import assert from "node:assert/strict";
import test from "node:test";
import { mkdtemp, rm, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createZip, verifyZip } from "../src/zip";

test("ZIP creation verifies central directory, decompression, size, CRC and hash", async () => {
  const root = await mkdtemp(join(tmpdir(), "pom-zip-"));
  try {
    const source = join(root, "artifact.md");
    const archive = join(root, "delivery.zip");
    await writeFile(source, "# Verified artifact\n\nCanonical content.\n");
    await createZip(archive, [{ absolutePath: source, archivePath: "docs/artifact.md" }]);
    const result = await verifyZip(archive);
    assert.equal(result.members.length, 1);
    assert.equal(result.members[0].path, "docs/artifact.md");
    assert.match(result.members[0].crc32, /^[0-9a-f]{8}$/);
    assert.match(result.sha256, /^[0-9a-f]{64}$/);
    await assert.rejects(createZip(join(root, "bad.zip"), [
      { absolutePath: source, archivePath: "same.md" },
      { absolutePath: source, archivePath: "same.md" },
    ]), /Duplicate archive member/);
    await assert.rejects(createZip(join(root, "escape.zip"), [{ absolutePath: source, archivePath: "../escape.md" }]), /Unsafe archive member/);
  } finally {
    await rm(root, { recursive: true, force: true });
  }
});

test("malformed ZIP is rejected", async () => {
  const root = await mkdtemp(join(tmpdir(), "pom-bad-zip-"));
  try {
    const bad = join(root, "bad.zip");
    await writeFile(bad, Buffer.from("PK\\x03\\x04not-a-real-archive"));
    await assert.rejects(verifyZip(bad));
  } finally {
    await rm(root, { recursive: true, force: true });
  }
});