import test from 'node:test';
import assert from 'node:assert/strict';
import {mkdtempSync,rmSync} from 'node:fs';
import {tmpdir} from 'node:os';
import {join} from 'node:path';
import {randomUUID} from 'node:crypto';
import {openStore,digest} from '../apps/server/store.mjs';
import {createApp} from '../apps/server/app.mjs';
import {toECS,toCEF} from '../packages/core/siem.mjs';
import transportAudit from '../packages/core/transport-facts.cjs';
const facts=phase=>({transportId:randomUUID(),protocol:'webtransport',phase,realm:'worker',sessionId:randomUUID(),connectionEstablished:phase==='established'});
test('native transport ingestion retains only strict matching lifecycle facts',async t=>{
 const dir=mkdtempSync(join(tmpdir(),'safetynet-transport-audit-')),store=openStore(dir),credential='synthetic-device-transport-audit-token';
 store.db.prepare('INSERT INTO devices(id,name,token_hash) VALUES(?,?,?)').run('device','Synthetic',digest(credential));
 const server=createApp(store,{publicUrl:'http://127.0.0.1',adminToken:'synthetic-administrator-token-123456789',secure:false}).listen(0,'127.0.0.1');await new Promise(r=>server.once('listening',r));
 t.after(async()=>{server.closeAllConnections();await new Promise(r=>server.close(r));store.db.close();assert.ok(dir.startsWith(join(tmpdir(),'safetynet-transport-audit-')));rmSync(dir,{recursive:true,force:true});});
 const send=body=>fetch(`http://127.0.0.1:${server.address().port}/api/device/events`,{method:'POST',headers:{authorization:`Bearer ${credential}`,'content-type':'application/json'},body:JSON.stringify({eventId:randomUUID(),policyVersion:1,...body})});
 for(const phase of ['created','established','closed']){const transport=facts(phase);assert.equal((await send({kind:`transport.${phase}`,host:'synthetic.example',transport})).status,200);const row=store.db.prepare('SELECT * FROM events WHERE kind=?').get(`transport.${phase}`);assert.deepEqual(JSON.parse(row.metadata).transport,transport);const ecs=toECS({...row,metadata:JSON.parse(row.metadata)});assert.deepEqual(ecs.event.type,['info']);assert.equal(ecs.event.outcome,'unknown');assert.equal(ecs.destination.domain,'synthetic.example');}
 for(const body of [{kind:'transport.created'},{kind:'transport.created',transport:facts('established')},{kind:'transport.created',transport:{...facts('created'),connectionEstablished:true}},{kind:'transport.closed',transport:{...facts('closed'),url:'PRIVATE_BODY'}},{kind:'transport.created',transport:{...facts('created'),transportId:'raw-cdp-id'}},{kind:'clipboard.copy',transport:facts('created')},{kind:'transport.closed',transport:facts('closed'),request:{bytes:1,detectedType:'text'}},{kind:'transport.monitor-unavailable',ruleId:'PRIVATE_BODY'},{kind:'transport.monitor-unavailable',ruleId:'transport-observer-unavailable',transport:facts('closed')}])assert.equal((await send(body)).status,400);
 for(const host of ['synthetic.example','127.0.0.1','[2001:db8::1]'])assert.equal((await send({kind:'transport.created',host,transport:facts('created')})).status,200);
 for(const host of [undefined,'https://synthetic.example/private?secret=1','synthetic.example\r\nPRIVATE_BODY','user:password@synthetic.example','synthetic.example:443','synthetic.example/private','synthetic.example?secret=1','Synthetic.Example','127.1','[2001:0db8::1]'])assert.equal((await send({kind:'transport.created',host,transport:facts('created')})).status,400);
 assert.equal((await send({kind:'transport.monitor-unavailable',host:'synthetic.example',ruleId:'transport-observer-unavailable'})).status,400);
 for(const ruleId of transportAudit.TRANSPORT_MONITOR_REASONS)assert.equal((await send({kind:'transport.monitor-unavailable',ruleId})).status,200);
 assert.equal(store.auditIntegrity.verify().valid,true);
});
test('SIEM native lifecycle is informational and rejects injected or cross-kind facts',()=>{
 const transport=facts('established'),event={id:1,time:new Date().toISOString(),kind:'transport.established',metadata:{host:'synthetic.example',transport,decision:'block',traceId:'1'.repeat(32)},audit:{hash:'2'.repeat(64),sequence:1}};
 const ecs=toECS(event),cef=toCEF(event);assert.equal(ecs.event.outcome,'unknown');assert.deepEqual(ecs.event.type,['info']);assert.equal(ecs.safetynet.decision,null);assert.equal(ecs.safetynet.transport.connection_established,true);assert.equal(ecs.trace.id,'1'.repeat(32));assert.match(cef,/TransportPhase cs3=established/);assert.match(cef,/\|3\|/);assert.match(cef,/AuditRecordHash/);assert.ok(cef.includes('cs1Label=TransportId cs1='+transport.transportId));assert.equal(cef.includes('flexString3'),false);
 for(const bad of [{...transport,url:'PRIVATE_BODY'},{...transport,phase:'closed'},{...transport,sessionId:'PRIVATE_BODY'}]){event.metadata.transport=bad;assert.equal(toECS(event).safetynet.transport,undefined);assert.equal(toCEF(event).includes('PRIVATE_BODY'),false);}
 event.metadata.transport=transport;event.metadata.host='https://user:PRIVATE_BODY@synthetic.example/private';assert.equal(toECS(event).destination,undefined);assert.equal(toCEF(event).includes('PRIVATE_BODY'),false);event.metadata.host='synthetic.example';event.kind='upload.authorized';assert.equal(toECS(event).safetynet.transport,undefined);assert.equal(toCEF(event).includes('TransportPhase'),false);
});