import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import { readFile } from "node:fs/promises";
import { fileURLToPath } from "node:url";
import test from "node:test";

const contractUrl = new URL(
  "../../../deployment/device-edge-core-channel-v1.json",
  import.meta.url,
);
const freezeUrl = new URL(
  "../../../deployment/superseded-vps-initiated-transport-v1.json",
  import.meta.url,
);
const sourceAcceptanceUrl = new URL(
  "../../../deployment/device-edge-core-channel-source-v1.json",
  import.meta.url,
);
const edgeBuilder = fileURLToPath(new URL(
  "../../../infra/deploy-runner/build-device-edge-vps-artifact.mjs",
  import.meta.url,
));
const enrollmentBuilder = fileURLToPath(new URL(
  "../../../infra/deploy-runner/build-device-plane-backhaul-vps-enrollment-artifact.mjs",
  import.meta.url,
));

async function readJson(url) {
  return JSON.parse(await readFile(url, "utf8"));
}

test("pins a Core-initiated mutually authenticated Edge channel", async () => {
  const contract = await readJson(contractUrl);

  assert.equal(contract.status, "accepted-design");
  assert.equal(contract.direction, "device-gateway-core-initiated");
  assert.equal(contract.transport.tls, "TLSv1.3-mutual-authentication");
  assert.equal(contract.transport.genericTcpForwarding, "forbidden");
  assert.equal(contract.networkBoundary.synologyPublicIngress, false);
  assert.equal(contract.networkBoundary.vpsInitiatedSynologyConnection, false);
  assert.equal(contract.networkBoundary.subnetRoutes, false);
  assert.equal(contract.networkBoundary.exitNode, false);
  assert.equal(contract.identity.privateKeysInArtifacts, false);
});

test("requires Core acceptance before acknowledging tracker packages", async () => {
  const contract = await readJson(contractUrl);

  assert.equal(
    contract.acknowledgement.trackerPackageAck,
    "only-after-bounded-core-acceptance",
  );
  assert.equal(
    contract.acknowledgement.coreUnavailable,
    "do-not-acknowledge-tracker-package",
  );
  assert.equal(contract.acknowledgement.deliverySemantics, "at-least-once");
  assert.equal(contract.pilotLimits.durableEdgeSpool, false);
  assert.ok(contract.pilotLimits.maxBufferedBytesPerTrackerSession <= 262144);
  assert.ok(contract.pilotLimits.maxAggregateBufferedBytes <= 33554432);
  assert.equal(contract.pilotSlo.trackerAckBeforeDurableCoreAcceptance, 0);
  assert.equal(contract.pilotSlo.lossOfCoreAcceptedPackages, 0);
  assert.ok(
    contract.pilotSlo.edgeReceiveToCoreAcceptanceP99Milliseconds <= 5000,
  );
  assert.ok(contract.pilotSlo.deadCoreDetectionHardCeilingSeconds <= 45);
});

test("records source acceptance without opening an Edge or tracker port", async () => {
  const acceptance = await readJson(sourceAcceptanceUrl);

  assert.equal(acceptance.status, "source-accepted");
  assert.equal(acceptance.transport.initiator, "device-gateway-core");
  assert.equal(acceptance.transport.tls, "TLSv1.3-mutual-authentication");
  assert.equal(acceptance.identity.privateKeysInSource, false);
  assert.equal(acceptance.identity.privateKeysInArtifact, false);
  assert.equal(
    acceptance.identity.rotation,
    "one-active-plus-one-staged-generation",
  );
  assert.equal(acceptance.identity.retiredFingerprint, "reject");
  assert.equal(acceptance.runtime.mutationInThisTransition, false);
  assert.equal(acceptance.runtime.edgePort8443Published, false);
  assert.equal(acceptance.runtime.trackerPort9921Published, false);
  assert.equal(acceptance.runtime.synologyPublicIngress, false);
  assert.equal(acceptance.runtime.commandTransport, "disabled");
  assert.equal(acceptance.runtime.gelios, "untouched");
});

test("freezes the VPS-initiated Tailscale and SSH backhaul", async () => {
  const freeze = await readJson(freezeUrl);

  assert.equal(freeze.status, "frozen");
  assert.equal(freeze.successor, "nodedc.device-edge.core-channel.v1");
  assert.equal(freeze.runtimeMutationInPhase0, false);
  assert.ok(freeze.forbiddenForNewPlanOrApply.includes(
    "nodedc.device-plane.backhaul-vps-enrollment.v1",
  ));
  assert.ok(freeze.forbiddenForNewPlanOrApply.includes(
    "tailscale-userspace-key-only-ssh-local-forward",
  ));
});

test("superseded artifact builders fail closed outside test-only reconstruction", () => {
  const environment = { ...process.env };
  delete environment.NODEDC_ALLOW_SUPERSEDED_TRANSPORT;

  const edge = spawnSync(
    process.execPath,
    [edgeBuilder, "backhaul", "superseded-backhaul-unit"],
    { encoding: "utf8", env: environment },
  );
  assert.notEqual(edge.status, 0);
  assert.match(edge.stderr, /vps_initiated_transport_frozen:ADR-0001/);

  const enrollment = spawnSync(
    process.execPath,
    [enrollmentBuilder, "superseded-enrollment-unit"],
    { encoding: "utf8", env: environment },
  );
  assert.notEqual(enrollment.status, 0);
  assert.match(enrollment.stderr, /vps_initiated_transport_frozen:ADR-0001/);
});