package transport_test

import (
	"testing"

	"git.n1ko.dev/Niko/niko_trust/pkg/identity/signer"
	"git.n1ko.dev/Niko/niko_trust/pkg/protocol"
	"git.n1ko.dev/Niko/niko_trust/pkg/tce"
	"git.n1ko.dev/Niko/niko_trust/pkg/transport"
)

func TestEnvelopeViewAndVerify(t *testing.T) {
	issuer, _ := signer.Generate()
	subject, _ := signer.Generate()

	c := &protocol.Claim{
		Issuer:    issuer.Public(),
		Subject:   subject.Public(),
		Claims:    map[string]tce.Value{"example.flag": tce.Bool(true), "level": tce.Number("7")},
		CreatedAt: 1_700_000_000,
		ExpiresAt: 1_700_086_400,
		Serial:    1,
		Nonce:     make([]byte, tce.NonceSize),
	}
	tceBytes, err := protocol.EncodeClaim(c)
	if err != nil {
		t.Fatal(err)
	}
	sig := issuer.Sign(tceBytes)

	env := &transport.Envelope{TCE: tceBytes, Signature: sig}

	// The authoritative object_id is SHA-256(tce).
	if env.ContentID() != tce.ComputeID(tceBytes).String() {
		t.Fatal("ContentID mismatch")
	}

	// The object view decodes to valid JSON naming the subject address.
	_, view, err := env.BuildView()
	if err != nil {
		t.Fatal(err)
	}
	if len(view) == 0 {
		t.Fatal("empty view")
	}

	// A verifier checks the signature over the exact TCE bytes.
	if typ, err := env.Verify(); err != nil {
		t.Fatalf("verify %s: %v", typ, err)
	}

	// Round-trips through JSON.
	raw, err := env.Marshal()
	if err != nil {
		t.Fatal(err)
	}
	back, err := transport.ParseEnvelope(raw)
	if err != nil {
		t.Fatal(err)
	}
	if back.ContentID() != env.ContentID() {
		t.Fatal("round-trip id mismatch")
	}
}