/**
 * 覆盖网络 · **序47 S4/S5：服务器实例的设备凭据**（平台侧代签 ＋ 投递 ＋ 续签）单测。
 *
 * ## 这个文件要回答的六个问题
 * 1. **首签**：凭据文件落在**实例 home**（`<dataRoot>/users/<id>/home/.overlay-device.json`）、
 *    `0600`、台账出 `kind='instance'` 条目、relay 密钥表新增该 hostId、registry 已批准，
 *    且 grant 能被 `identity.ts` 的**验签路径**验过（⛔ 不是"写了个文件"就算过）。
 * 2. **幂等**：租约充裕时再调 ⇒ `unchanged`，**一个字节都不写**（台账 `grant_renewals` 不动、
 *    密钥表不出现新的 `*.bak-*`）。这条钉住"每次实例启动都续签一遍"的代价是 0。
 * 3. **续签**：租约将尽 ⇒ 同 `hostId`、**同 hmacSecret**（⛔ 不轮换 ⇒ 不会把还在用旧文件的实例
 *    自己拒掉），`grant_renewals + 1`，且 relay 密钥表**未被重写**（`relayKeyRotated=false`）。
 * 4. **⛔ 不猜不重建**：文件形状非法 ⇒ 具名 `credential-file-corrupt`，**文件逐字节保持原样**、
 *    台账不新增（重建会换 hostId ⇒ 绕过停发并多占配额位，见模块头注纪律 ③）。
 * 5. **停发即拒**：台账 `status='revoked'` ⇒ `device-revoked`（403），文件保持原样。
 * 6. **收编（纪律 ⑤）**：新签发改变 hostId 时，该用户**其它** `kind='instance'` 条目被置
 *    `revoked` 并从 registry 移除 ⇒ "删文件重建"这条处置不会静默留下孤儿设备 / 烧配额。
 *
 * 运行：`node --test test/instance-credential.test.mjs`（Node ≥ 22；测 `lib/` 产物，先 `npm run build`）。
 *
 * @module test/instance-credential
 */

import assert from 'node:assert/strict'
import { existsSync, mkdtempSync, readdirSync, readFileSync, statSync, writeFileSync, rmSync } from 'node:fs'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { test } from 'node:test'

import { LocalUserFs } from '../lib/fs/local-user-fs.js'
import {
  ensureInstanceCredential,
  parseInstanceCredential,
  startInstanceCredentialRenewal,
  INSTANCE_DEVICE_FILE,
} from '../lib/net/relay/instance-credential.js'
import { generateNodeKey, verifyPeerGrant } from '../lib/net/relay/identity.js'
import { loadKeysFile } from '../lib/net/relay/keys.js'
import { loadRegistry } from '../lib/net/relay/registry.js'

const USER = 'u47'

/* ─────────────────────────── 工具 ─────────────────────────── */

/**
 * 设备台账（v12/v13 `overlay_devices`）**内存桩** —— 只复刻被判据依赖的四条语义：
 * ① 首次插入 `grantRenewals = 1`，之后 **+1**；② `status` 不被续签覆盖（停发粘性）；
 * ③ `kind` 缺省 `desktop`；④ `setOverlayDeviceStatus` 对不存在的行回 `false`。
 */
function ledgerStub(seed = []) {
  const rows = new Map()
  for (const r of seed) rows.set(`${r.network}/${r.hostId}`, { kind: 'desktop', status: 'active', grantRenewals: 0, ...r })
  return {
    rows,
    async findOverlayDevice(network, hostId) {
      return rows.get(`${network}/${hostId}`)
    },
    async upsertOverlayDevice(input) {
      const key = `${input.network}/${input.hostId}`
      const at = input.at ?? Date.now()
      const prev = rows.get(key)
      const row = {
        network: input.network,
        hostId: input.hostId,
        userId: input.userId,
        nodeKey: input.nodeKey,
        kind: input.kind ?? 'desktop',
        status: prev?.status ?? 'active',
        leaseExpiresAt: input.leaseExpiresAt,
        grantIssuedAt: at,
        grantRenewals: (prev?.grantRenewals ?? 0) + 1,
      }
      rows.set(key, row)
      return row
    },
    async listOverlayDevices(network) {
      return [...rows.values()].filter((r) => network === undefined || r.network === network)
    },
    async setOverlayDeviceStatus(network, hostId, status) {
      const key = `${network}/${hostId}`
      const prev = rows.get(key)
      if (prev === undefined) return false
      rows.set(key, { ...prev, status })
      return true
    },
  }
}

