/**
 * Docker Security Module Tests
 * Tests for image digest verification, security modes, and trusted digest management
 * 
 * Note: These tests focus on the security logic and configuration management.
 * Docker API integration tests are handled separately.
 */

const fs = require('fs');
const path = require('path');

// We'll test the module with a temp config file to avoid affecting production
const TEST_CONFIG_PATH = path.join(__dirname, 'test-docker-security-config.json');

describe('DockerSecurity Module', () => {
  let dockerSecurity;
  const originalEnv = process.env.DOCKER_SECURITY_CONFIG;

  beforeAll(() => {
    // Point to test config file
    process.env.DOCKER_SECURITY_CONFIG = TEST_CONFIG_PATH;
  });

  beforeEach(() => {
    // Clean up test config before each test
    if (fs.existsSync(TEST_CONFIG_PATH)) {
      fs.unlinkSync(TEST_CONFIG_PATH);
    }

    // Clear module cache and reload
    delete require.cache[require.resolve('../docker-security')];
    dockerSecurity = require('../docker-security');
    
    // Clear any existing trusted digests
    dockerSecurity.config.trustedDigests = {};
    dockerSecurity.config.verificationMode = 'verify';
    dockerSecurity.mode = 'verify';
    dockerSecurity.saveConfig();
  });

  afterEach(() => {
    // Clean up test config
    if (fs.existsSync(TEST_CONFIG_PATH)) {
      fs.unlinkSync(TEST_CONFIG_PATH);
    }
  });

  afterAll(() => {
    // Restore original env
    if (originalEnv) {
      process.env.DOCKER_SECURITY_CONFIG = originalEnv;
    } else {
      delete process.env.DOCKER_SECURITY_CONFIG;
    }
  });

  describe('Configuration Management', () => {
    test('should create default config when file does not exist', () => {
      expect(dockerSecurity.config).toBeDefined();
      expect(dockerSecurity.config).toHaveProperty('trustedDigests');
      expect(dockerSecurity.config).toHaveProperty('verificationMode');
      expect(dockerSecurity.config).toHaveProperty('allowUnverified');
      expect(dockerSecurity.config).toHaveProperty('updateTrustedOnPull');
    });

    test('should save and load config correctly', () => {
      // Add a trusted digest
      dockerSecurity.setTrustedDigest('test:v1', 'sha256:test123');
      
      // Reload module
      delete require.cache[require.resolve('../docker-security')];
      const reloaded = require('../docker-security');
      
      // Should have loaded the saved config
      expect(reloaded.config.trustedDigests['test:v1']).toBe('sha256:test123');
    });

    test('should handle corrupted config file gracefully', () => {
      // Write corrupted JSON
      fs.writeFileSync(TEST_CONFIG_PATH, '{ invalid json');
      
      // Reload - should not crash
      delete require.cache[require.resolve('../docker-security')];
      const fresh = require('../docker-security');
      
      expect(fresh.config).toBeDefined();
      expect(fresh.config.trustedDigests).toBeDefined();
    });

    test('should persist changes to disk', () => {
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:abc123');
      
      // Config file should exist
      expect(fs.existsSync(TEST_CONFIG_PATH)).toBe(true);
      
      // Should be valid JSON
      const savedData = fs.readFileSync(TEST_CONFIG_PATH, 'utf8');
      const parsed = JSON.parse(savedData);
      expect(parsed.trustedDigests['nginx:latest']).toBe('sha256:abc123');
    });
  });

  describe('Trusted Digest Management', () => {
    test('should add new trusted digest', () => {
      dockerSecurity.setTrustedDigest('postgres:14', 'sha256:newdigest');
      
      expect(dockerSecurity.config.trustedDigests['postgres:14']).toBe('sha256:newdigest');
    });

    test('should update existing trusted digest', () => {
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:original');
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:updated');
      
      expect(dockerSecurity.config.trustedDigests['nginx:latest']).toBe('sha256:updated');
    });

