const test = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');
const os = require('node:os');
const crypto = require('node:crypto');
const { mapArch, parseChecksums, verifyFileSha256 } = require('../lib/verifier.js');

test('mapArch maps uname architecture to Trivy release arch', () => {
  assert.equal(mapArch('x86_64'), '64bit');
  assert.equal(mapArch('aarch64'), 'ARM64');
  assert.equal(mapArch('arm64'), 'ARM64');
  assert.throws(() => mapArch('mips'), /Unsupported architecture/);
});

test('parseChecksums parses sha256 checksum lockfile into filename map', () => {
  const content = `
    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  trivy_0.74.0_Linux-64bit.tar.gz
    a1b2c3d4e5f60000000000000000000000000000000000000000000000000000  trivy_0.74.0_Linux-ARM64.tar.gz
  `;

  const map = parseChecksums(content);
  assert.equal(map.get('trivy_0.74.0_Linux-64bit.tar.gz'), 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855');
  assert.equal(map.get('trivy_0.74.0_Linux-ARM64.tar.gz'), 'a1b2c3d4e5f60000000000000000000000000000000000000000000000000000');
  assert.equal(map.has('nonexistent'), false);
});

test('verifyFileSha256 verifies actual sha256 hash of a file', () => {
  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cve-test-'));
  const testFile = path.join(tmpDir, 'test.txt');
  const fileContent = 'hello world\n';
  fs.writeFileSync(testFile, fileContent);

  const expectedHash = crypto.createHash('sha256').update(fileContent).digest('hex');
  assert.equal(verifyFileSha256(testFile, expectedHash), true);
  assert.equal(verifyFileSha256(testFile, 'wronghash'), false);

  fs.rmSync(tmpDir, { recursive: true, force: true });
});