import test from 'node:test';
import assert from 'node:assert/strict';
import {generateKeyPairSync} from 'node:crypto';
import {createRequire} from 'node:module';
import {defaultPolicy,PolicySchema,signPolicy,verifyPolicy} from '../packages/core/policy.mjs';
import {AgentGrantSchema} from '../packages/core/security.mjs';
const {startAgentControl}=createRequire(import.meta.url)('../apps/browser/agent-control.cjs');
const {requestAgent}=createRequire(import.meta.url)('../apps/browser/agent-transport-client.cjs');

test('worker gate defaults off and survives signed policy verification',()=>{
 const p=defaultPolicy();assert.equal(p.browser.allowAgentBackgroundWorkers,false);
 delete p.browser.allowAgentBackgroundWorkers;
 assert.equal(PolicySchema.parse(p).browser.allowAgentBackgroundWorkers,false);
 p.browser.allowAgentBackgroundWorkers=true;
 const {privateKey,publicKey}=generateKeyPairSync('ed25519',{privateKeyEncoding:{type:'pkcs8',format:'pem'},publicKeyEncoding:{type:'spki',format:'pem'}});
 assert.equal(verifyPolicy(signPolicy(p,privateKey),publicKey).browser.allowAgentBackgroundWorkers,true);
 assert.equal(PolicySchema.safeParse({...p,browser:{...p.browser,allowAgentBackgroundWorkers:'true'}}).success,false);
});

test('background permission cannot become an executable agent RPC',async t=>{
 const grant=AgentGrantSchema.parse({id:'worker-agent',name:'Worker',enabled:true,expiresAt:'2099-12-31T23:59:59Z',scopes:['network:background'],allowedHosts:['company.example'],generation:1});
 assert.deepEqual(grant.scopes,['network:background']);let executed=0;
 const api=await startAgentControl({authorize:async()=>({allowed:true,role:'agent',scopes:['network:background']}),actions:{'network:background':async()=>{executed++;}},audit:async()=>{}});
 t.after(()=>api.close());
 assert.equal((await requestAgent(api,{action:'network:background',args:{}})).status,400);
 assert.equal(executed,0);
});