import { describe, expect, it, beforeEach, afterEach, vi } from 'vitest';
const getActuateConfig = vi.fn();
vi.mock('../../config/runtime.js', () => ({ getActuateConfig: () => getActuateConfig() }));
const { fieldShouldEncrypt, encryptSubmissionData, decryptSubmissionData } = await import('../../forms/encryption.js');
// Valid 64-hex (32 byte) AES-256 key.
const KEY = 'a'.repeat(64);
function field(over = {}) {
    return {
        id: over.key ?? 'fld',
        key: over.key ?? 'fld',
        label: over.label ?? 'Field',
        type: 'text',
        required: false,
        sortOrder: 0,
        ...over,
    };
}
describe('fieldShouldEncrypt', () => {
    beforeEach(() => getActuateConfig.mockReset());
    it('encrypts fields explicitly flagged encrypted regardless of config', () => {
        getActuateConfig.mockReturnValue({ forms: { encryptSensitiveFields: false } });
        expect(fieldShouldEncrypt(field({ encrypted: true }))).toBe(true);
    });
    it('encrypts high-PII fields only when encryptSensitiveFields is on', () => {
        getActuateConfig.mockReturnValue({ forms: { encryptSensitiveFields: true } });
        expect(fieldShouldEncrypt(field({ piiClassification: 'high' }))).toBe(true);
        expect(fieldShouldEncrypt(field({ piiClassification: 'low' }))).toBe(false);
        getActuateConfig.mockReturnValue({ forms: { encryptSensitiveFields: false } });
        expect(fieldShouldEncrypt(field({ piiClassification: 'high' }))).toBe(false);
    });
    it('does not encrypt ordinary fields', () => {
        getActuateConfig.mockReturnValue({ forms: {} });
        expect(fieldShouldEncrypt(field({ key: 'name' }))).toBe(false);
    });
});
describe('encrypt/decrypt submission data', () => {
    const original = process.env.CMS_ENCRYPTION_KEY;
    beforeEach(() => {
        getActuateConfig.mockReturnValue({ forms: { encryptSensitiveFields: true } });
        process.env.CMS_ENCRYPTION_KEY = KEY;
    });
    afterEach(() => {
        if (original === undefined)
            delete process.env.CMS_ENCRYPTION_KEY;
        else
            process.env.CMS_ENCRYPTION_KEY = original;
    });
    it('encrypts only the sensitive fields and round-trips back to plaintext', async () => {
        const fields = [
            field({ key: 'name' }),
            field({ key: 'ssn', encrypted: true }),
            field({ key: 'notes', piiClassification: 'high' }),
        ];
        const data = { name: 'Ada', ssn: '123-45-6789', notes: 'private', extra: 'kept' };
        const { data: encrypted, encryptedKeys } = await encryptSubmissionData(fields, data);
        expect(encrypted.name).toBe('Ada');
        expect(encrypted.extra).toBe('kept');
        expect(String(encrypted.ssn)).toMatch(/^enc:v1:/);
        expect(String(encrypted.notes)).toMatch(/^enc:v1:/);
        expect(encryptedKeys.sort()).toEqual(['notes', 'ssn']);
        const decrypted = await decryptSubmissionData(encrypted);
        expect(decrypted).toMatchObject({ name: 'Ada', ssn: '123-45-6789', notes: 'private' });
    });
    it('encrypts string elements inside array values', async () => {
        const fields = [field({ key: 'tags', type: 'checkbox', encrypted: true })];
        const { data } = await encryptSubmissionData(fields, { tags: ['a', 'b'] });
        expect(data.tags.every((v) => v.startsWith('enc:v1:'))).toBe(true);
        const decrypted = await decryptSubmissionData(data);
        expect(decrypted.tags).toEqual(['a', 'b']);
    });
    it('passes plaintext rows through decryption unchanged (legacy/dev rows)', async () => {
        const data = { name: 'Ada', email: 'ada@example.com' };
        const decrypted = await decryptSubmissionData(data);
        expect(decrypted).toEqual(data);
    });
    it('returns input unchanged when no fields are sensitive', async () => {
        getActuateConfig.mockReturnValue({ forms: {} });
        const data = { name: 'Ada' };
        const { data: out, encryptedKeys } = await encryptSubmissionData([field({ key: 'name' })], data);
        expect(out).toBe(data);
        expect(encryptedKeys).toEqual([]);
    });
});
//# sourceMappingURL=encryption.test.js.map