import { describe, expect, it } from "vitest";
import type { FidoMetadataSnapshot } from "../../src/webauthn/metadata";
import {
  DEFAULT_ATTESTATION_TRUST_POLICY,
  evaluateMetadataPolicy,
} from "../../src/webauthn/trust-policy";

const AAGUID = "00000000-0000-0000-0000-000000000001";

function snapshot(): FidoMetadataSnapshot {
  return {
    sequenceNumber: 42,
    nextUpdate: "2027-01-01",
    entries: [
      {
        aaguid: AAGUID,
        statusReports: [
          { status: "FIDO_CERTIFIED", effectiveDate: "2025-01-01" },
          {
            status: "USER_VERIFICATION_BYPASS",
            effectiveDate: "2026-04-01",
            authenticatorVersion: 7,
          },
        ],
      },
    ],
    jwtAlgorithm: "RS256",
    signerCertificates: 1,
    signerCertificateChain: ["AA"],
    signatureVerified: true,
    trustEstablished: false,
    warnings: [],
  };
}

describe("attestation metadata policy", () => {
  it("evaluates historical effective dates", () => {
    const result = evaluateMetadataPolicy({
      snapshot: snapshot(),
      aaguid: AAGUID,
      asOf: "2026-03-01",
      trustEstablished: true,
    });
    expect(result.accepted).toBe(true);
    expect(result.activeStatusReports.map(({ status }) => status)).toEqual([
      "FIDO_CERTIFIED",
    ]);
  });

  it("blocks severe statuses for the selected firmware", () => {
    const result = evaluateMetadataPolicy({
      snapshot: snapshot(),
      aaguid: AAGUID,
      asOf: "2026-08-19",
      authenticatorVersion: 7,
      trustEstablished: true,
    });
    expect(result.accepted).toBe(false);
    expect(result.checks).toContainEqual(
      expect.objectContaining({
        name: "Metadata status: USER_VERIFICATION_BYPASS",
        status: "fail",
      }),
    );
  });

  it("allows transparent policy overrides", () => {
    const result = evaluateMetadataPolicy({
      snapshot: { ...snapshot(), signatureVerified: false },
      aaguid: "ffffffff-ffff-ffff-ffff-ffffffffffff",
      asOf: "2028-01-01",
      policy: {
        ...DEFAULT_ATTESTATION_TRUST_POLICY,
        requireValidBlobSignature: false,
        requirePinnedTrustRoot: false,
        requireCurrentSnapshot: false,
        requireMetadataEntry: false,
      },
    });
    expect(result.accepted).toBe(true);
  });
});