/**
 * Branch-coverage filler for canonical.ts encryption / retention /
 * optional-field paths and other defence-in-depth code that the
 * spec-tied tests don't exercise.
 */

import { describe, expect, it } from "@suaveplan/testing/runner";
import { canonicalSerialize } from "../src/codec/canonical.js";
import type {
    DriveTemplate,
    FileTemplate,
    FolderTemplate,
} from "../src/index.js";
import { TemplateNonceLru, validateTemplate } from "../src/index.js";
import {
    DEFAULT_POLICY,
    emptyRoot,
    makeKeys,
    makeNonce,
    signed,
} from "./_helpers.js";

const baseFile: FileTemplate = {
    name: "x.bin",
    fileLocId: "loc-1",
    fileId: "f".repeat(64),
    size: 100,
    totalChunks: 1,
    chunkSize: 1024,
    checksum: "sha256:abcdef",
    flags: DEFAULT_POLICY,
    manifestKey: "manifest:f",
    manifestSig: new Uint8Array(64).fill(1),
};

describe("canonicalSerialize encryption branches", () => {
    it("file with kind:inline encryption serializes", { timeout: 5000 }, () => {
        const tpl: Omit<DriveTemplate, "serverSignature"> = {
            schemaVersion: 1,
            driveId: "d",
            policy: { defaultPolicy: DEFAULT_POLICY },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: makeNonce(),
            rootFolder: {
                name: "/",
                children: [
                    {
                        ...baseFile,
                        encryption: {
                            algorithm: "xchacha20-poly1305",
                            keyDistribution: {
                                kind: "inline",
                                wrappedKey: new Uint8Array(80).fill(0xab),
                            },
                        },
                    },
                ],
            },
        };
        expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
    });

    it("file with kind:retroactive encryption serializes", {
        timeout: 5000,
    }, () => {
        const tpl: Omit<DriveTemplate, "serverSignature"> = {
            schemaVersion: 1,
            driveId: "d",
            policy: { defaultPolicy: DEFAULT_POLICY },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: makeNonce(),
            rootFolder: {
                name: "/",
                children: [
                    {
                        ...baseFile,
                        encryption: {
                            algorithm: "xchacha20-poly1305",
                            keyDistribution: {
                                kind: "retroactive",
                                keyAuthority: "auth-1",
                            },
                        },
                    },
                ],
            },
        };
        expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
    });

    it("retention 'permanent' / 'lru' / { maxAgeMs } / undefined serialize", {
        timeout: 5000,
    }, () => {
        for (const retention of [
            undefined,
            "permanent" as const,
            "lru" as const,
            { maxAgeMs: 1000 },
        ]) {
            const tpl: Omit<DriveTemplate, "serverSignature"> = {
                schemaVersion: 1,
                driveId: "d",
                policy: {
                    defaultPolicy: { ...DEFAULT_POLICY, retention },
                },
                issuer: "00".repeat(32),
                issuedAt: 1,
                expiresAt: 1_000,
                nonce: makeNonce(),
                rootFolder: emptyRoot(),
            };
            expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
        }
    });

    it("GlobalPolicy with maxLocalCacheBytes / maxConcurrentFetches set", {
        timeout: 5000,
    }, () => {
        const tpl: Omit<DriveTemplate, "serverSignature"> = {
            schemaVersion: 1,
            driveId: "d",
            policy: {
                defaultPolicy: DEFAULT_POLICY,
                maxLocalCacheBytes: 1_000_000,
                maxConcurrentFetches: 4,
                trustedKeyAuthorities: ["a", "b"],
            },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: makeNonce(),
            rootFolder: emptyRoot(),
        };
        expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
    });

    it("CdnFallbackConfig with optional uploadEndpoint serialises", {
        timeout: 5000,
    }, () => {
        const tpl: Omit<DriveTemplate, "serverSignature"> = {
            schemaVersion: 1,
            driveId: "d",
            policy: { defaultPolicy: DEFAULT_POLICY },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: makeNonce(),
            rootFolder: emptyRoot(),
            cdnFallback: {
                baseUrl: "https://example.com",
                pathScheme: "reverse-id",
                levels: 3,
                padding: 9,
                uploadEndpoint: "https://upload.example.com",
            },
        };
        expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
    });

