import { test } from "node:test";
import assert from "node:assert/strict";
import { mkdtemp, writeFile, readFile, readdir } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { seal, unseal, compareVersions } from "../dist/primitives/index.js";
import { registerModuleTools, collectTools, resetTools } from "../dist/tools/index.js";
import { runProvisioner, type Grant } from "../dist/provisioner/index.js";

test("seal round-trips and rejects the wrong key", () => {
  const sealed = seal("hunter2", "node-key");
  assert.equal(unseal(sealed, "node-key"), "hunter2");
  assert.notEqual(sealed, "hunter2");
  assert.throws(() => unseal(sealed, "wrong-key"));
});

test("semver orders releases", () => {
  assert.equal(compareVersions("1.2.3", "1.2.10"), -1);
  assert.equal(compareVersions("2.0.0", "1.9.9"), 1);
  assert.equal(compareVersions("v1.0.0", "1.0.0"), 0);
});

test("module tools register and collect, a thrower is skipped not fatal", () => {
  resetTools();
  registerModuleTools("umami", () => [
    { name: "umami_stats", description: "d", input: {}, run: async () => 1 },
  ]);
  registerModuleTools("broken", () => {
    throw new Error("no token");
  });
  const collected = collectTools({});
  const umami = collected.find((c) => c.module === "umami");
  const broken = collected.find((c) => c.module === "broken");
  assert.equal(umami?.tools.length, 1);
  assert.equal(broken?.tools.length, 0);
});

test("provisioner creates a sealed credential for a grant, then removes on withdrawal", async () => {
  const dir = await mkdtemp(join(tmpdir(), "prov-"));
  const created: string[] = [];
  const removed: string[] = [];

  const grant: Grant = { resource: "analytics", consumer: "webapp", node: "anchor", values: { name: "webapp" } };
  await writeFile(join(dir, "webapp.grant.json"), JSON.stringify(grant));

  const stop = runProvisioner(
    "analytics",
    {
      async create(g) {
        created.push(g.consumer);
        return { fields: { siteId: "abc", snippet: "<script>", dashboard: "https://x/webapp" } };
      },
      async remove(g) {
        removed.push(g.consumer);
      },
    },
    { grants: dir, sealKey: "k", everyMs: 20 },
  );

  await waitFor(() => created.length === 1, 2000);
  const files = await readdir(dir);
  const credFile = files.find((f) => f.endsWith(".credential"));
  assert.ok(credFile, "a credential file was written");
  const sealed = await readFile(join(dir, credFile!), "utf8");
  const body = JSON.parse(unseal(sealed, "k")) as { fields: Record<string, string> };
  assert.equal(body.fields.siteId, "abc");

  // Withdraw the grant → the harness removes via the adapter and deletes the credential.
  await (await import("node:fs/promises")).rm(join(dir, "webapp.grant.json"));
  await waitFor(() => removed.length === 1, 2000);
  stop();
});

async function waitFor(cond: () => boolean, ms: number): Promise<void> {
  const start = Date.now();
  while (!cond()) {
    if (Date.now() - start > ms) throw new Error("timed out waiting");
    await new Promise((r) => setTimeout(r, 10));
  }
}