/**
 * GATE 4 — Mock Verae client lifecycle
 */

import { describe, it, beforeEach } from 'node:test';
import assert from 'node:assert/strict';
import { veraeClient, clearMockJobs } from '../../src/clients/veraeClient.js';
import { config } from '../../src/config.js';
import { setDebugTestSink, createDebugger } from '../../src/debug/index.js';

describe('veraeClient mock', () => {
  beforeEach(() => {
    clearMockJobs();
    // ensure mock mode (set at process start via env in gate script)
    assert.equal(config.mockVerae, true, 'MOCK_VERAE must be true for unit tests');
  });

  it('create → wait → completed', async () => {
    const login = await veraeClient.login({ username: 'u', password: 'p' });
    assert.ok(login.token.startsWith('mock-jwt-'));
    const again = await veraeClient.login({ username: 'u', password: 'p' });
    assert.equal(login.user.id, again.user.id);
    assert.match(login.user.id, /^vu_[0-9a-f]{16}$/);

    const { jobId } = await veraeClient.createTimestamp(login.token, {
      data: 'hello',
      hashAlg: 'SHA256',
    });
    assert.ok(jobId);

    const status = await veraeClient.waitForJob(login.token, jobId, {
      maxAttempts: 40,
      intervalMs: 20,
    });
    assert.equal(status.status, 'completed');
    assert.ok(status.result.startsWith('mock-cert-'));
  });

  it('verify accepts mock certificates', async () => {
    const login = await veraeClient.login({ username: 'u', password: 'p' });
    const { jobId } = await veraeClient.createTimestamp(login.token, { data: 'x' });
    const status = await veraeClient.waitForJob(login.token, jobId, {
      maxAttempts: 40,
      intervalMs: 20,
    });
    const result = await veraeClient.verify(login.token, { certificate: status.result });
    assert.equal(result.valid, true);
  });

  it('debug http logs do not include Authorization values', () => {
    const lines = [];
    setDebugTestSink((line) => lines.push(line));
    process.env.DEBUG_VERAE = 'http';
    const log = createDebugger('http');
    log.debug('verae request', {
      method: 'POST',
      path: '/api/timestamp',
      authorization: 'Bearer super-secret-token-value',
      hasToken: true,
    });
    setDebugTestSink(null);
    delete process.env.DEBUG_VERAE;
    assert.equal(lines.length, 1);
    assert.doesNotMatch(lines[0], /super-secret-token-value/);
    assert.match(lines[0], /REDACTED|hasToken/);
  });
});