/**
 * DTP-05 step 5 — TEMPLATE_UNTRUSTED_ISSUER rejection.
 */

import { describe, expect, it } from "@suaveplan/testing/runner";
import {
    type DriveTemplateError,
    DTP_CODES,
    signTemplate,
    TemplateNonceLru,
    validateTemplate,
} from "../src/index.js";
import { buildTemplate, emptyRoot, makeKeys } from "./_helpers.js";

describe("DTP-05 step 5 — trusted issuer gate", () => {
    it("issuer not in trustedKeyAuthorities rejected", {
        timeout: 5000,
    }, () => {
        const keys = makeKeys();
        const tpl = signTemplate(
            {
                ...buildTemplate({ issuer: keys.publicHex }),
                policy: {
                    defaultPolicy: {
                        autoDownload: false,
                        meshAllowed: true,
                        cdnAllowed: true,
                    },
                    trustedKeyAuthorities: ["someone-else"],
                },
            },
            keys.secret
        );
        const ctx = {
            clock: () => Date.now(),
            nonceLru: new TemplateNonceLru(),
        };
        try {
            validateTemplate(tpl, ctx);
            throw new Error("expected UNTRUSTED_ISSUER");
        } catch (err) {
            expect((err as DriveTemplateError).code).toBe(
                DTP_CODES.TEMPLATE_UNTRUSTED_ISSUER
            );
        }
    });

    it("empty trustedKeyAuthorities permits any issuer (no allowlist)", {
        timeout: 5000,
    }, () => {
        const keys = makeKeys();
        const tpl = signTemplate(
            {
                ...buildTemplate({ issuer: keys.publicHex }),
                policy: {
                    defaultPolicy: {
                        autoDownload: false,
                        meshAllowed: true,
                        cdnAllowed: true,
                    },
                    trustedKeyAuthorities: [],
                },
            },
            keys.secret
        );
        const ctx = {
            clock: () => Date.now(),
            nonceLru: new TemplateNonceLru(),
        };
        expect(() => validateTemplate(tpl, ctx)).not.toThrow();
    });

    it("issuer in allowlist accepted", { timeout: 5000 }, () => {
        const keys = makeKeys();
        const tpl = signTemplate(
            {
                ...buildTemplate({
                    issuer: keys.publicHex,
                    rootFolder: emptyRoot(),
                }),
                policy: {
                    defaultPolicy: {
                        autoDownload: false,
                        meshAllowed: true,
                        cdnAllowed: true,
                    },
                    trustedKeyAuthorities: [keys.publicHex],
                },
            },
            keys.secret
        );
        const ctx = {
            clock: () => Date.now(),
            nonceLru: new TemplateNonceLru(),
        };
        expect(() => validateTemplate(tpl, ctx)).not.toThrow();
    });
});