import assert from 'node:assert/strict';
import {spawnSync} from 'node:child_process';
import {cpSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync} from 'node:fs';
import {join, relative, resolve} from 'node:path';
import {hashAt} from './boot-contract-report.mjs';

assert.equal(process.argv.length, 3,
  'usage: node scripts/os-acceptance/handles-rights.mjs <K1310-matrix-report.json>');
const root = process.cwd();
const predecessorPath = relative(root, resolve(process.argv[2]));
assert.match(predecessorPath,
  /^reports\/os-implementation\/K1310-generation-el0-matrix-check-[A-Za-z0-9_-]+\/report\.json$/);
const predecessor = JSON.parse(readFileSync(join(root, predecessorPath), 'utf8'));
assert.equal(predecessor.status, 'K1310_GENERATION_EL0_DEVELOPMENT_MATRIX_VALIDATED');
assert.equal(predecessor.guestAccepted, true);
const directory = mkdtempSync(join(root,
  'reports/os-implementation/K1315-handles-rights-local-preflight-'));
const workspace = join(directory, 'workspace');
const source = 'os-handles/rights/handles.rs';
const tests = 'kernel/tests/os/handles_rights.rs';
mkdirSync(join(workspace, 'os-handles/rights'), {recursive: true});
mkdirSync(join(workspace, 'kernel/tests/os'), {recursive: true});
cpSync(join(root, source), join(workspace, source));
cpSync(join(root, tests), join(workspace, tests));
const artifact = path => ({path: relative(root, path),
  sha256: hashAt(root, relative(root, path))});
const run = (name, command, args) => {
  const answer = spawnSync(command, args, {cwd: root, encoding: 'utf8',
    timeout: 600000, maxBuffer: 64 * 1024 * 1024});
  const log = join(directory, name + '.log');
  writeFileSync(log, (answer.stdout ?? '') + (answer.stderr ?? ''));
  return {exitCode: answer.status, error: answer.error?.message ?? null,
    log: artifact(log)};
};
const binary = join(directory, 'handles-rights-test');
const compile = run('host-compile', 'rustc', ['--edition=2024', '--test',
  join(workspace, tests), '-o', binary]);
assert.equal(compile.exitCode, 0,
  readFileSync(join(root, compile.log.path), 'utf8'));
const green = run('host-tests', binary, ['--nocapture']);
const greenText = readFileSync(join(root, green.log.path), 'utf8');
assert.equal(green.exitCode, 0, greenText);
for (const name of ['os_handles_rights_positive',
  'os_handles_rights_negative', 'kind_rights_and_generation_remain_separate'])
  assert.match(greenText, new RegExp(`test ${name} \\.\\.\\. ok`));
assert.match(greenText, /3 passed; 0 failed/);

const wrapper = join(workspace, 'os-handles/rights/no_std_check.rs');
writeFileSync(wrapper, '#![no_std]\n#[path = "handles.rs"]\nmod handles;\n');
const target = run('aarch64-no-std-check', 'rustc', ['--edition=2024',
  '--crate-type=lib', '--target=aarch64-unknown-none', '--emit=metadata',
  wrapper, '-o', join(directory, 'handles-rights-aarch64.rmeta')]);
assert.equal(target.exitCode, 0,
  readFileSync(join(root, target.log.path), 'utf8'));

const copiedSource = join(workspace, source);
const original = readFileSync(copiedSource, 'utf8');
const guard = 'if !requested.is_nonempty_subset_of(original.rights) {';
assert.equal(original.split(guard).length, 2);
writeFileSync(copiedSource, original.replace(guard,
  'if false {'));
const mutantCompile = run('rights-widen-mutant-compile', 'rustc',
  ['--edition=2024', '--test', join(workspace, tests),
    '-o', join(directory, 'handles-rights-mutant-test')]);
assert.equal(mutantCompile.exitCode, 0,
  readFileSync(join(root, mutantCompile.log.path), 'utf8'));
const red = run('rights-widen-mutant',
  join(directory, 'handles-rights-mutant-test'),
  ['os_handles_rights_negative', '--exact', '--nocapture']);
const redText = readFileSync(join(root, red.log.path), 'utf8');
assert.notEqual(red.exitCode, 0);
assert.match(redText, /os_handles_rights_negative \.\.\. FAILED/);
writeFileSync(copiedSource, original);

const report = {schema: 'turkos-k1315-handles-rights-local-preflight/v1',
  status: 'K1311_K1314_LOCAL_VALIDATED',
  guestAccepted: false, productAccepted: false,
  predecessor: artifact(join(root, predecessorPath)),
  sources: {contract: artifact(join(root,
    'os-handles/rights/CONTRACT.md')),
  handles: artifact(join(root, source)), tests: artifact(join(root, tests)),
  harness: artifact(join(root, 'scripts/os-acceptance/handles-rights.mjs'))},
  tests: {compile, green, target, mutantCompile, red,
    greenCount: 3, mutationRejected: true},
  scope: 'Local rights-attenuating kernel handle model: RW File to RO copy, RO write EACCES, RO-to-RW duplicate denial without mutation, preserved original and copy ownership, typed and generation separation, AArch64 no_std metadata build and a red widening mutant. Native EL0 six-profile integration remains K1315.'};
const reportPath = join(directory, 'report.json');
writeFileSync(reportPath, JSON.stringify(report, null, 2) + '\n');
console.log(JSON.stringify({status: report.status,
  report: relative(root, reportPath), green: report.tests.greenCount}));