package main

// 🤖 Live-wire test for the CLI vault path (docs/locked-vaults.md): two
// members against the real router, one emitting vault events through
// Client.SendEvent, the other folding them back through Client.Events —
// including a >1-page history, so the full-log pager is exercised where a
// silent truncation would fold a vault with no keyring.

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"testing"

	"lchat/internal/e2ee"
	"lchat/internal/vault"
)

func TestElevenVaultEventsRoundTrip(t *testing.T) {
	ts, srv := newTestServer(t)
	// The message brake (burst 30, ~30/min) would turn a 200+-message history
	// into a seven-minute test; the brake has its own tests, this one is about
	// the pager.
	srv.brakes.messages = newModLimiter(100000, 100000)
	term := joinForTest(t, ts.URL, "Terminal")
	friend := joinForTest(t, ts.URL, "Friend")
	termUID, err := term.Me()
	if err != nil {
		t.Fatalf("Me: %v", err)
	}
	friendUID, err := friend.Me()
	if err != nil {
		t.Fatalf("Me: %v", err)
	}

	// A shared group, the operator-vault shape: thread key wrapped to both.
	tk, err := e2ee.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	tkB64 := e2ee.B64uEncode(tk)
	wrapTo := func(pub string) string {
		w, err := e2ee.WrapThreadKey(tkB64, pub)
		if err != nil {
			t.Fatal(err)
		}
		return w
	}
	nameBlob, err := e2ee.EncryptJSON(tk, map[string]string{"name": "ops"})
	if err != nil {
		t.Fatal(err)
	}
	body, _ := json.Marshal(map[string]any{
		"token": friend.Session.Token, "kind": "group", "name_blob": nameBlob,
		"members": []map[string]string{
			{"user_id": friendUID, "wrapped": wrapTo(friend.Session.UserPub)},
			{"user_id": termUID, "wrapped": wrapTo(term.Session.UserPub)},
		},
	})
	resp, err := http.Post(ts.URL+"/api/threads", "application/json", bytes.NewReader(body))
	if err != nil {
		t.Fatal(err)
	}
	var created struct {
		ThreadID string `json:"thread_id"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&created); err != nil || created.ThreadID == "" {
		t.Fatalf("create thread: %v (id %q)", err, created.ThreadID)
	}
	resp.Body.Close()
	tid := created.ThreadID

	// Terminal writes a vault life: one plain add, the lock re-sealing it, and
	// enough sealed adds to push the history past one /api/messages page (200)
	// — the pager must fold the FIRST page's lock event or everything below is
	// wrong. Blobs are opaque strings to the fold; the wire crypto (thread-key
	// AES-GCM) is the real thing via SendEvent.
	if err := term.SendEvent(tid, map[string]any{"type": "vault.add", "id": "s0", "aid": "a0", "label": "WiFi", "value": "hunter2"}); err != nil {
		t.Fatalf("SendEvent add: %v", err)
	}
	if err := term.SendEvent(tid, map[string]any{
		"type": "vault.lock", "aid": "a-lock", "pub": "vault-pub",
		"wrap":   map[string]any{"id": "w1", "kind": "keychain", "label": "Terminal — CLI", "wrapped": "wrap-blob"},
		"sealed": map[string]any{"s0": "sealed-s0"},
	}); err != nil {
		t.Fatalf("SendEvent lock: %v", err)
	}
	// A plain chat line in between must never fold into the vault.
	if err := term.Send(tid, "deploying now"); err != nil {
		t.Fatalf("Send: %v", err)
	}
	const extra = 205
	for i := 1; i <= extra; i++ {
		ev := map[string]any{
			"type": "vault.add", "id": fmt.Sprintf("s%03d", i), "aid": fmt.Sprintf("a%03d", i),
			"label": fmt.Sprintf("KEY_%03d", i), "sealed": fmt.Sprintf("sealed-%03d", i),
		}
		if err := term.SendEvent(tid, ev); err != nil {
			t.Fatalf("SendEvent %d: %v", i, err)
		}
	}

	// Friend folds the whole thing back — 200-per-page means at least two pages.
	events, err := friend.Events(tid, "vault.")
	if err != nil {
		t.Fatalf("Events: %v", err)
	}
	if len(events) != extra+2 {
		t.Fatalf("folded %d vault events, want %d (partial page walk?)", len(events), extra+2)
	}
	s := vault.FoldAll(events)
	if s.Keyring == nil || s.Keyring.Pub != "vault-pub" || len(s.Keyring.Wraps) != 1 {
		t.Fatalf("keyring didn't survive the page walk: %+v", s.Keyring)
	}
	if len(s.Items) != extra+1 {
		t.Fatalf("items %d, want %d", len(s.Items), extra+1)
	}
	if it := s.FindItem("WiFi"); it == nil || it.Sealed != "sealed-s0" || it.Value != "" {
		t.Fatalf("the lock's re-seal was lost across pages: %+v", it)
	}
	if it := s.FindItem("KEY_205"); it == nil || it.Sealed != "sealed-205" {
		t.Fatalf("last item wrong: %+v", it)
	}
	// The transport injected attribution: the emitter's uid and name, not the
	// event author's claims.
	if it := s.FindItem("KEY_001"); it == nil || it.By != termUID || it.ByName != "Terminal" {
		t.Fatalf("attribution not injected: %+v", it)
	}
}