package emission

import (
	"bytes"
	"crypto/ed25519"
	"encoding/json"
	"github.com/netkingdom/access-engine/internal/sign"
	"github.com/netkingdom/access-engine/pkg/api"
	"testing"
)

func TestOutboxReplayPreservesProducerNumericSignature(t *testing.T) {
	folder := t.TempDir()
	outbox, err := Open(folder, "synthetic-source")
	if err != nil {
		t.Fatal(err)
	}
	key := ed25519.NewKeyFromSeed(bytes.Repeat([]byte{21}, 32))
	envelope := api.DecisionEnvelope{ID: "decision:synthetic-numeric", Effect: api.DecisionEffectDeny, Resource: api.ResourceRef{ID: "synthetic", Type: "tenant", System: "tenant-engine"}}
	envelope.Binding = &api.DecisionBinding{Context: map[string]any{"float": json.Number("1.0"), "negative_zero": json.Number("-0.0"), "integer": json.Number("9007199254740993"), "exponent": json.Number("1e-07")}}
	if err := sign.Sign(&envelope, key, "synthetic-numeric"); err != nil {
		t.Fatal(err)
	}
	if err := outbox.Append(envelope); err != nil {
		t.Fatal(err)
	}
	outbox.Close()
	outbox, err = Open(folder, "synthetic-source")
	if err != nil {
		t.Fatal(err)
	}
	defer outbox.Close()
	entry, _, err := outbox.nextEntry()
	if err != nil {
		t.Fatal(err)
	}
	wire, err := json.Marshal(entry.Event.Data)
	if err != nil {
		t.Fatal(err)
	}
	replayed, err := sign.DecodeEnvelope(wire)
	if err != nil {
		t.Fatal(err)
	}
	if err := sign.Verify(replayed, map[string]ed25519.PublicKey{"synthetic-numeric": key.Public().(ed25519.PublicKey)}); err != nil {
		t.Fatal(err)
	}
	before, _ := sign.CanonicalBytes(envelope)
	after, _ := sign.CanonicalBytes(replayed)
	if !bytes.Equal(before, after) {
		t.Fatal("replayed signed bytes changed")
	}
}