/**
 * Tests for Sigstore signing
 */
import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
import { signContent, isSigningAvailable, createUnsignedArtifact, verifySignature, generateSigningSummary, sha256, sha256Base64, } from "./signing.js";
describe("Sigstore Signing", () => {
    const originalEnv = process.env;
    beforeEach(() => {
        vi.resetModules();
        process.env = { ...originalEnv };
        // Clear any signing-related env vars
        delete process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
        delete process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
        delete process.env.SIGSTORE_ID_TOKEN;
        delete process.env.GITHUB_ACTIONS;
    });
    afterEach(() => {
        process.env = originalEnv;
    });
    describe("isSigningAvailable", () => {
        it("returns false when no token available", () => {
            expect(isSigningAvailable()).toBe(false);
        });
        it("returns false when skipSigning is true", () => {
            process.env.SIGSTORE_ID_TOKEN = "test-token";
            expect(isSigningAvailable({ skipSigning: true })).toBe(false);
        });
        it("returns true with SIGSTORE_ID_TOKEN", () => {
            process.env.SIGSTORE_ID_TOKEN = "test-token";
            expect(isSigningAvailable()).toBe(true);
        });
        it("returns true with GitHub Actions token", () => {
            process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = "ghs_token";
            expect(isSigningAvailable()).toBe(true);
        });
        it("returns true with provided identityToken", () => {
            expect(isSigningAvailable({ identityToken: "provided-token" })).toBe(true);
        });
    });
    describe("signContent", () => {
        it("returns unsigned artifact when signing skipped", async () => {
            const result = await signContent("test content", { skipSigning: true });
            expect(result.signed).toBe(false);
            expect(result.error).toBe("Signing skipped by configuration");
            expect(result.digest).toBe(sha256("test content"));
        });
        it("returns unsigned artifact when no token available", async () => {
            const result = await signContent("test content");
            expect(result.signed).toBe(false);
            expect(result.error).toContain("not available");
        });
        it("includes correct digest in result", async () => {
            const content = "test content for hashing";
            const result = await signContent(content, { skipSigning: true });
            expect(result.digest).toBe(sha256(content));
        });
        it("includes timestamp in result", async () => {
            const before = Date.now();
            const result = await signContent("test", { skipSigning: true });
            const after = Date.now();
            const signedTime = new Date(result.signedAt).getTime();
            expect(signedTime).toBeGreaterThanOrEqual(before);
            expect(signedTime).toBeLessThanOrEqual(after);
        });
    });
    describe("createUnsignedArtifact", () => {
        it("creates artifact with correct content", () => {
            const content = "test content";
            const artifact = createUnsignedArtifact(content);
            expect(artifact.content).toBe(content);
            expect(artifact.signed).toBe(false);
            expect(artifact.error).toBeDefined();
        });
        it("computes correct digest", () => {
            const content = "content for digest";
            const artifact = createUnsignedArtifact(content);
            expect(artifact.digest).toBe(sha256(content));
        });
        it("includes timestamp", () => {
            const artifact = createUnsignedArtifact("test");
            expect(artifact.signedAt).toBeDefined();
            expect(new Date(artifact.signedAt).getTime()).toBeLessThanOrEqual(Date.now());
        });
    });
    describe("verifySignature", () => {
        it("fails for unsigned artifacts", () => {
            const artifact = createUnsignedArtifact("test");
            const result = verifySignature(artifact);
            expect(result.valid).toBe(false);
            expect(result.errors).toContain("Artifact is not signed");
        });
        it("fails when no bundle present", () => {
            const artifact = {
                content: "test",
                digest: sha256("test"),
                signedAt: new Date().toISOString(),
                signed: true,
            };
            const result = verifySignature(artifact);
            expect(result.valid).toBe(false);
            expect(result.errors).toContain("No Sigstore bundle present");
        });
        it("fails when digest mismatched", () => {
            const artifact = {
                content: "test",
                digest: "wrong-digest",
                signedAt: new Date().toISOString(),
                signed: true,
                bundle: {
                    mediaType: "test",
                    verificationMaterial: {
                        tlogEntries: [
                            {
                                logIndex: "1",
                                logId: { keyId: "test" },
                                kindVersion: { kind: "test", version: "1" },
                                integratedTime: "123",
                                canonicalizedBody: "",
                            },
                        ],
                    },
                },
            };
            const result = verifySignature(artifact);
            expect(result.valid).toBe(false);
            expect(result.errors).toContain("Content digest mismatch");
        });
    });
    describe("generateSigningSummary", () => {
        it("includes signed status", () => {
            const artifact = createUnsignedArtifact("test");
            const summary = generateSigningSummary(artifact);
            expect(summary).toContain("Signed: No");
        });
        it("includes digest", () => {
            const artifact = createUnsignedArtifact("test");
            const summary = generateSigningSummary(artifact);
            expect(summary).toContain("Digest:");
            expect(summary).toContain("sha256:");
        });
        it("includes error when present", () => {
            const artifact = createUnsignedArtifact("test");
            const summary = generateSigningSummary(artifact);
            expect(summary).toContain("Error:");
        });
    });
    describe("sha256", () => {
        it("computes correct SHA-256 hex", () => {
            const hash = sha256("test");
            expect(hash).toBe("9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08");
        });
        it("returns 64-character hex string", () => {
            const hash = sha256("any content");
            expect(hash.length).toBe(64);
            expect(/^[a-f0-9]+$/.test(hash)).toBe(true);
        });
    });
    describe("sha256Base64", () => {
        it("computes correct SHA-256 base64", () => {
            const hash = sha256Base64("test");
            // Base64 of the SHA-256 of "test"
            expect(hash).toBe("n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=");
        });
        it("returns valid base64 string", () => {
            const hash = sha256Base64("any content");
            expect(/^[A-Za-z0-9+/]+=*$/.test(hash)).toBe(true);
        });
    });
});
//# sourceMappingURL=signing.test.js.map