    test('should remove trusted digest', () => {
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:test');
      expect(dockerSecurity.config.trustedDigests['nginx:latest']).toBeDefined();
      
      dockerSecurity.removeTrustedDigest('nginx:latest');
      expect(dockerSecurity.config.trustedDigests['nginx:latest']).toBeUndefined();
    });

    test('should get all trusted digests', () => {
      dockerSecurity.setTrustedDigest('image1', 'sha256:digest1');
      dockerSecurity.setTrustedDigest('image2', 'sha256:digest2');
      
      const digests = dockerSecurity.getTrustedDigests();
      
      expect(digests).toHaveProperty('image1');
      expect(digests).toHaveProperty('image2');
      expect(Object.keys(digests).length).toBeGreaterThanOrEqual(2);
    });

    test('should return copy of trusted digests (not reference)', () => {
      dockerSecurity.setTrustedDigest('original', 'sha256:original');
      
      const digests = dockerSecurity.getTrustedDigests();
      digests['modified'] = 'sha256:modified';
      
      expect(dockerSecurity.config.trustedDigests['modified']).toBeUndefined();
      expect(dockerSecurity.config.trustedDigests['original']).toBe('sha256:original');
    });

    test('should handle image names with special characters', () => {
      const specialName = 'my-app_v2.0:latest';
      
      dockerSecurity.setTrustedDigest(specialName, 'sha256:special');
      expect(dockerSecurity.config.trustedDigests[specialName]).toBe('sha256:special');
    });

    test('should handle very long image names', () => {
      const longName = `registry.example.com/team/project/${  'a'.repeat(100)  }:v1.2.3`;
      
      dockerSecurity.setTrustedDigest(longName, 'sha256:long');
      expect(dockerSecurity.config.trustedDigests[longName]).toBe('sha256:long');
    });
  });

  describe('Security Modes', () => {
    test('should set mode to strict', () => {
      dockerSecurity.setMode('strict');
      
      expect(dockerSecurity.mode).toBe('strict');
      expect(dockerSecurity.config.verificationMode).toBe('strict');
    });

    test('should set mode to verify', () => {
      dockerSecurity.setMode('verify');
      
      expect(dockerSecurity.mode).toBe('verify');
      expect(dockerSecurity.config.verificationMode).toBe('verify');
    });

    test('should set mode to permissive', () => {
      dockerSecurity.setMode('permissive');
      
      expect(dockerSecurity.mode).toBe('permissive');
      expect(dockerSecurity.config.verificationMode).toBe('permissive');
    });

    test('should reject invalid mode', () => {
      expect(() => dockerSecurity.setMode('invalid')).toThrow('Invalid mode');
      expect(() => dockerSecurity.setMode('STRICT')).toThrow('Invalid mode');
      expect(() => dockerSecurity.setMode('')).toThrow('Invalid mode');
    });

    test('should persist mode change to config file', () => {
      dockerSecurity.setMode('strict');
      
      const savedData = fs.readFileSync(TEST_CONFIG_PATH, 'utf8');
      const parsed = JSON.parse(savedData);
      expect(parsed.verificationMode).toBe('strict');
    });

    test('should load mode from config on startup', () => {
      dockerSecurity.setMode('strict');
      
      // Reload module
      delete require.cache[require.resolve('../docker-security')];
      const reloaded = require('../docker-security');
      
      expect(reloaded.mode).toBe('strict');
    });
  });

  describe('Digest Verification Logic', () => {
    test('should accept matching digest', async () => {
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:trusted123');
      
      const result = await dockerSecurity.verifyImageDigest('nginx:latest', 'sha256:trusted123');
      
      expect(result.verified).toBe(true);
      expect(result.action).toBe('accept');
      expect(result.reason).toContain('matches trusted value');
    });

    test('should reject mismatched digest in strict mode', async () => {
      dockerSecurity.setMode('strict');
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:trusted123');
      
      const result = await dockerSecurity.verifyImageDigest('nginx:latest', 'sha256:different');
      
      expect(result.verified).toBe(false);
      expect(result.action).toBe('reject');
      expect(result.reason).toContain('mismatch');
    });

