import { describe, expect, it } from 'vitest';

import {

  decryptGatewayPayload,

  encryptGatewayPayload,

  issueGatewayGrant,

  issueSessionGrant,

  verifyGatewayGrant,

  verifySessionGrant,

} from '../packages/persistence/src/relay.js';

describe('hosted runtime and session cryptography', () => {

  const secret = 'a-test-secret-that-is-at-least-thirty-two-bytes';

  it('encrypts message bodies and detects tampering', () => {

    const encrypted = encryptGatewayPayload(secret, { message: 'private task' });

    expect(JSON.stringify(encrypted)).not.toContain('private task');

    expect(decryptGatewayPayload(secret, encrypted)).toEqual({ message: 'private task' });

    expect(() =>

      decryptGatewayPayload(secret, { ...encrypted, ciphertext: `${encrypted.ciphertext}x` }),

    ).toThrow();

  });

  it('issues scoped, expiring delivery grants', () => {

    const token = issueGatewayGrant(secret, {

      interactionId: 'interaction-1',

      senderAgentId: 'agent-a',

      recipientAgentId: 'agent-b',

      expiresAt: Date.now() + 60_000,

    });

    expect(verifyGatewayGrant(secret, token).recipientAgentId).toBe('agent-b');

    expect(() => verifyGatewayGrant(secret, `${token}x`)).toThrow('Invalid gateway token');

  });

  it('issues platform-signed live-session credentials', () => {

    const token = issueSessionGrant(secret, {

      interactionId: 'interaction-1',

      senderAgentId: 'agent-a',

      recipientAgentId: 'agent-b',

      expiresAt: Date.now() + 60_000,

    });

    expect(verifySessionGrant(secret, token)).toMatchObject({

      interactionId: 'interaction-1',

      senderAgentId: 'agent-a',

      recipientAgentId: 'agent-b',

    });

    expect(() => verifySessionGrant(secret, `${token}x`)).toThrow(

      'Invalid live-session credential',

    );

  });

});