import assert from 'node:assert/strict';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { spawnSync } from 'node:child_process';
import test from 'node:test';

const release = JSON.parse(fs.readFileSync('release/macos/release.json', 'utf8'));
const appPlist = fs.readFileSync('release/macos/plists/App-Info.plist', 'utf8');
const agentPlist = fs.readFileSync('release/macos/plists/LaunchAgent.plist', 'utf8');
const distribution = fs.readFileSync('release/macos/Distribution.xml', 'utf8');
const preinstall = fs.readFileSync('release/macos/pkg-scripts/preinstall', 'utf8');

test('release identity, platform, and installer metadata agree', () => {
  assert.equal(release.version, '0.1.0');
  assert.equal(release.build, 100);
  assert.deepEqual(release.architectures, ['arm64']);
  assert.equal(release.minimumMacOS, '14.0');
  assert.equal(release.hosted.origin, 'https://mcp.knowtation.store');
  assert.equal(release.hosted.nativeOAuthIssuer, `${release.hosted.origin}/api/v1/auth/native`);
  assert.deepEqual(release.hosted.scopes, ['vault:read', 'vault:write']);
  assert.deepEqual(
    release.optionalExternalTools.map((entry) => entry.command),
    ['git', 'muse'],
  );
  assert.ok(release.optionalExternalTools.every((entry) => entry.bundled === false));
  assert.match(appPlist, /store\.knowtation\.companion/);
  assert.match(appPlist, /<string>0\.1\.0<\/string>/);
  assert.match(appPlist, /<string>100<\/string>/);
  assert.match(agentPlist, /store\.knowtation\.companion\.custody/);
  assert.match(agentPlist, /<key>MachServices<\/key>/);
  assert.match(agentPlist, /<key>BundleProgram<\/key>/);
  assert.match(distribution, /min="14\.0"/);
  assert.match(distribution, /store\.knowtation\.pkg/);
  assert.match(distribution, /require-scripts="true"/);
  assert.match(preinstall, /installed_build > 100/);
  assert.match(preinstall, /rollback is rejected/);
});

test('release entitlements do not disable library validation or permit debugging', () => {
  for (const file of [
    'release/macos/entitlements/app.plist',
    'release/macos/entitlements/custody.plist',
    'release/macos/entitlements/launcher.plist',
    'release/macos/entitlements/runtime.plist',
  ]) {
    const text = fs.readFileSync(file, 'utf8');
    assert.doesNotMatch(text, /get-task-allow/);
    assert.doesNotMatch(text, /disable-library-validation/);
  }
});

const custodyIdentifier = 'C72VAF2EM2.store.knowtation.companion.custody';
for (const [name, applicationIdentifier, keychainGroup, accepted] of [
  ['correct application identifier and Keychain group', custodyIdentifier, custodyIdentifier, true],
  ['missing application identifier', null, custodyIdentifier, false],
  ['incorrect application identifier', 'wrong.custody', custodyIdentifier, false],
  ['missing Keychain group', custodyIdentifier, null, false],
  ['incorrect Keychain group', custodyIdentifier, 'wrong.custody', false],
]) {
  test(`release custody entitlement checks: ${name}`, { skip: process.platform !== 'darwin' }, () => {
    // Run the verifier's actual shell checks against the real macOS plutil.
    const verifier = fs.readFileSync('scripts/release/macos/verify.sh', 'utf8');
    const checks = verifier.match(/^test "\$\(plutil -extract [\s\S]*?(?=^pkgutil --check-signature)/m)?.[0];
    assert.ok(checks, 'custody entitlement checks must be present');
    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'knowtation-entitlements-'));
    try {
      const appEntry = applicationIdentifier === null ? '' :
        `<key>com.apple.application-identifier</key><string>${applicationIdentifier}</string>`;
      const groupEntry = keychainGroup === null ? '' :
        `<key>keychain-access-groups</key><array><string>${keychainGroup}</string></array>`;
      fs.writeFileSync(path.join(root, 'custody-entitlements.plist'),
        `<?xml version="1.0"?><plist version="1.0"><dict>${appEntry}${groupEntry}</dict></plist>`);
      const result = spawnSync('/bin/bash', ['-euo', 'pipefail', '-c', checks], {
        encoding: 'utf8',
        env: { ...process.env, verification_tmp: root, KNOWTATION_APPLE_TEAM_ID: 'C72VAF2EM2' },
      });
      assert.ifError(result.error);
      assert.equal(result.signal, null);
      assert.equal(result.status, accepted ? 0 : 1, result.stdout + result.stderr);
    } finally {
      fs.rmSync(root, { recursive: true, force: true });
    }
  });
}