    test('should warn on mismatched digest in verify mode', async () => {
      dockerSecurity.setMode('verify');
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:trusted123');
      
      const result = await dockerSecurity.verifyImageDigest('nginx:latest', 'sha256:different');
      
      expect(result.verified).toBe(false);
      expect(result.action).toBe('warn');
      expect(result.reason).toContain('mismatch');
    });

    test('should accept mismatched digest in permissive mode', async () => {
      dockerSecurity.setMode('permissive');
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:trusted123');
      
      const result = await dockerSecurity.verifyImageDigest('nginx:latest', 'sha256:different');
      
      expect(result.verified).toBe(true);
      expect(result.action).toBe('accept');
      expect(result.reason).toContain('permissive mode');
    });

    test('should reject unknown image in strict mode', async () => {
      dockerSecurity.setMode('strict');
      
      const result = await dockerSecurity.verifyImageDigest('unknown:latest', 'sha256:anything');
      
      expect(result.verified).toBe(false);
      expect(result.action).toBe('reject');
      expect(result.reason).toContain('No trusted digest');
    });

    test('should accept unknown image in verify mode', async () => {
      dockerSecurity.setMode('verify');
      
      const result = await dockerSecurity.verifyImageDigest('unknown:latest', 'sha256:anything');
      
      expect(result.verified).toBe(true);
      expect(result.action).toBe('accept');
    });

    test('should accept and auto-trust unknown image when updateTrustedOnPull enabled', async () => {
      dockerSecurity.setMode('permissive');
      dockerSecurity.config.updateTrustedOnPull = true;
      
      const result = await dockerSecurity.verifyImageDigest('newimage:v1', 'sha256:new123');
      
      expect(result.verified).toBe(true);
      expect(result.action).toBe('accept');
      expect(dockerSecurity.config.trustedDigests['newimage:v1']).toBe('sha256:new123');
    });

    test('should not auto-trust when updateTrustedOnPull disabled', async () => {
      dockerSecurity.config.updateTrustedOnPull = false;
      
      const result = await dockerSecurity.verifyImageDigest('newimage:v2', 'sha256:new456');
      
      expect(result.verified).toBe(true);
      expect(dockerSecurity.config.trustedDigests['newimage:v2']).toBeUndefined();
    });

    test('should match base image name when tag not in config', async () => {
      // Config has 'redis' (no tag), test 'redis:alpine'
      dockerSecurity.setTrustedDigest('redis', 'sha256:base');
      
      const result = await dockerSecurity.verifyImageDigest('redis:alpine', 'sha256:base');
      
      expect(result.verified).toBe(true);
      expect(result.action).toBe('accept');
    });

    test('should prefer specific tag over base name', async () => {
      dockerSecurity.setTrustedDigest('redis', 'sha256:base');
      dockerSecurity.setTrustedDigest('redis:alpine', 'sha256:alpine');
      
      const result = await dockerSecurity.verifyImageDigest('redis:alpine', 'sha256:alpine');
      
      expect(result.verified).toBe(true);
      expect(result.trustedDigest).toBe('sha256:alpine');
    });
  });

  describe('Status Reporting', () => {
    test('should return security status', () => {
      const status = dockerSecurity.getStatus();
      
      expect(status).toHaveProperty('mode');
      expect(status).toHaveProperty('trustedImagesCount');
      expect(status).toHaveProperty('configFile');
      expect(status).toHaveProperty('updateTrustedOnPull');
    });

    test('should count trusted images correctly', () => {
      const initialCount = dockerSecurity.getStatus().trustedImagesCount;
      
      dockerSecurity.setTrustedDigest('count-test-1', 'sha256:1');
      dockerSecurity.setTrustedDigest('count-test-2', 'sha256:2');
      dockerSecurity.setTrustedDigest('count-test-3', 'sha256:3');
      
      const status = dockerSecurity.getStatus();
      
      expect(status.trustedImagesCount).toBe(initialCount + 3);
    });

