import { describe, expect, it } from 'vitest'
import { openDb, type DB } from '../src/db'
import { seedIfEmpty } from '../src/seed'
import { commitBill, verifyAuditChain, writeAudit } from '../src/repos'

/**
 * H2 (red-team): the audit log is a per-tenant hash chain. Each row's entry_hash covers the
 * previous entry's hash plus its own content, so any out-of-band UPDATE/DELETE/INSERT to the
 * table breaks the chain, which verifyAuditChain / GET /api/audit/verify recomputes. This is
 * tamper-EVIDENCE, not prevention (the SQLite file is still writable — sealing it is H3). These
 * tests build a chain, prove it verifies, then tamper directly via better-sqlite3 and re-verify.
 */
function fresh(): DB {
  const db = openDb(':memory:')
  seedIfEmpty(db)
  return db
}
const itemId = (db: DB, code: string): string =>
  (db.prepare("SELECT id FROM item WHERE tenant_id='t1' AND code=?").get(code) as { id: string }).id
interface AuditRow { id: string; prev_hash: string | null; entry_hash: string | null }
const auditRows = (db: DB): AuditRow[] =>
  db.prepare("SELECT id, prev_hash, entry_hash FROM audit_log WHERE tenant_id='t1' ORDER BY rowid").all() as AuditRow[]

describe('H2 — tamper-evident audit hash chain', () => {
  it('a genuine sequence verifies, and each row links to the previous (genesis = "")', () => {
    const db = fresh()
    // a real commit writes a BILL_COMMIT row inside its transaction...
    commitBill(db, {
      tenantId: 't1', storeId: 's1', counterId: 'c2', cashierId: 'u1', shiftId: 'sh1',
      businessDate: '2026-07-10',
      lines: [{ itemId: itemId(db, '108'), name: 'Carry Bag', hsn: '3923', qty: 1, unitCode: 'PCS', unitPricePaise: 500, priceIncludesTax: true, taxClassCode: 'GST18' }],
      payments: [{ mode: 'CASH', amountPaise: 500 }], clientPayablePaise: 500,
    })
    // ...and a couple of plain rows chain on after it
    writeAudit(db, 't1', 'u1', 'TEST_A', 'x', 'x1')
    writeAudit(db, 't1', 'u3', 'TEST_B', 'x', 'x2', { a: 1 }, { b: 2 })
    const rows = auditRows(db)
    expect(rows.length).toBeGreaterThanOrEqual(3)
    expect(rows[0]!.prev_hash).toBe('') // genesis
    for (let i = 1; i < rows.length; i++) expect(rows[i]!.prev_hash).toBe(rows[i - 1]!.entry_hash)
    expect(verifyAuditChain(db, 't1')).toEqual({ ok: true })
  })

  it('detects an out-of-band UPDATE, pointing at the changed row', () => {
    const db = fresh()
    writeAudit(db, 't1', 'u1', 'A', 'e', '1')
    writeAudit(db, 't1', 'u1', 'B', 'e', '2')
    writeAudit(db, 't1', 'u1', 'C', 'e', '3')
    expect(verifyAuditChain(db, 't1').ok).toBe(true)
    const target = auditRows(db)[1]!.id
    db.prepare('UPDATE audit_log SET after_json=? WHERE id=?').run(JSON.stringify({ forged: true }), target)
    const res = verifyAuditChain(db, 't1')
    expect(res.ok).toBe(false)
    expect(res.brokenAtId).toBe(target)
  })

  it('detects an out-of-band DELETE, pointing at the row after the gap', () => {
    const db = fresh()
    writeAudit(db, 't1', 'u1', 'A', 'e', '1')
    writeAudit(db, 't1', 'u1', 'B', 'e', '2')
    writeAudit(db, 't1', 'u1', 'C', 'e', '3')
    const rows = auditRows(db)
    db.prepare('DELETE FROM audit_log WHERE id=?').run(rows[1]!.id) // remove the middle row
    const res = verifyAuditChain(db, 't1')
    expect(res.ok).toBe(false)
    expect(res.brokenAtId).toBe(rows[2]!.id) // its prev_hash no longer matches the running chain
  })

  it('detects a forged INSERT appended out-of-band', () => {
    const db = fresh()
    writeAudit(db, 't1', 'u1', 'A', 'e', '1')
    db.prepare(
      `INSERT INTO audit_log (id, tenant_id, at_wall, user_id, action, entity, entity_id, before_json, after_json, prev_hash, entry_hash)
       VALUES ('forged-id', 't1', ?, 'attacker', 'FORGED', 'e', '9', NULL, ?, 'deadbeef', 'cafebabe')`,
    ).run(new Date().toISOString(), JSON.stringify({ evil: true }))
    const res = verifyAuditChain(db, 't1')
    expect(res.ok).toBe(false)
    expect(res.brokenAtId).toBe('forged-id')
  })

  it('scopes per tenant — one tenant’s tamper does not fail another tenant’s chain', () => {
    const db = fresh()
    db.prepare("INSERT INTO tenant (id, code, name, gst_scheme, fy_start_month, created_at) VALUES ('t2','T2','Other','regular',4,?)").run(new Date().toISOString())
    writeAudit(db, 't1', 'u1', 'A', 'e', '1')
    writeAudit(db, 't2', 'z9', 'A', 'e', '1')
    writeAudit(db, 't2', 'z9', 'B', 'e', '2')
    // tamper only t1
    db.prepare('UPDATE audit_log SET action=? WHERE tenant_id=?').run('HACKED', 't1')
    expect(verifyAuditChain(db, 't1').ok).toBe(false)
    expect(verifyAuditChain(db, 't2')).toEqual({ ok: true })
  })
})