/** 一组临时环境：签名者私钥 ＋ 密钥表 ＋ registry ＋ 真 `LocalUserFs`（要验 0600 / 落点）。 */
function makeEnv(t, extraEnv = {}) {
  const dir = mkdtempSync(join(tmpdir(), 'dshs-seq47-inst-'))
  t.after(() => rmSync(dir, { recursive: true, force: true }))
  const dataRoot = join(dir, 'data')
  const signer = generateNodeKey()
  const signerKeyFile = join(dir, 'signer-key.pem')
  writeFileSync(signerKeyFile, signer.privateKeyPem, { mode: 0o600 })
  const relayKeysFile = join(dir, 'relay-keys.json')
  writeFileSync(relayKeysFile, '{}\n', { mode: 0o600 })
  const vars = {
    DSHS_OVERLAY_SIGNER_KEY_FILE: signerKeyFile,
    DSHS_RELAY_KEYS_FILE: relayKeysFile,
    DSHS_OVERLAY_NODES_FILE: join(dir, 'nodes.json'),
    DESKTOP_GRANT_TTL_HOURS: '24',
    DESKTOP_GRANT_MAX_DEVICES: '10',
    ...extraEnv,
  }
  for (const [k, v] of Object.entries(vars)) process.env[k] = v
  const userFs = new LocalUserFs((id) => join(dataRoot, 'users', id))
  const credFile = join(dataRoot, 'users', USER, 'home', INSTANCE_DEVICE_FILE)
  return { dir, dataRoot, signer, signerKeyFile, relayKeysFile, userFs, credFile, vars }
}

/** 台账里的实例条目（`kind='instance'`）。 */
function instanceRows(db) {
  return [...db.rows.values()].filter((r) => r.kind === 'instance')
}

function bakCount(dir) {
  return readdirSync(dir).filter((f) => f.startsWith('relay-keys.json.bak-')).length
}

/* ─────────────────────────── 用例 ─────────────────────────── */

test('S4 首签：凭据落实例 home（0600）＋ 台账 kind=instance ＋ 密钥表 ＋ registry ＋ grant 可验签', async (t) => {
  const env = makeEnv(t)
  const db = ledgerStub()

  const res = await ensureInstanceCredential({ db, userFs: env.userFs }, USER, { reason: 'test' })
  assert.equal(res.ok, true, JSON.stringify(res))
  assert.equal(res.action, 'issued')
  assert.equal(res.network, `u:${USER}`)
  assert.equal(res.renewals, 1)

  // ① 文件落在**实例 home**（不是 ws、不是平台目录），权限 0600，内容可解析
  assert.ok(existsSync(env.credFile), `凭据文件应存在：${env.credFile}`)
  const text = readFileSync(env.credFile, 'utf8')
  const cred = parseInstanceCredential(text)
  assert.notEqual(cred, undefined, '凭据文件应能被严格解析')
  assert.equal(cred.hostId, res.hostId)
  assert.equal(cred.kind, 'instance')
  assert.equal(cred.version, 1)
  if (process.platform !== 'win32') {
    assert.equal(statSync(env.credFile).mode & 0o777, 0o600, '凭据必须 0600')
  }

  // ② hostId 口径 = `d-<userId>-<公钥前 8 位>`（§④ 已定规则，与用户态端点同源）
  assert.equal(cred.hostId, `d-${USER}-${cred.nodeKey.slice(0, 8)}`)
  assert.equal(cred.nodeKey.length, 64)

  // ③ 台账：kind='instance' ＋ active ＋ 租约与回执一致
  const rows = instanceRows(db)
  assert.equal(rows.length, 1)
  assert.equal(rows[0].status, 'active')
  assert.equal(rows[0].nodeKey, cred.nodeKey)
  assert.equal(new Date(rows[0].leaseExpiresAt).toISOString(), res.expiresAt)

  // ④ relay 密钥表：新增该 hostId（否则实例的 HELLO 永远对不上 MAC）
  const keys = loadKeysFile(env.relayKeysFile)
  assert.ok(
    [...keys.keys()].some((k) => k === `${res.network}/${res.hostId}`),
    `密钥表应含 ${res.network}/${res.hostId}，实得 ${[...keys.keys()].join(',')}`,
  )

  // ⑤ registry：已批准（⇒ 立刻进入该网的派生白名单）
  const reg = loadRegistry(env.vars.DSHS_OVERLAY_NODES_FILE)
  const node = reg.nodes[`${res.network}/${res.hostId}`]
  assert.equal(node?.status, 'approved')

  // ⑥ grant 能被**产品自己的验签路径**验过（network / hostId / nodeKey 三者都要对得上）
  const verdict = verifyPeerGrant(cred.grant.doc, cred.grant.sig, {
    trustedSignerKeys: [env.signer.publicKey],
    network: res.network,
    hostId: res.hostId,
    nodeKey: cred.nodeKey,
  })
  assert.equal(verdict.ok, true, `grant 应验签通过，实得 ${JSON.stringify(verdict)}`)

