import test from 'node:test';
import assert from 'node:assert/strict';
import {createRequire} from 'node:module';
import {generateKeyPairSync} from 'node:crypto';
import {defaultPolicy,signPolicy,verifyPolicy} from '../packages/core/policy.mjs';
const {assertPolicyAssignment}=createRequire(import.meta.url)('../apps/browser/policy-assignment.cjs');
test('signed effective policy cannot be reused for another enrolled device',()=>{
  const a='00000000-0000-4000-8000-000000000001',b='00000000-0000-4000-8000-000000000002';
  const keys=generateKeyPairSync('ed25519');
  const privateKey=keys.privateKey.export({type:'pkcs8',format:'pem'}),publicKey=keys.publicKey.export({type:'spki',format:'pem'});
  const p={...defaultPolicy(),assignment:{deviceId:a,groups:[]}};
  const verified=verifyPolicy(signPolicy(p,privateKey),publicKey);
  assert.equal(assertPolicyAssignment(verified,a),verified);
  assert.throws(()=>assertPolicyAssignment(verified,b),/device assignment rejected/);
  const legacy=verifyPolicy(signPolicy(defaultPolicy(),privateKey),publicKey);
  assert.equal(assertPolicyAssignment(legacy,a),legacy);
});