import { createHash } from 'node:crypto';
import { describe, expect, it } from 'vitest';
import { authenticateReferenceRun, validateObservedReferenceEnvironment } from './reference-run';

const attestation = (runIndex = 1) => ({
  schema: 'portfolio-reference-run-attestation/v1',
  profile: 'desktop-high',
  runId: `desktop-reference-${runIndex}`,
  capturedAt: '2026-09-02T05:00:00.000Z',
  runIndex,
  device: { model: 'Apple M1 MacBook Air', cpu: 'Apple M1', gpu: 'Apple M1 integrated GPU', ramGb: 8 },
  browser: { name: 'Chromium', version: '140.0.0', driverVersion: 'Playwright 1.62.1' },
  osVersion: 'macOS 15.6',
  display: { refreshHz: 60 },
  viewport: { width: 1_440, height: 900 },
  network: { downstreamKbps: 10_000, upstreamKbps: 10_000, roundTripLatencyMs: 40 },
  assertions: {
    batteryPercent: 80,
    powerSaving: false,
    coolStart: true,
    noOtherForegroundApplications: true,
    cpuEmulation: false,
    pageZoom: 1,
    reducedMotion: 'no-preference',
    saveData: false,
    audioState: 'idle',
    freshBrowserProfile: true,
    startedFromAboutBlank: true,
    storageCleared: { serviceWorkers: true, cacheStorage: true, httpCache: true, cookies: true, localStorage: true, sessionStorage: true, indexedDb: true, preferences: true },
    physicalReferenceDevice: true,
  },
});

describe('authenticated reference runs', () => {
  it('cannot mark an ordinary developer trace as gating evidence', () => {
    const bytes = Buffer.from(JSON.stringify(attestation()));
    expect(() => authenticateReferenceRun({
      referenceMode: false,
      expectedProfile: 'desktop-high',
      attestationBytes: bytes,
      expectedDigest: createHash('sha256').update(bytes).digest('hex'),
    })).toThrow(/reference mode/u);
  });

  it('fails closed on digest, device, network, or assertion mismatch', () => {
    const invalid = attestation();
    invalid.network.downstreamKbps = 9_999;
    const bytes = Buffer.from(JSON.stringify(invalid));
    expect(() => authenticateReferenceRun({
      referenceMode: true,
      expectedProfile: 'desktop-high',
      attestationBytes: bytes,
      expectedDigest: createHash('sha256').update(bytes).digest('hex'),
    })).toThrow(/network/u);
    expect(() => authenticateReferenceRun({
      referenceMode: true,
      expectedProfile: 'desktop-high',
      attestationBytes: bytes,
      expectedDigest: '0'.repeat(64),
    })).toThrow(/digest/u);
  });

  it('authenticates only exact pinned metadata and validates browser-observed assertions', () => {
    const bytes = Buffer.from(JSON.stringify(attestation()));
    const authenticated = authenticateReferenceRun({
      referenceMode: true,
      expectedProfile: 'desktop-high',
      attestationBytes: bytes,
      expectedDigest: createHash('sha256').update(bytes).digest('hex'),
    });
    expect(authenticated).toMatchObject({ runId: 'desktop-reference-1', runIndex: 1, profile: 'desktop-high' });
    expect(() => validateObservedReferenceEnvironment(authenticated, {
      viewport: { width: 1_440, height: 900 },
      visible: true,
      reducedMotion: 'no-preference',
      saveData: false,
      pageZoom: 1,
      devicePixelRatio: 2,
      browserName: 'Chromium',
      browserVersion: '140.0.0',
      startedFromAboutBlank: true,
    })).not.toThrow();
    expect(() => validateObservedReferenceEnvironment(authenticated, {
      viewport: { width: 1_440, height: 899 },
      visible: true,
      reducedMotion: 'no-preference',
      saveData: false,
      pageZoom: 1,
      devicePixelRatio: 2,
      browserName: 'Chromium',
      browserVersion: '140.0.0',
      startedFromAboutBlank: true,
    })).toThrow(/viewport/u);
    expect(() => validateObservedReferenceEnvironment(authenticated, {
      viewport: { width: 1_440, height: 900 },
      visible: true,
      reducedMotion: 'no-preference',
      saveData: false,
      pageZoom: 1,
      devicePixelRatio: 1,
      browserName: 'Chromium',
      browserVersion: '140.0.0',
      startedFromAboutBlank: true,
    })).toThrow(/pixel ratio/u);
  });
});