import { createHash } from 'node:crypto'

import { describe, expect, it } from 'vitest'

import {
  PINNED,
  SUBDIRS,
  resolveDownloadUrl,
  resolveVersion,
  verifyArchiveDigest,
  verifyBinaryDigest
} from './fetch-micromamba.mjs'

describe('micromamba pinning', () => {
  it('pins a concrete version, never `latest`', () => {
    expect(PINNED.version).toMatch(/^\d+\.\d+\.\d+$/)
    expect(PINNED.version).not.toBe('latest')
  })

  it('has a valid sha256 for every supported subdir', () => {
    for (const subdir of SUBDIRS) {
      expect(PINNED.sha256[subdir], `missing digest for ${subdir}`).toMatch(/^[0-9a-f]{64}$/)
    }
  })

  it('downloads the pinned archive from the matching official GitHub release', () => {
    expect(resolveDownloadUrl('osx-arm64')).toBe(
      'https://github.com/mamba-org/micromamba-releases/releases/download/2.8.1-1/micromamba-osx-arm64.tar.bz2'
    )
  })

  it('pins a separately built Windows compatibility runner and both of its digests', () => {
    expect(PINNED.compatibility).toMatchObject({
      version: '1.5.12',
      releaseTag: '1.5.12-0'
    })
    expect(PINNED.compatibility.sha256['win-64']).toMatch(/^[0-9a-f]{64}$/)
    expect(PINNED.compatibility.binarySha256['win-64']).toMatch(/^[0-9a-f]{64}$/)
    expect(resolveDownloadUrl('win-64', 'compatibility')).toBe(
      'https://github.com/mamba-org/micromamba-releases/releases/download/1.5.12-0/micromamba-win-64.tar.bz2'
    )
    expect(() => resolveDownloadUrl('linux-64', 'compatibility')).toThrow(/no pinned sha256/)
  })
})

describe('verifyArchiveDigest', () => {
  it('accepts a buffer whose sha256 matches the pinned digest', () => {
    const buf = Buffer.from('micromamba archive bytes')
    // Register a temporary subdir pinned to this buffer's real hash, then verify it passes.
    const fake = '__test-match__'
    PINNED.sha256[fake] = createHash('sha256').update(buf).digest('hex')
    try {
      expect(() => verifyArchiveDigest(buf, fake)).not.toThrow()
    } finally {
      delete PINNED.sha256[fake]
    }
  })

  it('throws on a digest mismatch before any copy', () => {
    expect(() => verifyArchiveDigest(Buffer.from('tampered'), 'linux-64')).toThrow(
      /sha256 mismatch/
    )
  })

  it('throws when a subdir has no pinned digest', () => {
    expect(() => verifyArchiveDigest(Buffer.from('x'), 'nonexistent-subdir')).toThrow(
      /no pinned sha256/
    )
  })
})

describe('resolveVersion', () => {
  it('uses the pinned version when MICROMAMBA_VERSION is unset', () => {
    expect(resolveVersion({})).toBe(PINNED.version)
  })

  it('allows an override equal to the pinned version', () => {
    expect(resolveVersion({ MICROMAMBA_VERSION: PINNED.version })).toBe(PINNED.version)
  })

  it('fails fast on an override that differs from the pinned version', () => {
    // The digests only cover PINNED.version, so a different version can never verify — reject it
    // BEFORE any fetch, with actionable guidance instead of a confusing sha256 mismatch.
    expect(() => resolveVersion({ MICROMAMBA_VERSION: '9.9.9' })).toThrow(
      /does not match the pinned .* update scripts\/micromamba-versions\.json/s
    )
  })
})

describe('verifyBinaryDigest', () => {
  it('accepts extracted bytes matching the selected pin', () => {
    const buf = Buffer.from('compatibility executable bytes')
    const fake = '__test-binary-match__'
    PINNED.compatibility.binarySha256[fake] = createHash('sha256').update(buf).digest('hex')
    try {
      expect(() => verifyBinaryDigest(buf, fake, 'compatibility')).not.toThrow()
    } finally {
      delete PINNED.compatibility.binarySha256[fake]
    }
  })

  it('rejects an extracted compatibility executable whose digest differs', () => {
    expect(() => verifyBinaryDigest(Buffer.from('tampered'), 'win-64', 'compatibility')).toThrow(
      /binary sha256 mismatch/
    )
  })
})