
    result.journal.entries.map((entry) => entry.data?.trusted),
    [true, false],
  );
  assert.ok(result.journal.entries.every((entry) => entry.kind === "vote"));
});

function configure(plugin, mode) {
  return { plugin, mode };
}

test("security surface contains immutable-frame and simulation labels", async () => {
  const html = await readFile(new URL("../ui/index.html", import.meta.url), "utf8");
  assert.match(html, /Browsec security decision/);
  assert.match(html, /Browser-owned test surface/);
  assert.match(html, /TRUSTLAB · SYNTHETIC/);
  assert.match(html, /cannot alter browser or system trust/);
  assert.match(html, /Live TLS target/);
  assert.match(html, /Export investigation/);
  assert.match(html, /Import investigation/);
  assert.match(html, /Decision target/);
  assert.match(html, /Effective and consumed local rules/);
});