'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const fs = require('fs');
const path = require('path');
const {
  createChimeraBeaconClient, parseBeaconResponse, parseSentinelResponse, buildSentinelRequest,
  parsePairResponse, hmacHex, REQUEST_PREFIX, SENTINEL_REQUEST_PREFIX, BEACON_PORT, MAX_PACKET_BYTES,
} = require('../../src/services/chimera-beacon-client');

test('Chimera Beacon protocol validates identity, nonce and bounded read-only telemetry', () => {
  const nonce = '0123456789abcdef';
  const response = Buffer.from(JSON.stringify({ schema: 1, service: 'chimera-beacon', version: '0.1.0', nonce, uptimeSeconds: 42, model: 'CFI-1016A', cpuTemperatureC: 61, socTemperatureC: 58, capabilities: ['identity', 'temperature', 'uptime', 'not-allowed'] }));
  const parsed = parseBeaconResponse(response, nonce);
  assert.equal(parsed.version, '0.1.0');
  assert.equal(parsed.model, 'CFI-1016A');
  assert.equal(parsed.cpuTemperatureC, 61);
  assert.deepEqual(parsed.capabilities, ['identity', 'temperature', 'uptime']);
  assert.equal(parsed.security.authenticated, false);
  assert.equal(BEACON_PORT, 9234);
  assert.equal(REQUEST_PREFIX, 'CHIMERA_DISCOVER/1 ');
  assert.throws(() => parseBeaconResponse(response, 'ffffffffffffffff'), /nonce/);
});

test('Sentinel 0.2 authenticates bounded telemetry and rejects spoofing, replay and oversized packets', () => {
  const key = Buffer.alloc(32, 7);
  const nonce = '0123456789abcdef0123456789abcdef';
  const timestamp = 2_000_000_000;
  const payload = Buffer.from(JSON.stringify({
    version: '0.2.0', capabilities: ['identity', 'temperature', 'uptime', 'memory', 'volumes', 'errors', 'shell'],
    model: 'CFI-1216A', uptimeSeconds: 123, cpuTemperatureC: 60, socTemperatureC: 58,
    memory: { totalBytes: 1_000, availableBytes: 400 },
    volumes: [{ id: 'internal-data', kind: 'internal', mountpoint: '/data', filesystem: 'unknown', totalBytes: 5_000, freeBytes: 2_000, readOnly: false }],
    errors: [],
  })).toString('base64');
  const signature = hmacHex(key, `response|${nonce}|${timestamp}|${payload}`);
  const response = Buffer.from(JSON.stringify({ schema: 2, service: 'chimera-sentinel', nonce, timestamp, payload, hmac: signature }));
  const replay = new Set();
  const parsed = parseSentinelResponse(response, { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp, replayCache: replay });
  assert.equal(parsed.security.authenticated, true);
  assert.equal(parsed.memory.availableBytes, 400);
  assert.equal(parsed.volumes[0].kind, 'internal');
  assert.equal(parsed.capabilities.includes('shell'), false);
  assert.throws(() => parseSentinelResponse(response, { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp, replayCache: replay }), /replay/i);
  assert.throws(() => parseSentinelResponse(response, { expectedNonce: nonce, pairingKey: Buffer.alloc(32, 8), nowSeconds: timestamp }), /HMAC/i);
  assert.throws(() => parseSentinelResponse(Buffer.alloc(MAX_PACKET_BYTES + 1), { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp }), /grootte/i);
});

test('Sentinel requests and pair acknowledgements use the documented HMAC transcript', () => {
  const key = Buffer.alloc(32, 9);
  const nonce = 'abcdefabcdefabcdefabcdefabcdefab';
  const timestamp = 2_000_000_001;
  const request = buildSentinelRequest(nonce, timestamp, key).toString('ascii');
  assert.equal(request, `${SENTINEL_REQUEST_PREFIX}${nonce} ${timestamp} ${hmacHex(key, `discover|${nonce}|${timestamp}`)}`);
  const hmac = hmacHex(key, `paired|${nonce}|${timestamp}`);
  const result = parsePairResponse(Buffer.from(JSON.stringify({ schema: 2, service: 'chimera-sentinel', paired: true, nonce, timestamp, hmac })), { expectedNonce: nonce, pairingKey: key, nowSeconds: timestamp });
  assert.equal(result.authenticated, true);
});

test('a configured Sentinel key blocks silent downgrade when secure telemetry times out', async () => {
  const client = createChimeraBeaconClient({
    settings: { get: key => key === 'ftp.host' ? '127.0.0.1' : '' }, timeoutMs: 25,
    pairingKeyProvider: () => '11'.repeat(32),
  });
  const result = await client.probe();
  assert.equal(result.online, false);
  assert.equal(result.downgradeBlocked, true);
});

test('Beacon source and Docker build keep deployment and dangerous capabilities out', () => {
  const root = path.resolve(__dirname, '../..');
  const source = fs.readFileSync(path.join(root, 'payloads', 'chimera-beacon', 'main.c'), 'utf8');
  const dockerfile = fs.readFileSync(path.join(root, 'Dockerfile'), 'utf8');
  assert.match(source, /CHIMERA_DISCOVER\/1/);
  assert.match(source, /CHIMERA_DISCOVER\/2/);
  assert.match(source, /PAIR_WINDOW_SECONDS 120/);
  assert.match(source, /chimera_hmac_sha256/);
  assert.match(source, /SOCK_DGRAM/);
  assert.doesNotMatch(source, /sceKernelGetHwSerialNumber|system\s*\(|execv|fopen|open\s*\(/);
  assert.match(dockerfile, /sdk\/releases\/download\/v0\.41/);
  assert.match(dockerfile, /ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984/);
  assert.match(dockerfile, /chimera-beacon\.elf/);
});