import assert from "node:assert/strict";
import { test } from "node:test";

import { normalizeRuntimeDocument } from "../src/server.mjs";

const fingerprint = Array.from({ length: 32 }, () => "AB").join(":");

test("runtime document accepts one generation-bound Core identity", () => {
  const result = normalizeRuntimeDocument({
    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
    edgeRegistrationId: "edge:moscow-vps-1",
    channelGeneration: "channel:1",
    trustGeneration: "trust:1",
    allowedCoreFingerprints: [fingerprint],
  });

  assert.equal(result.edgeRegistrationId, "edge:moscow-vps-1");
  assert.deepEqual(result.allowedCoreFingerprints, [fingerprint]);
});

test("runtime document rejects hidden authority and missing identity", () => {
  assert.throws(() => normalizeRuntimeDocument({
    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
    edgeRegistrationId: "edge:moscow-vps-1",
    channelGeneration: "channel:1",
    trustGeneration: "trust:1",
    allowedCoreFingerprints: [fingerprint],
    endpoint: "https://attacker.invalid",
  }), /runtime_config_key_invalid/);

  assert.throws(() => normalizeRuntimeDocument({
    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
    edgeRegistrationId: "edge:moscow-vps-1",
    channelGeneration: "channel:1",
    trustGeneration: "trust:1",
    allowedCoreFingerprints: [],
  }), /runtime_core_identity_invalid/);

  assert.throws(() => normalizeRuntimeDocument({
    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
    edgeRegistrationId: "edge:moscow-vps-1",
    channelGeneration: "channel:1",
    trustGeneration: "trust:1",
    allowedCoreFingerprints: [fingerprint, fingerprint],
  }), /runtime_core_identity_invalid/);
});