'use strict';
// Synthetic classification belongs only in this explicitly test-only factory.
const fs=require('node:fs');
const path=require('node:path');
const https=require('node:https');
const {runBrokerProcess}=require('../../apps/network-broker/process-entry.cjs');
const {createConnectProxy}=require('../../apps/network-broker/connect-inspection-proxy.cjs');
const cert=fs.readFileSync(path.join(__dirname,'icap/cert.pem'));
const key=fs.readFileSync(path.join(__dirname,'icap/key.pem'));
runBrokerProcess(config=>{
  if(Object.keys(config).join(',')!=='destination'||typeof config.destination!=='string'||!/^localhost:[1-9][0-9]{0,4}$/.test(config.destination))throw Error('invalid-test-config');
  const port=Number(config.destination.split(':')[1]);if(port>65535)throw Error('invalid-test-config');
  return createConnectProxy({authority:'synthetic-test-policy',current:()=>true,resolveCertificate:binding=>binding.authority===config.destination?{authority:config.destination,key,cert}:undefined,inspect:({body})=>({decision:body.toString().includes('SECRET')?'block':'allow'}),forward:({request,body,signal,maxResponseBytes})=>new Promise((resolve,reject)=>{
    const outgoing=https.request({host:'127.0.0.1',port,path:new URL(request.url).pathname,method:request.method,servername:'localhost',ca:cert,rejectUnauthorized:true,signal,headers:{host:config.destination,'content-length':body.length}},res=>{
      const chunks=[];let bytes=0;
      res.on('data',chunk=>{bytes+=chunk.length;if(bytes>maxResponseBytes){outgoing.destroy();reject(Error('response-bound'));return;}chunks.push(Buffer.from(chunk));});res.on('end',()=>resolve({statusCode:res.statusCode,headers:res.headers,body:Buffer.concat(chunks)}));res.on('error',reject);
    });outgoing.on('error',reject);outgoing.end(body);
  }),deadlineMs:1000,authMode:'bearer'});
});