import test from 'node:test';
import assert from 'node:assert/strict';
import {createRequire} from 'node:module';
import {randomUUID} from 'node:crypto';
import {spawnSync} from 'node:child_process';
import fs from 'node:fs';
import path from 'node:path';
const require=createRequire(import.meta.url);
const {createBrokerAuditPersistence}=require('../apps/browser/broker-audit-persistence.cjs');
const enabled=process.platform==='win32'&&process.env.SAFETYNET_NATIVE_BROKER_AUDIT==='1';
test('actual Windows DPAPI encrypted commit preserves broker identity before receipt',{skip:!enabled},()=>{
 const root=path.resolve('artifacts/broker-parent-audit');fs.mkdirSync(root,{recursive:true});
 const directory=fs.mkdtempSync(path.join(root,'proof-'));
 const python=path.resolve('.runtime/windows/python/python.exe'),helper=path.resolve('apps/inspector/dpapi.py');
 const convert=(action,input)=>{const result=spawnSync(python,[helper,action],{input,windowsHide:true,timeout:10000,maxBuffer:65536});assert.equal(result.status,0,'Private Windows DPAPI operation failed');return result.stdout;};
 const queue=[],file=path.join(directory,'queue.bin'),temporary=path.join(directory,'queue.tmp');let committed=false;
 const sink=createBrokerAuditPersistence({policyVersion:4,current:()=>true,getQueue:()=>queue,onFailure:()=>assert.fail('Parent audit was quarantined'),persistQueue:()=>{
  const protectedBytes=convert('protect',Buffer.from(JSON.stringify(queue)));
  const fd=fs.openSync(temporary,'wx',0o600);try{fs.writeFileSync(fd,protectedBytes);fs.fsyncSync(fd);}finally{fs.closeSync(fd);}
  fs.renameSync(temporary,file);committed=true;
 }});
 const input={eventId:randomUUID(),kind:'upload.authorized',ruleId:'broker-approved',policyVersion:4,request:{bytes:6,detectedType:'text'}};
 const receipt=sink.persist(input);assert.equal(committed,true);assert.equal(receipt.eventId,input.eventId);
 const encrypted=fs.readFileSync(file);assert.equal(encrypted.includes(Buffer.from(input.eventId)),false);
 const decrypted=convert('unprotect',encrypted);try{assert.deepEqual(JSON.parse(decrypted.toString()),[input]);}finally{decrypted.fill(0);}
 fs.writeFileSync(path.join(directory,'proof.json'),JSON.stringify({outcome:'passed',nativeProtection:'Windows current-user DPAPI',fsyncBeforeReceipt:true,identityPreserved:true,plaintextIdentityAbsent:true,productionMainWired:false},null,2)+'\n');
});