import assert from "node:assert/strict";
import { test } from "node:test";
import { parseStagingImageManifest } from "../scripts/staging-image-manifest.mjs";

const gitSha = "0123456789abcdef0123456789abcdef01234567";
const apiDigest = `sha256:${"a".repeat(64)}`;
const webDigest = `sha256:${"b".repeat(64)}`;
const controllerSha256 = "c".repeat(64);

function legacyManifest(): string {
  return [
    `git_sha=${gitSha}`,
    `api_digest=${apiDigest}`,
    `web_digest=${webDigest}`,
    "",
  ].join("\n");
}

function validManifest(): string {
  return legacyManifest().replace(
    `web_digest=${webDigest}\n`,
    `web_digest=${webDigest}\ncontroller_sha256=${controllerSha256}\n`,
  );
}

test("legacy image-only manifest remains valid for the GitHub artifact contract", () => {
  assert.deepEqual(parseStagingImageManifest(legacyManifest(), gitSha), {
    gitSha,
    apiDigest,
    webDigest,
    apiImage: `ghcr.io/jesse-ux/jyotisha-api@${apiDigest}`,
    webImage: `ghcr.io/jesse-ux/jyotisha-web@${webDigest}`,
  });
});

test("manifest produces immutable GHCR digest references", () => {
  assert.deepEqual(parseStagingImageManifest(validManifest(), gitSha), {
    gitSha,
    apiDigest,
    webDigest,
    controllerSha256,
    apiImage: `ghcr.io/jesse-ux/jyotisha-api@${apiDigest}`,
    webImage: `ghcr.io/jesse-ux/jyotisha-web@${webDigest}`,
  });
});

test("manifest produces immutable shared ACR repository references", () => {
  const repository =
    "crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com/copse/jyotisha";
  assert.deepEqual(parseStagingImageManifest(validManifest(), gitSha, repository), {
    gitSha,
    apiDigest,
    webDigest,
    controllerSha256,
    apiImage: `${repository}@${apiDigest}`,
    webImage: `${repository}@${webDigest}`,
  });
});

test("manifest rejects revision drift, mutable tags, duplicates, extras, and malformed digests", () => {
  const invalid = [
    validManifest().replace(gitSha, "f".repeat(40)),
    validManifest().replace(apiDigest, `${gitSha}`),
    validManifest().replace(apiDigest, `sha256:${"A".repeat(64)}`),
    validManifest().replace(controllerSha256, "C".repeat(64)),
    validManifest().replace(controllerSha256, "c".repeat(63)),
    validManifest().replace(
      `web_digest=${webDigest}`,
      `api_digest=${apiDigest}`,
    ),
    `${validManifest()}extra=value\n`,
    validManifest().replace("api_digest=", "api_image=ghcr.io/example:"),
  ];

  for (const contents of invalid) {
    assert.throws(() => parseStagingImageManifest(contents, gitSha));
  }
  for (const registry of [
    "https://git.copse.top/root",
    "git.copse.top/root;touch /tmp/pwned",
    "git.copse.top/Root",
    "git.copse.top/root@evil.example",
    "git.copse.top/root/../evil",
    "",
  ]) {
    assert.throws(() => parseStagingImageManifest(validManifest(), gitSha, registry));
  }
});