    test('should reflect current mode', () => {
      dockerSecurity.setMode('strict');
      expect(dockerSecurity.getStatus().mode).toBe('strict');
      
      dockerSecurity.setMode('verify');
      expect(dockerSecurity.getStatus().mode).toBe('verify');
    });
  });

  describe('Edge Cases & Security Boundaries', () => {
    test('should handle empty digest string in strict mode', async () => {
      dockerSecurity.setMode('strict');
      dockerSecurity.setTrustedDigest('test:latest', 'sha256:trusted');
      
      const result = await dockerSecurity.verifyImageDigest('test:latest', '');
      
      expect(result.verified).toBe(false);
      expect(result.action).toBe('reject');
    });

    test('should handle null/undefined digest in strict mode', async () => {
      dockerSecurity.setMode('strict');
      dockerSecurity.setTrustedDigest('test:latest', 'sha256:trusted');
      
      const result1 = await dockerSecurity.verifyImageDigest('test:latest', null);
      const result2 = await dockerSecurity.verifyImageDigest('test:latest', undefined);
      
      expect(result1.verified).toBe(false);
      expect(result2.verified).toBe(false);
    });

    test('should not expose sensitive data in verification result', async () => {
      dockerSecurity.setTrustedDigest('nginx:latest', 'sha256:trusted123');
      
      const result = await dockerSecurity.verifyImageDigest('nginx:latest', 'sha256:trusted123');
      
      // Should not contain file paths, internal state, etc
      const resultJson = JSON.stringify(result);
      expect(resultJson).not.toContain(TEST_CONFIG_PATH);
      expect(result).not.toHaveProperty('config');
      expect(result).not.toHaveProperty('_internal');
    });

    test('should handle concurrent digest updates safely', () => {
      // Add multiple digests rapidly
      for (let i = 0; i < 10; i++) {
        dockerSecurity.setTrustedDigest(`image${i}`, `sha256:digest${i}`);
      }
      
      // All should be present
      for (let i = 0; i < 10; i++) {
        expect(dockerSecurity.config.trustedDigests[`image${i}`]).toBe(`sha256:digest${i}`);
      }
    });

    test('should handle removal of non-existent digest', () => {
      expect(() => {
        dockerSecurity.removeTrustedDigest('nonexistent:latest');
      }).not.toThrow();
    });

    test('should validate digest format (basic)', async () => {
      dockerSecurity.setMode('verify');
      
      // These should all work (verification logic doesn't enforce sha256: prefix)
      const result1 = await dockerSecurity.verifyImageDigest('test:1', 'sha256:abc123');
      const result2 = await dockerSecurity.verifyImageDigest('test:2', 'localid123');
      
      expect(result1.actualDigest).toBe('sha256:abc123');
      expect(result2.actualDigest).toBe('localid123');
    });
  });

  describe('Verification Result Structure', () => {
    test('should include all expected fields in result', async () => {
      dockerSecurity.setTrustedDigest('test:v1', 'sha256:trusted');
      
      const result = await dockerSecurity.verifyImageDigest('test:v1', 'sha256:trusted');
      
      expect(result).toHaveProperty('verified');
      expect(result).toHaveProperty('mode');
      expect(result).toHaveProperty('imageName');
      expect(result).toHaveProperty('actualDigest');
      expect(result).toHaveProperty('trustedDigest');
      expect(result).toHaveProperty('action');
      expect(result).toHaveProperty('reason');
    });

    test('should set trustedDigest to null when not configured', async () => {
      const result = await dockerSecurity.verifyImageDigest('unknown:v1', 'sha256:test');
      
      expect(result.trustedDigest).toBeNull();
    });

    test('should preserve imageName and actualDigest in result', async () => {
      const imageName = 'myapp:1.2.3';
      const digest = 'sha256:abcdef123456';
      
      const result = await dockerSecurity.verifyImageDigest(imageName, digest);
      
      expect(result.imageName).toBe(imageName);
      expect(result.actualDigest).toBe(digest);
    });
  });
});