'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const os = require('node:os');
const path = require('node:path');
const { spawnSync } = require('node:child_process');

const ROOT = path.join(__dirname, '..');
const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
const readJson = (name) => JSON.parse(read(name));

function writeKit(root, { version = '1.2.5', legacy = false } = {}) {
  const extension = path.join(root, 'chrome-extension');
  fs.mkdirSync(extension, { recursive: true });
  fs.writeFileSync(path.join(root, 'AltaCameraProxy.exe'), 'synthetic executable');
  fs.writeFileSync(path.join(root, 'aware-cam-proxy.exe'), 'synthetic helper');
  for (const name of ['popup.html', 'popup.js', 'popup.css', 'options.html', 'options.js', 'options.css']) {
    fs.writeFileSync(path.join(extension, name), legacy && name === 'popup.js' ? 'apt-local-bridge-token' : `'use strict';`);
  }
  fs.writeFileSync(path.join(extension, 'manifest.json'), JSON.stringify({
    manifest_version: 3,
    name: 'Alta Proxy Tool Bridge',
    version,
  }));
}

test('application and extension versions and supported dependencies stay coordinated', () => {
  const pkg = readJson('package.json');
  const lock = readJson('package-lock.json');
  const manifest = readJson('chrome-extension/manifest.json');

  assert.equal(pkg.version, '1.2.5');
  assert.equal(manifest.version, pkg.version);
  assert.equal(lock.version, pkg.version);
  assert.equal(lock.packages[''].version, pkg.version);
  assert.deepEqual(pkg.dependencies, { axios: '1.19.0' });
  assert.deepEqual(pkg.devDependencies, {
    electron: '43.4.1',
    'electron-builder': '26.15.3',
  });
  for (const removed of ['crypto-js', 'electron-packager']) {
    assert.equal(pkg.dependencies?.[removed], undefined);
    assert.equal(pkg.devDependencies?.[removed], undefined);
  }
});

test('build remains Windows portable without misleading signing overrides', () => {
  const pkg = readJson('package.json');
  assert.equal(pkg.build.win.target, 'portable');
  assert.equal(pkg.build.portable.artifactName, 'AltaCameraProxy-${version}-portable.exe');
  assert.equal(Object.hasOwn(pkg.build.win, 'signAndEditExecutable'), false);
  assert.equal(Object.hasOwn(pkg.build, 'forceCodeSigning'), false);
  assert.equal(pkg.scripts['audit:prod'], 'npm audit --omit=dev --audit-level=low');
  assert.match(pkg.scripts.check, /verify-kit/);
});

test('GitPeji CI targets the live runner and is build-only on Node 22', () => {
  const workflow = read('.gitea/workflows/ci.yml');
  assert.match(workflow, /runs-on:\s*apt-ci/);
  assert.doesNotMatch(workflow, /^\s*runs-on:\s*ubuntu-latest\s*$/m);
  assert.match(workflow, /actions\/checkout@v4/);
  assert.match(workflow, /actions\/setup-node@v4/);
  assert.match(workflow, /node-version:\s*['"]?22['"]?/);
  for (const command of ['npm ci', 'npm run check', 'npm run audit:prod', 'npm run build-test']) {
    assert.ok(workflow.includes(command), `missing CI command: ${command}`);
  }
  assert.match(workflow, /verify-kit\.js\s+--build\s+dist\/win-unpacked/);
  assert.doesNotMatch(workflow, /npm\s+(?:publish|run\s+(?:release|deploy))|actions\/(?:upload-release|deploy)|git\s+push/i);
  assert.doesNotMatch(workflow, /secrets\./);
});

test('kit verifier accepts a complete synthetic kit and rejects version drift and legacy strings', () => {
  const valid = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-valid-'));
  writeKit(valid);
  const accepted = spawnSync(process.execPath, ['scripts/verify-kit.js', valid], { cwd: ROOT, encoding: 'utf8' });
  assert.equal(accepted.status, 0, accepted.stderr || accepted.stdout);

  const drifted = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-drift-'));
  writeKit(drifted, { version: '1.0.0' });
  const rejectedDrift = spawnSync(process.execPath, ['scripts/verify-kit.js', drifted], { cwd: ROOT, encoding: 'utf8' });
  assert.notEqual(rejectedDrift.status, 0);
  assert.match(rejectedDrift.stderr, /version/i);

  const legacy = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-legacy-'));
  writeKit(legacy, { legacy: true });
  const rejectedLegacy = spawnSync(process.execPath, ['scripts/verify-kit.js', legacy], { cwd: ROOT, encoding: 'utf8' });
  assert.notEqual(rejectedLegacy.status, 0);
  assert.match(rejectedLegacy.stderr, /forbidden/i);
});

test('kit verifier rejects unsafe relative archive paths', () => {
  const { normalizeRelative } = require('../scripts/verify-kit');
  for (const unsafe of ['../escape', 'folder/../../escape', '/absolute', 'C:\\absolute']) {
    assert.throws(() => normalizeRelative(unsafe), /unsafe/i);
  }
  assert.equal(normalizeRelative('chrome-extension\\manifest.json'), 'chrome-extension/manifest.json');
});