    it("CdnFallbackConfig WITHOUT uploadEndpoint covers optional false branch", {
        timeout: 5000,
    }, () => {
        const tpl: Omit<DriveTemplate, "serverSignature"> = {
            schemaVersion: 1,
            driveId: "d",
            policy: { defaultPolicy: DEFAULT_POLICY },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: makeNonce(),
            rootFolder: emptyRoot(),
            cdnFallback: {
                baseUrl: "https://example.com",
                pathScheme: "reverse-id",
                levels: 3,
                padding: 9,
            },
        };
        expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
    });

    it("nested folder serialises with TAG_FOLDER recursion", {
        timeout: 5000,
    }, () => {
        const inner: FolderTemplate = { name: "deep", children: [] };
        const outer: FolderTemplate = { name: "/", children: [inner] };
        const tpl: Omit<DriveTemplate, "serverSignature"> = {
            schemaVersion: 1,
            driveId: "d",
            policy: { defaultPolicy: DEFAULT_POLICY },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: makeNonce(),
            rootFolder: outer,
        };
        expect(canonicalSerialize(tpl).length).toBeGreaterThan(0);
    });
});

describe("schema invocation coverage", () => {
    it("DriveTemplateSchema rejects nonce of wrong length", {
        timeout: 5000,
    }, async () => {
        const { DriveTemplateSchema } = await import("../src/index.js");
        const r = DriveTemplateSchema.safeParse({
            schemaVersion: 1,
            driveId: "d",
            rootFolder: { name: "/", children: [] },
            policy: { defaultPolicy: DEFAULT_POLICY },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: new Uint8Array(8), // wrong length
            serverSignature: new Uint8Array(64),
        });
        expect(r.success).toBe(false);
    });

    it("DriveTemplateSchema accepts a well-formed payload", {
        timeout: 5000,
    }, async () => {
        const { DriveTemplateSchema } = await import("../src/index.js");
        const r = DriveTemplateSchema.safeParse({
            schemaVersion: 1,
            driveId: "d",
            rootFolder: { name: "/", children: [] },
            policy: { defaultPolicy: DEFAULT_POLICY },
            issuer: "00".repeat(32),
            issuedAt: 1,
            expiresAt: 1_000,
            nonce: makeNonce(),
            serverSignature: new Uint8Array(64),
        });
        expect(r.success).toBe(true);
    });

    it("FolderTemplateSchema parses recursive folder/file mix", {
        timeout: 5000,
    }, async () => {
        const { FolderTemplateSchema } = await import("../src/index.js");
        const r = FolderTemplateSchema.safeParse({
            name: "/",
            children: [
                {
                    name: "subfolder",
                    children: [],
                },
                {
                    name: "file.bin",
                    fileLocId: "loc",
                    fileId: "fid",
                    size: 1,
                    totalChunks: 1,
                    chunkSize: 1024,
                    checksum: "blake3:abcd",
                    flags: DEFAULT_POLICY,
                    manifestKey: "k",
                    manifestSig: new Uint8Array(64),
                },
            ],
        });
        expect(r.success).toBe(true);
    });
});

describe("depth check accepts a folder containing a file", () => {
    it("walk descends into folder, returns from file branch", {
        timeout: 5000,
    }, async () => {
        const { assertFolderDepth } = await import("../src/index.js");
        const tree: FolderTemplate = {
            name: "/",
            children: [baseFile],
        };
        expect(() => assertFolderDepth(tree)).not.toThrow();
    });
});

describe("validate.replay LRU empty-on-evict edge", () => {
    it("LRU eviction on size==capacity is a no-op pre-add", {
        timeout: 5000,
    }, () => {
        const keys = makeKeys();
        const ctx = {
            clock: () => Date.now(),
            nonceLru: new TemplateNonceLru(2),
        };
        const tpl1 = signed(
            { issuer: keys.publicHex, nonce: makeNonce(1) },
            keys
        );
        const tpl2 = signed(
            { issuer: keys.publicHex, nonce: makeNonce(2) },
            keys
        );
        validateTemplate(tpl1, ctx);
        validateTemplate(tpl2, ctx);
        expect(ctx.nonceLru.size).toBe(2);
    });
});