import test from 'node:test'
import assert from 'node:assert/strict'
import { normalizeFingerprint, assertRemoteIdentity, parsePhoneIdentity } from '../src/peer-identity.mjs'
import { openPhoneConnection } from '../src/transport.mjs'

const trusted = Array(32).fill('AB').join(':')
const other = Array(32).fill('CD').join(':')
const line = pin => `a=fingerprint:sha-256 ${pin}`

test('phone identity document binds the complete fingerprint to this pairing and device', () => {
  const value = { kind: 'aiturk-phone-identity', version: 1, pairingId: 'pair',
    deviceId: '33333333-3333-4333-8333-333333333333', fingerprint: trusted }
  assert.deepEqual(parsePhoneIdentity(JSON.stringify(value), 'pair'), { deviceId: value.deviceId, fingerprint: trusted })
  for (const bad of [{ ...value, pairingId: 'other' }, { ...value, fingerprint: 'AB' },
    { ...value, deviceId: '__proto__' }, { ...value, version: 2 }])
    assert.throws(() => parsePhoneIdentity(JSON.stringify(bad), 'pair'))
})

test('phone refuses absent or malformed saved trust before signaling or opening WebRTC', async () => {
  let calls = 0
  for (const desktopFingerprints of [undefined, {}, { desktop: 'invalid' }, Object.create({ desktop: trusted })]) {
    const account = { credentials: { desktopFingerprints }, call() { calls++; throw new Error('must not contact gateway') } }
    await assert.rejects(openPhoneConnection(account, 'desktop', () => {}), /kimliği/)
  }
  assert.equal(calls, 0)
})

test('a peer identity is a complete SHA-256 fingerprint, not a name or partial digest', () => {
  assert.equal(normalizeFingerprint(trusted.toLowerCase()), trusted)
  for (const bad of [null, '', 'desktop', 'AB', trusted + ':AB', ' ' + trusted, trusted.replace('AB', 'ZZ')])
    assert.throws(() => normalizeFingerprint(bad))
})

test('every advertised DTLS fingerprint must match the independently trusted peer', () => {
  assert.doesNotThrow(() => assertRemoteIdentity(`v=0\r\n${line(trusted)}\r\nm=application 9 UDP/DTLS/SCTP webrtc-datachannel\r\n${line(trusted.toLowerCase())}\r\n`, trusted))
  for (const bad of ['', 'v=0', line(other), `${line(trusted)}\n${line(other)}`,
    line(trusted).replace('sha-256', 'sha-1'), line(trusted) + ' extra', 'x'.repeat(131073)])
    assert.throws(() => assertRemoteIdentity(bad, trusted))
  assert.throws(() => assertRemoteIdentity(line(trusted), undefined))
})