// Finite, isolated administrator workflow proof using actual UI and HTTP routes.
import assert from 'node:assert/strict';
import { createRequire } from 'node:module';
import { createServer } from 'node:net';
import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join, resolve, sep, basename } from 'node:path';
import { spawn } from 'node:child_process';
import { randomBytes } from 'node:crypto';
import { openStore } from '../apps/server/store.mjs';
import { createApp } from '../apps/server/app.mjs';
import { verifyPolicy } from '../packages/core/policy.mjs';
const require=createRequire(import.meta.url),directory=mkdtempSync(join(tmpdir(),'safetynet-enterprise-admin-smoke-'));
let store,server,icap,child;const exchanges=[];
try{
 store=openStore(join(directory,'management'));const original=store.get('policy');original.browser.allowDevTools=true;original.browser.allowWebSockets=true;store.put('policy',original);
 const adminToken=randomBytes(32).toString('base64url'),config={adminToken,publicUrl:'http://127.0.0.1',secure:false};
 server=createApp(store,config).listen(0,'127.0.0.1');await new Promise(r=>server.once('listening',r));config.publicUrl=`http://127.0.0.1:${server.address().port}`;
 icap=createServer(socket=>{let received=Buffer.alloc(0);socket.on('data',chunk=>{received=Buffer.concat([received,chunk]);if(received.length>16384){socket.destroy();return;}if(received.includes('\r\n\r\n')){exchanges.push(received.toString('ascii'));socket.end('ICAP/1.0 200 OK\r\nMethods: RESPMOD, REQMOD\r\nISTag: "synthetic-test-service"\r\nAllow: 204\r\nEncapsulated: null-body=0\r\n\r\n');}});}).listen(0,'127.0.0.1');await new Promise(r=>icap.once('listening',r));
 const env={...process.env,SAFETYNET_ADMIN_SMOKE_PROFILE:join(directory,'browser'),SAFETYNET_ADMIN_SMOKE_URL:config.publicUrl,SAFETYNET_ADMIN_SMOKE_TOKEN:adminToken,SAFETYNET_ADMIN_SMOKE_ICAP:`icap://127.0.0.1:${icap.address().port}/scan`};delete env.ELECTRON_RUN_AS_NODE;
 child=spawn(require('electron'),['scripts/enterprise-admin-smoke.cjs'],{env,windowsHide:true,stdio:['ignore','pipe','pipe']});child.stdout.on('data',data=>{if(String(data).includes('ADMIN_UI_PROOF_OK'))console.log('Administrator interface workflow passed.');});child.stderr.on('data',data=>{const message=String(data);if(message.includes('ADMIN_UI_PROOF_'))console.error(message.trim());});
 const timer=setTimeout(()=>child.kill(),60000),code=await new Promise(r=>{child.once('exit',code=>r(code??1));child.once('error',()=>r(1));});clearTimeout(timer);assert.equal(code,0,'Administrator interface proof failed');
 const policy=verifyPolicy(store.envelope(),store.publicKey());assert.equal(policy.version,3);assert.equal(policy.browser.allowDevTools,false);assert.equal(policy.browser.allowWebSockets,false);assert.deepEqual(policy.enterprise.dns,{mode:'secure',templates:['https://dns.synthetic.example/dns-query']});assert.deepEqual(policy.enterprise.vpn,{required:true,interfaceNames:['Synthetic Corporate VPN'],requiredDnsServers:['10.77.0.53']});assert.equal(policy.enterprise.icap.enabled,true);assert.equal(policy.enterprise.icap.url,env.SAFETYNET_ADMIN_SMOKE_ICAP);assert.equal(exchanges.length,1);assert.ok(exchanges[0].startsWith('OPTIONS '));assert.equal(exchanges[0].split('\r\n\r\n')[1],'');
 assert.equal(policy.diagnostics.enabled,true);assert.equal(policy.diagnostics.mode,'debug');assert.equal(policy.diagnostics.endpoint,'https://collector.synthetic.example');assert.ok(policy.agents.scopes.includes('bookmarks:mutate'));
 const report={signedDiagnosticsUi:true,newAgentScopesUi:true,adminUi:true,isolatedControlPlane:true,previewDidNotPublish:true,explicitSignedPublication:true,integrationFormRoundtrip:true,optionsOnlyProbe:true,probeContentSent:false,cspPreserved:true,nodeUnavailable:true,hiddenCpuWindow:true,policyVersion:policy.version,groupedNavigation:true,draftChangeReview:true,reviewDoesNotPublish:true,fleetAndAuditFilters:true,consoleThemePersistence:true,mobileNoHorizontalOverflow:true,readOnlyRoleControls:true,sessionInventoryUi:true};mkdirSync('artifacts',{recursive:true});writeFileSync('artifacts/enterprise-admin-proof.json',JSON.stringify(report,null,2));console.log(JSON.stringify(report));
}finally{
 // eslint-disable-next-line no-unsafe-finally -- Cleanup failure must fail closed rather than report successful protected cleanup.
 child?.kill();for(const service of [server,icap])if(service)await new Promise(r=>{service.closeAllConnections?.();service.close(r);});store?.db.close();const target=resolve(directory);if(!target.startsWith(resolve(tmpdir())+sep)||!basename(target).startsWith('safetynet-enterprise-admin-smoke-'))throw Error('Unsafe proof cleanup');rmSync(target,{recursive:true,force:true,maxRetries:10,retryDelay:100});
}