import { describe, expect, it } from "vitest";

import {
  diffDependencyInventories,
  isValidSha512Integrity,
  parsePnpmLockfilePackages,
  supplyChainDigest,
  validateDependencyReview,
  validateLicensePolicy,
} from "../../scripts/lib/supply-chain.ts";

const integrity = `sha512-${Buffer.alloc(64, 7).toString("base64")}`;
const dependency = {
  name: "fixture",
  version: "1.0.0",
  direct: true,
  scope: "production",
  optional: false,
  license: "MIT",
  integrity,
  dependencies: [],
};

describe("supply-chain policy", () => {
  it("parses every top-level lockfile package and validates SRI", () => {
    const parsed = parsePnpmLockfilePackages(`
packages:

  '@scope/one@1.0.0':
    resolution: {integrity: ${integrity}}

  two@2.0.0:
    resolution: {integrity: ${integrity}}

snapshots:
`);
    expect(parsed).toEqual([
      { name: "@scope/one", version: "1.0.0", integrity },
      { name: "two", version: "2.0.0", integrity },
    ]);
    expect(parsed.every((entry) => isValidSha512Integrity(entry.integrity))).toBe(
      true,
    );
  });

  it("keeps inventory digests stable when dependency ordering changes", () => {
    const other = { ...dependency, name: "other" };
    expect(supplyChainDigest([dependency, other])).toBe(
      supplyChainDigest([other, dependency]),
    );
  });

  it("calculates actual additions and requires independent high-risk review", () => {
    const before = { dependencies: [] };
    const after = { dependencies: [dependency] };
    const diff = diffDependencyInventories(before, after);
    expect(diff.added).toEqual(["fixture@1.0.0"]);
    expect(
      validateDependencyReview(diff, after, {
        changes: [
          {
            changeId: "add:fixture@1.0.0",
            owner: "one",
            reviewer: "one",
            reason: "fixture",
            rollback: "remove",
          },
        ],
      }).passed,
    ).toBe(false);
  });

  it("allows explicit policy licenses and rejects denied licenses", () => {
    expect(
      validateLicensePolicy(
        { dependencies: [dependency] },
        { allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
      ).passed,
    ).toBe(true);
    expect(
      validateLicensePolicy(
        {
          dependencies: [{ ...dependency, license: "AGPL-3.0" }],
        },
        { allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
      ).passed,
    ).toBe(false);
  });
});