'use strict';

const assert = require('assert');
const {
  PLAN_SCHEMA,
  validateProductionDataReplicaPlan,
  buildDefaultOffDataReplicaArtifacts
} = require('../services/productionDataReplicaPlan');

const now = new Date('2026-08-06T07:00:00.000Z');
const hex = (character, length = 64) => character.repeat(length);
const node = index => ({
  nodeKeyId: hex(String(index + 1)),
  networkFailureDomainCommitment: hex(String(index + 4)),
  controlPlaneFailureDomainCommitment: hex(String(index + 7)),
  storageRootCommitment: hex(String.fromCharCode(97 + index)),
  transportEndpointCommitment: hex(String.fromCharCode(100 + index)),
  endpointCertificateSpkiSha256: hex(String(index + 1)),
  privateTransportOnly: true,
  mutualTlsReady: true,
  diskEncryptionVerified: true,
  isolatedRestoreWorkspaceReady: true,
  productionAuthMaterialPresent: false,
  validatorRoleCoupled: false,
  mongoVersion: `8.2.${index}`,
  minimumFreeBytes: 100 * 1024 ** 3
});
const plan = {
  schemaVersion: PLAN_SCHEMA,
  issuedAt: now.toISOString(),
  expiresAt: new Date(now.getTime() + 12 * 60 * 60_000).toISOString(),
  replicaSetName: 'plaiRecoveryRs',
  activationAllowed: false,
  productionBackupReadAllowed: false,
  externalCiphertextTransferAllowed: false,
  applicationWriteSwitchAllowed: false,
  productionDnsMutationAllowed: false,
  validatorMutationAllowed: false,
  operatorSigningAllowed: false,
  encryptedBackupOnly: true,
  plaintextBackupAllowed: false,
  writeConcern: 'majority',
  readConcern: 'majority',
  tlsMode: 'requireTLS',
  authorizationRequired: true,
  maximumRpoSeconds: 300,
  maximumRtoSeconds: 1800,
  nodes: [0, 1, 2].map(node)
};

const validated = validateProductionDataReplicaPlan(plan, { now });
const artifacts = buildDefaultOffDataReplicaArtifacts(plan, { now });
assert.strictEqual(validated.nodes.length, 3);
assert.strictEqual(artifacts.activationAllowed, false);
assert.strictEqual(artifacts.replicaSetPolicy.writeConcern, 'majority');
assert.strictEqual(artifacts.rehearsalPolicy.productionBackupReadAllowed, false);
assert.strictEqual(artifacts.safety.plaintextBackupAllowed, false);
assert.throws(() => validateProductionDataReplicaPlan({ ...plan, activationAllowed: true }, { now }),
  /ENVELOPE_INVALID/);
assert.throws(() => validateProductionDataReplicaPlan({ ...plan, mongoUri: 'forbidden' }, { now }),
  /SECRET_FIELD_REJECTED/);
assert.throws(() => validateProductionDataReplicaPlan({
  ...plan,
  nodes: [node(0), node(1), { ...node(2), networkFailureDomainCommitment: node(1).networkFailureDomainCommitment }]
}, { now }), /THREE_INDEPENDENT_NODES_REQUIRED/);
assert.throws(() => validateProductionDataReplicaPlan({
  ...plan,
  nodes: [node(0), node(1), { ...node(2), privateTransportOnly: false }]
}, { now }), /NODE_INVALID/);
assert.throws(() => validateProductionDataReplicaPlan({ ...plan, plaintextBackupAllowed: true }, { now }),
  /ENVELOPE_INVALID/);

process.stdout.write(`${JSON.stringify({
  ok: true,
  check: 'production-data-replica-plan',
  replicaNodes: validated.nodes.length,
  independentNetworkFailureDomains: new Set(validated.nodes.map(row => row.networkFailureDomainCommitment)).size,
  independentControlPlaneFailureDomains: new Set(validated.nodes.map(row => row.controlPlaneFailureDomainCommitment)).size,
  encryptedBackupOnly: true,
  privateTransportAndMutualTlsRequired: true,
  diskEncryptionAndIsolatedRestoreRequired: true,
  majorityReadWritePolicyRequired: true,
  productionCredentialsAbsent: true,
  activationDefaultOff: true,
  productionChanged: false,
  databaseConnected: false,
  networkRequestsMade: false
}, null, 2)}\n`);