  // ⑦ ⛔ 回执 / 回执的序列化里不得出现密钥材料（本模块的返回值会进日志）
  const dumped = JSON.stringify(res)
  assert.ok(!dumped.includes('PRIVATE KEY'), '回执不得含私钥')
  assert.ok(!dumped.includes(cred.hmacSecret), '回执不得含 hmacSecret')
})

test('S5 幂等：租约充裕 ⇒ unchanged，且一个字节都不写', async (t) => {
  const env = makeEnv(t)
  const db = ledgerStub()
  const first = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
  assert.equal(first.action, 'issued')
  const textBefore = readFileSync(env.credFile, 'utf8')
  const baksBefore = bakCount(env.dir)

  const again = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
  assert.equal(again.ok, true)
  assert.equal(again.action, 'unchanged')
  assert.equal(again.hostId, first.hostId)
  assert.equal(again.renewals, 1, '未续签 ⇒ grant_renewals 不应增长')
  assert.equal(readFileSync(env.credFile, 'utf8'), textBefore, 'unchanged 不得改写文件')
  assert.equal(bakCount(env.dir), baksBefore, 'unchanged 不得产生密钥表备份')
  assert.equal(instanceRows(db).length, 1)
})

test('S5 续签：同 hostId ＋ 同 hmacSecret，grant_renewals +1，密钥表不重写', async (t) => {
  const env = makeEnv(t)
  const db = ledgerStub()
  const first = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
  const credBefore = parseInstanceCredential(readFileSync(env.credFile, 'utf8'))
  const baksBefore = bakCount(env.dir)

  const renewed = await ensureInstanceCredential({ db, userFs: env.userFs }, USER, { force: true, reason: 'test-force' })
  assert.equal(renewed.ok, true, JSON.stringify(renewed))
  assert.equal(renewed.action, 'renewed')
  assert.equal(renewed.hostId, first.hostId, '续签必须同 hostId（⛔ 不换设备）')
  assert.equal(renewed.renewals, 2, 'grant_renewals 应为 2')
  assert.equal(renewed.relayKeyRotated, false, '复用同一把密钥 ⇒ 密钥表不应被重写')

  const credAfter = parseInstanceCredential(readFileSync(env.credFile, 'utf8'))
  assert.equal(credAfter.nodeKey, credBefore.nodeKey)
  assert.equal(credAfter.nodePrivateKeyPem, credBefore.nodePrivateKeyPem)
  assert.equal(credAfter.hmacSecret, credBefore.hmacSecret, '⛔ 不轮换 hmacSecret（否则旧进程被自己拒）')
  assert.equal(bakCount(env.dir), baksBefore, '密钥表值未变 ⇒ 不得产生备份文件')
  assert.equal(instanceRows(db).length, 1, '⛔ 不得出现第二条实例设备')
  assert.equal(loadKeysFile(env.relayKeysFile).size, 1)
})

test('S5 定时续签：只扫 kind=instance 且 active 的租户网，桌面条目不动', async (t) => {
  const env = makeEnv(t)
  const stale = new Date(Date.now() - 60_000).toISOString()
  const db = ledgerStub([
    { network: `u:${USER}`, hostId: `d-${USER}-aaaaaaaa`, userId: USER, nodeKey: 'a'.repeat(64), kind: 'instance', status: 'active', leaseExpiresAt: 0, grantRenewals: 3 },
    { network: 'u:desktopguy', hostId: 'd-desktopguy-bbbbbbbb', userId: 'desktopguy', nodeKey: 'b'.repeat(64), kind: 'desktop', status: 'active', leaseExpiresAt: 0, grantRenewals: 1 },
    { network: 'u:revoked', hostId: 'd-revoked-cccccccc', userId: 'revoked', nodeKey: 'c'.repeat(64), kind: 'instance', status: 'revoked', leaseExpiresAt: 0, grantRenewals: 1 },
    { network: 'ops', hostId: 'manager', userId: 'x', nodeKey: 'd'.repeat(64), kind: 'instance', status: 'active', leaseExpiresAt: 0, grantRenewals: 1 },
  ])
  // 给 USER 铺一份"租约将尽"的真凭据（先签发，再把文件里的 expiresAt 改旧）
  const first = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
  assert.equal(first.ok, true, JSON.stringify(first))
  const cred = parseInstanceCredential(readFileSync(env.credFile, 'utf8'))
  writeFileSync(env.credFile, JSON.stringify({ ...cred, expiresAt: stale }, null, 2) + '\n')

