import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import {
  buildPolicy, draftFromPolicy, inheritedControlDisabled, setDraftChannel,
  setDraftMethod, stable
} from "../src/features/policy/archiveEncryptionDraft.ts";

const baseline = {
  allowed_password_encryption_methods: ["aes"],
  allowed_password_delivery_channels: ["separate_mail", "sms", "letter", "phone", "in_person"],
  policy_hash: "baseline", source_path: [], reason: "Secure baseline", diagnostics: []
};
const initial = draftFromPolicy({}, baseline);
assert.deepEqual(buildPolicy(initial), {}, "Opening default system settings must not create an override or dirty state");
assert.equal(inheritedControlDisabled("system", initial.inheritMethods), false, "System defaults must be editable without a hidden inheritance toggle");
assert.equal(inheritedControlDisabled("system", initial.inheritChannels), false);
const enabled = setDraftMethod(initial, "zip_standard", true);
assert.deepEqual(buildPolicy(enabled), { allowed_password_encryption_methods: ["aes", "zip_standard"] }, "The first system Legacy click must produce an explicit override");
assert.notEqual(stable(buildPolicy(enabled)), stable({}));
assert.deepEqual(buildPolicy(initial), {}, "Changing a draft must preserve the original policy");
const narrowedChannels = setDraftChannel(initial, "sms", false);
assert.deepEqual(buildPolicy(narrowedChannels), { allowed_password_delivery_channels: ["separate_mail", "letter", "phone", "in_person"] });
assert.equal(inheritedControlDisabled("tenant", initial.inheritMethods), true, "Child scopes retain explicit inheritance controls");
assert.equal(inheritedControlDisabled("user", false), false);
assert.deepEqual(buildPolicy(draftFromPolicy(buildPolicy(enabled), baseline)), buildPolicy(enabled), "An explicit system policy survives save/reload");
assert.deepEqual(buildPolicy(setDraftMethod(enabled, "zip_standard", false)), { allowed_password_encryption_methods: ["aes"] });

const panel = readFileSync(new URL("../src/features/policy/ArchiveEncryptionPoliciesPanel.tsx", import.meta.url), "utf8");
assert.match(panel, /inheritedControlDisabled\(scopeType, draft\.inheritMethods\)/);
assert.match(panel, /inheritedControlDisabled\(scopeType, draft\.inheritChannels\)/);
assert.match(panel, /setDraft\(setDraftMethod\(draft, method\.id, checked\)\)/);
assert.match(panel, /setDraft\(setDraftChannel\(draft, channel\.id, checked\)\)/);
assert.match(panel, /scopeType !== "system" && !parentMethods\.includes\(method\.id\)/, "Child scopes must still respect parent ceilings");
const moduleSource = readFileSync(new URL("../src/module.ts", import.meta.url), "utf8");
assert.match(moduleSource, /scopeType: "system",\s*canWrite: hasScope\(auth, "system:settings:write"\) && hasScope\(auth, "admin:policies:write"\)/, "Tenant policy administration alone must not enable edits to the global system archive ceiling");
console.log("Archive encryption settings regressions passed.");