// Tests for the home server's browser crypto module, run in Node (Node 22 has
// Web Crypto). Same harness style as test/crypto.test.mjs.
//   node home/test/crypto.test.mjs
import assert from "node:assert/strict";
import {
  b64urlToBytes,
  bytesToB64url,
  kekFromPRF,
  generateDEK,
  exportDEK,
  importDEK,
  wrapDEK,
  unwrapDEK,
  pad,
  unpad,
  BLOB_PAD,
  sealBlob,
  unpackBlob,
  openBlob,
} from "../web/static/crypto.js";

let failures = 0;
async function test(name, fn) {
  try {
    await fn();
    console.log("PASS  " + name);
  } catch (e) {
    console.log("FAIL  " + name + "  —  " + (e && e.message));
    failures++;
  }
}

// A stand-in for the PRF extension output (32 random bytes from the
// authenticator; only ever seen client-side).
const fakePRF = () => crypto.getRandomValues(new Uint8Array(32));

await test("pad produces a fixed-size buffer and unpad round-trips", async () => {
  const msg = new TextEncoder().encode("héllo 🌍");
  const padded = pad(msg);
  assert.equal(padded.length, BLOB_PAD, "padded size must always be BLOB_PAD");
  assert.deepEqual(unpad(padded), msg);
});

await test("pad: empty and boundary (BLOB_PAD-4) payloads round-trip", async () => {
  for (const n of [0, 1, BLOB_PAD - 4]) {
    const msg = crypto.getRandomValues(new Uint8Array(n));
    const padded = pad(msg);
    assert.equal(padded.length, BLOB_PAD);
    assert.deepEqual(unpad(padded), msg);
  }
});

await test("pad rejects payloads over the fixed size", async () => {
  assert.throws(() => pad(new Uint8Array(BLOB_PAD - 3)), /too large/);
  assert.throws(() => pad(new Uint8Array(BLOB_PAD + 1)), /too large/);
});

await test("padded size is identical regardless of contents (length leaks nothing)", async () => {
  const short = pad(new TextEncoder().encode("{}"));
  const long = pad(crypto.getRandomValues(new Uint8Array(8000)));
  assert.equal(short.length, long.length);
});

await test("sealBlob → openBlob round-trips via a PRF-derived KEK", async () => {
  const prf = fakePRF();
  const kek = await kekFromPRF(prf);
  const dek = await generateDEK();
  const obj = { v: 1, servers: [{ url: "https://family.example.com", name: "Family" }] };
  const sealed = await sealBlob(obj, dek, { "cred-1": await wrapDEK(dek, kek) });

  const { keys } = unpackBlob(sealed);
  const dek2 = await unwrapDEK(keys["cred-1"], await kekFromPRF(prf));
  const { obj: out } = await openBlob(sealed, dek2);
  assert.deepEqual(out, obj);
});

await test("unwrapDEK with a KEK from the wrong PRF output fails", async () => {
  const kek = await kekFromPRF(fakePRF());
  const dek = await generateDEK();
  const wrapped = await wrapDEK(dek, kek);
  const wrongKek = await kekFromPRF(fakePRF());
  await assert.rejects(() => unwrapDEK(wrapped, wrongKek));
});

await test("envelope wraps the DEK per credential: each of 2 KEKs can open", async () => {
  const prfA = fakePRF();
  const prfB = fakePRF();
  const dek = await generateDEK();
  const obj = { v: 1, servers: [{ url: "https://test.example.com" }] };
  const sealed = await sealBlob(obj, dek, {
    "cred-a": await wrapDEK(dek, await kekFromPRF(prfA)),
    "cred-b": await wrapDEK(dek, await kekFromPRF(prfB)),
  });

  const { keys } = unpackBlob(sealed);
  for (const [credId, prf] of [["cred-a", prfA], ["cred-b", prfB]]) {
    const unwrapped = await unwrapDEK(keys[credId], await kekFromPRF(prf));
    const { obj: out } = await openBlob(sealed, unwrapped);
    assert.deepEqual(out, obj, credId + " must open the blob");
  }
  // ...and neither KEK unwraps the OTHER credential's blob copy directly.
  const kekB = await kekFromPRF(prfB);
  await assert.rejects(() => unwrapDEK(keys["cred-a"], kekB));
});

await test("ciphertext hides the plaintext and the DEK survives export/import", async () => {
  const dek = await generateDEK();
  const obj = { v: 1, servers: [{ url: "https://secret-instance.example" }] };
  const sealed = await sealBlob(obj, dek, {});
  assert.ok(!new TextDecoder("utf-8", { fatal: false }).decode(sealed).includes("secret-instance"));

  const dek2 = await importDEK(await exportDEK(dek)); // the silent-sync cache path
  const { obj: out } = await openBlob(sealed, dek2);
  assert.deepEqual(out, obj);
});

await test("unpackBlob rejects non-envelope bytes", async () => {
  assert.throws(() => unpackBlob(new TextEncoder().encode("NOPE-not-an-envelope")), /not a home blob/);
});

await test("b64url is URL-safe and round-trips", async () => {
  const bytes = crypto.getRandomValues(new Uint8Array(64));
  const s = bytesToB64url(bytes);
  assert.ok(!/[+/=]/.test(s));
  assert.deepEqual(b64urlToBytes(s), bytes);
});

console.log(failures === 0 ? "\nALL PASSED" : `\n${failures} FAILED`);
process.exit(failures === 0 ? 0 : 1);