// 🤖 Tests for the restore page's payload validation + CLI return URL — the
// pure half of the passkey handoff (home/web/static/restore-payload.js).
//   node home/test/restore-payload.test.mjs
import assert from "node:assert/strict";
import { validRestorePayload, validCLIPort, cliReturnURL, validReturnScheme } from "../web/static/restore-payload.js";

// ---- instance shape ---------------------------------------------------------

assert.deepEqual(
  validRestorePayload({ ret: "https://chat.example.com/", nonce: "n", ephPub: "P" }),
  { ret: "https://chat.example.com/", nonce: "n", ephPub: "P" },
  "instance payload passes",
);
assert.equal(validRestorePayload({ ret: "not a url", nonce: "n", ephPub: "P" }), null, "unparseable ret rejected");
assert.equal(validRestorePayload({ ret: "https://x.com", nonce: "n" }), null, "missing ephPub rejected");
assert.equal(validRestorePayload(null), null, "null rejected");

// ---- app shape --------------------------------------------------------------

assert.deepEqual(
  validRestorePayload({ app: 1, nonce: "n", ephPub: "P" }),
  { app: 1, nonce: "n", ephPub: "P" },
  "app payload passes",
);
// Only the expected fields survive — a smuggled ret must not ride along on an
// app/cli payload (their return targets are fixed / loopback-only).
assert.equal(validRestorePayload({ app: 1, nonce: "n", ephPub: "P", ret: "https://evil.example" }).ret,
  undefined, "app payload drops extra fields");

// ---- the app shape's return scheme (dev alts name themselves) ----------------

assert.deepEqual(
  validRestorePayload({ app: 1, nonce: "n", ephPub: "P", scheme: "elevenmessenger.alt-dek" }),
  { app: 1, nonce: "n", ephPub: "P", scheme: "elevenmessenger.alt-dek" },
  "an alt names its own suffixed scheme",
);
assert.equal(
  validRestorePayload({ app: 1, nonce: "n", ephPub: "P", scheme: "elevenmessenger" }).scheme,
  "elevenmessenger",
  "the plain scheme passes too",
);
for (const scheme of ["https", "evil", "elevenmessenger.alt-", "elevenmessenger.alt-UPPER",
  "elevenmessengerx", "elevenmessenger.alt-" + "x".repeat(33), 7, null, {}]) {
  assert.equal(
    validRestorePayload({ app: 1, nonce: "n", ephPub: "P", scheme }).scheme,
    undefined,
    `junk scheme ${JSON.stringify(scheme)} dropped (plain-app fallback)`,
  );
}
assert.equal(validReturnScheme("elevenmessenger.alt-dek2"), true, "digits in slugs pass");
assert.equal(
  validRestorePayload({ ret: "https://x.example", nonce: "n", ephPub: "P", scheme: "elevenmessenger.alt-dek" }).scheme,
  undefined,
  "only the app shape carries a scheme",
);

// ---- cli shape --------------------------------------------------------------

assert.deepEqual(
  validRestorePayload({ cli: 1, nonce: "n", ephPub: "P", port: 49152 }),
  { cli: 1, nonce: "n", ephPub: "P", port: 49152 },
  "cli payload with port passes",
);
assert.deepEqual(
  validRestorePayload({ cli: 1, nonce: "n", ephPub: "P" }),
  { cli: 1, nonce: "n", ephPub: "P", port: undefined },
  "cli payload without port (paste mode) passes",
);
for (const port of [0, 80, 1023, 65536, -1, 1.5, "8080", null]) {
  assert.equal(validRestorePayload({ cli: 1, nonce: "n", ephPub: "P", port }), null, `bad port ${port} rejected`);
}
assert.equal(validRestorePayload({ cli: 1, ephPub: "P", port: 49152 }), null, "cli missing nonce rejected");
assert.equal(validRestorePayload({ cli: 1, nonce: "n", ephPub: "P", port: 49152, ret: "https://evil.example" }).ret,
  undefined, "cli payload drops extra fields");

// ---- loopback URL -----------------------------------------------------------

assert.equal(cliReturnURL(49152, "abc-_123"), "http://127.0.0.1:49152/cb?d=abc-_123", "loopback URL shape");
assert.throws(() => cliReturnURL(80, "x"), "privileged port refused");
assert.throws(() => cliReturnURL("49152", "x"), "string port refused");
assert.equal(validCLIPort(1024), true);
assert.equal(validCLIPort(65535), true);
assert.equal(validCLIPort(1023), false);

console.log("restore-payload.test.mjs: all passed");