  const handle = startInstanceCredentialRenewal({ db, userFs: env.userFs }, { intervalMs: 0 })
  assert.equal(handle.armed, false, 'intervalMs=0 ⇒ 只留手动一遍')
  const report = await handle.runOnce()
  handle.stop()

  assert.equal(report.scanned, 1, `只该扫到 u:${USER}（桌面 / 已停发 / 非租户网都不动），实得 ${report.scanned}`)
  assert.equal(report.renewed, 1)
  assert.equal(report.issued, 0)
  assert.deepEqual(report.failed, [])
  const after = parseInstanceCredential(readFileSync(env.credFile, 'utf8'))
  assert.equal(after.hostId, cred.hostId)
  assert.equal(Date.parse(after.expiresAt) > Date.now(), true, '续签后租约应重新变新')
  // 台账里那些非 instance 的条目一个都没动
  const desktopRow = [...db.rows.values()].find((r) => r.hostId === 'd-desktopguy-bbbbbbbb')
  assert.equal(desktopRow.grantRenewals, 1)
})

test('⛔ 不猜不重建：文件形状非法 ⇒ 具名拒绝且文件逐字节保持原样', async (t) => {
  const env = makeEnv(t)
  const db = ledgerStub()
  const first = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
  assert.equal(first.action, 'issued')
  const rowsBefore = db.rows.size

  for (const bad of ['{not json', '{}', JSON.stringify({ version: 1, kind: 'instance' })]) {
    writeFileSync(env.credFile, bad)
    const res = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
    assert.equal(res.ok, false, `应拒绝：${bad.slice(0, 24)}`)
    assert.equal(res.reason, 'credential-file-corrupt')
    assert.equal(readFileSync(env.credFile, 'utf8'), bad, '⛔ 拒绝路径不得改写文件')
    assert.equal(db.rows.size, rowsBefore, '⛔ 拒绝路径不得新增台账条目')
  }

  // 公私钥不成对（改成另一把私钥）同样按 corrupt 处理 —— 否则故障会推迟到拨号时表现为"网络问题"
  const cred = parseInstanceCredential(
    JSON.stringify({
      version: 1,
      kind: 'instance',
      network: `u:${USER}`,
      hostId: `d-${USER}-00000000`,
      nodeKey: 'e'.repeat(64),
      nodePrivateKeyPem: generateNodeKey().privateKeyPem,
      hmacSecret: 'f'.repeat(64),
      grant: { doc: { v: 1 }, sig: 'x' },
      issuedAt: new Date().toISOString(),
      expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
      renewals: 1,
    }),
  )
  assert.equal(cred, undefined, '公私钥不成对应判为不可用')
})

test('停发即拒：台账 revoked ⇒ device-revoked(403)，文件保持原样', async (t) => {
  const env = makeEnv(t)
  const db = ledgerStub()
  const first = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
  const textBefore = readFileSync(env.credFile, 'utf8')
  await db.setOverlayDeviceStatus(`u:${USER}`, first.hostId, 'revoked')

  const res = await ensureInstanceCredential({ db, userFs: env.userFs }, USER, { force: true })
  assert.equal(res.ok, false)
  assert.equal(res.reason, 'device-revoked')
  assert.equal(res.status, 403)
  assert.equal(readFileSync(env.credFile, 'utf8'), textBefore, '被停发的设备不得拿到新凭据')
})

test('纪律 ⑤ 收编：新签发换 hostId ⇒ 旧的实例条目被置 revoked 并退出 registry', async (t) => {
  const env = makeEnv(t)
  const db = ledgerStub()
  const first = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)
  assert.equal(first.action, 'issued')

  // 模拟"凭据文件丢了"（我们自己写进处置流程的那条动作）⇒ 下一次 ensure 会重新签发
  rmSync(env.credFile)
  const again = await ensureInstanceCredential({ db, userFs: env.userFs }, USER)

  assert.equal(again.ok, true, JSON.stringify(again))
  assert.equal(again.action, 'issued')
  assert.notEqual(again.hostId, first.hostId, '重建必然换 hostId（平台不留私钥副本）')
  assert.deepEqual(again.superseded, [first.hostId], '旧条目应被点名收编')

  const old = db.rows.get(`u:${USER}/${first.hostId}`)
  assert.equal(old.status, 'revoked', '旧条目应被置 revoked')
  assert.equal(old.kind, 'instance')
  const reg = loadRegistry(env.vars.DSHS_OVERLAY_NODES_FILE)
  assert.equal(reg.nodes[`u:${USER}/${first.hostId}`], undefined, '旧节点应已退出 registry 白名单')
  assert.equal(reg.nodes[`u:${USER}/${again.hostId}`]?.status, 'approved')
  assert.equal(instanceRows(db).length, 2, '台账保留旧行为审计痕迹（⛔ 不删行）')
})