import assert from 'node:assert/strict'
import test from 'node:test'

import { isCacheRecordFresh, openLocalCache, sealLocalCache } from '../src/secureCache'

test('LKG cache round-trips with context-bound authenticated encryption', () => {
  const encrypted = sealLocalCache('{"enabled":true}', 'signed-secret', 'app|package|environment')
  assert.equal(
    openLocalCache(encrypted, 'signed-secret', 'app|package|environment'),
    '{"enabled":true}',
  )
  assert.equal(encrypted.includes('enabled'), false)
})

test('LKG cache rejects tampering and a different package/environment context', () => {
  const encrypted = sealLocalCache('payload', 'signed-secret', 'app|package|environment')
  const parts = encrypted.split('.')
  parts[2] = `${parts[2][0] === 'A' ? 'B' : 'A'}${parts[2].slice(1)}`
  assert.throws(() => openLocalCache(parts.join('.'), 'signed-secret', 'app|package|environment'))
  assert.throws(() => openLocalCache(encrypted, 'signed-secret', 'app|other|environment'))
})

test('LKG freshness rejects future timestamps and expired records', () => {
  const now = 1_000_000
  assert.equal(isCacheRecordFresh(now - 1_000, now, 2_000), true)
  assert.equal(isCacheRecordFresh(now - 2_001, now, 2_000), false)
  assert.equal(isCacheRecordFresh(now + 1, now, 2_000), false)
})