import assert from "node:assert/strict";
import { test } from "node:test";

import {
  validateAuthResult,
  validateDeliverySummary,
  validateDomainCheck,
  validateRedaction,
} from "../../scripts/lib/resend-release-gate.mjs";

const realEvidence = {
  source: "human_controlled_real",
  service: "resend",
  status: "verified",
  schema_version: "1.0",
};

test("requires SPF, DKIM, exact free limits, and no paid fallback", () => {
  assert.deepEqual(validateDomainCheck({
    ...realEvidence,
    dkim: { status: "pass" },
    domain_controlled: true,
    free_rules: { daily_limit: 80, monthly_limit: 2400, paid_fallback_enabled: false, status: "verified" },
    spf: { status: "pass" },
  }), []);
  assert.ok(validateDomainCheck({ ...realEvidence, domain_controlled: true, spf: { status: "pass" }, dkim: { status: "fail" }, free_rules: { status: "unknown" } }).includes("dkim"));
});

test("requires exactly three 20-message delivery cohorts with 19 within 120 seconds", () => {
  const summary = {
    ...realEvidence,
    categories: ["qq", "163", "enterprise"].map((category) => ({
      category,
      delivered_within_120_seconds: 19,
      max_latency_seconds: 120,
      mock_used: false,
      preseeded_account_used: false,
      sent_count: 20,
    })),
  };
  assert.deepEqual(validateDeliverySummary(summary), []);
  assert.ok(validateDeliverySummary({ ...summary, categories: summary.categories.map((item) => item.category === "163" ? { ...item, delivered_within_120_seconds: 18 } : item) }).some((error) => error.includes("163")));
  assert.ok(validateDeliverySummary({ ...summary, categories: summary.categories.map((item) => item.category === "enterprise" ? { ...item, max_latency_seconds: undefined } : item) }).some((error) => error.includes("enterprise")));
});

test("requires formal ordinary and admin authentication chains", () => {
  assert.deepEqual(validateAuthResult({
    ...realEvidence,
    admin: { chain: "formal", status: "passed", verification_code_source: "real_delivery" },
    mock_used: false,
    ordinary: { chain: "formal", status: "passed", verification_code_source: "real_delivery" },
    preseeded_account_used: false,
  }), []);
  assert.ok(validateAuthResult({ ...realEvidence, admin: { chain: "mock", status: "passed", verification_code_source: "fixture" }, ordinary: { status: "failed" } }).length > 0);
});

test("rejects credentials, mailboxes, private values, and paths from evidence", () => {
  assert.deepEqual(validateRedaction({
    absolute_paths_in_evidence: false,
    credentials_in_evidence: false,
    forbidden_matches: 0,
    mailboxes_in_evidence: false,
    private_content_in_evidence: false,
    schema_version: "1.0",
    status: "passed",
  }, JSON.stringify({ category: "qq", delivered_within_120_seconds: 20 })), []);
  assert.ok(validateRedaction({
    absolute_paths_in_evidence: false,
    credentials_in_evidence: false,
    forbidden_matches: 0,
    mailboxes_in_evidence: false,
    private_content_in_evidence: false,
    schema_version: "1.0",
    status: "passed",
  }, JSON.stringify({ mailbox: "recipient@example.invalid" })).includes("email_value"));
});