import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import test from 'node:test'
import { decodeBase64 } from '../security/base64.js'
import {
  PluginManifestSignatureError,
  verifySignedPluginManifest,
  type SignedPluginManifest,
} from '../src/internalSecurity'
import { canonicalJson } from '../security/canonical-json.js'

interface ServerSignatureVector {
  keyId: string
  publicKeyRawBase64: string
  canonicalJson: string
  signatureBase64Url: string
}

const vectorPath = new URL('./fixtures/rn-release-signature-vector.generated.json', import.meta.url)
const vector = JSON.parse(readFileSync(vectorPath, 'utf8')) as ServerSignatureVector
const manifest = JSON.parse(vector.canonicalJson) as SignedPluginManifest
const trustedKeys = { [vector.keyId]: vector.publicKeyRawBase64 }

test('accepts the Server-owned Ed25519 verification vector byte-for-byte', () => {
  assert.deepEqual(
    Buffer.from(canonicalJson(manifest), 'utf8'),
    Buffer.from(vector.canonicalJson, 'utf8'),
  )
  assert.equal(decodeBase64(vector.publicKeyRawBase64).length, 32)
  assert.equal(decodeBase64(vector.signatureBase64Url).length, 64)
  assert.doesNotThrow(() =>
    verifySignedPluginManifest(manifest, vector.keyId, vector.signatureBase64Url, trustedKeys),
  )
})

test('canonical manifest omits null fields used only by non-common modules', () => {
  assert.equal(
    canonicalJson({ moduleId: 'common', commonVersionRange: null }),
    '{"moduleId":"common"}',
  )
})

test('rejects an unknown plugin signing key', () => {
  assert.throws(
    () => verifySignedPluginManifest(manifest, 'unknown', vector.signatureBase64Url, trustedKeys),
    (error: unknown) =>
      error instanceof PluginManifestSignatureError && error.code === 'UNKNOWN_SIGNING_KEY',
  )
})

test('rejects any immutable manifest field tampering', () => {
  assert.throws(
    () =>
      verifySignedPluginManifest(
        { ...manifest, bundleSha256: 'b'.repeat(64) },
        vector.keyId,
        vector.signatureBase64Url,
        trustedKeys,
      ),
    (error: unknown) =>
      error instanceof PluginManifestSignatureError && error.code === 'INVALID_SIGNATURE',
  )
  assert.throws(
    () =>
      verifySignedPluginManifest(
        { ...manifest, archiveSha256: 'd'.repeat(64) },
        vector.keyId,
        vector.signatureBase64Url,
        trustedKeys,
      ),
    (error: unknown) =>
      error instanceof PluginManifestSignatureError && error.code === 'INVALID_SIGNATURE',
  )
})