import { describe, expect, test } from 'bun:test';
import {
  WELL_KNOWN_CAPABILITIES,
  getSupportedCapabilities,
  getWellKnownCapability,
  isWellKnown,
  validateZoneRequirement,
} from './well-known';

describe('Well-Known Capabilities Registry', () => {
  describe('WELL_KNOWN_CAPABILITIES', () => {
    test('should have public_web capability', () => {
      expect(WELL_KNOWN_CAPABILITIES.public_web).toBeDefined();
      expect(WELL_KNOWN_CAPABILITIES.public_web.canonical_hostname).toBe('www');
      expect(WELL_KNOWN_CAPABILITIES.public_web.required_zone).toBe('dmz');
      expect(WELL_KNOWN_CAPABILITIES.public_web.zone_enforced).toBe(true);
    });

    test('should have dns_registrar capability', () => {
      expect(WELL_KNOWN_CAPABILITIES.dns_registrar).toBeDefined();
      expect(WELL_KNOWN_CAPABILITIES.dns_registrar.canonical_hostname).toBe('dns-reg');
      expect(WELL_KNOWN_CAPABILITIES.dns_registrar.required_zone).toBe('dmz');
      expect(WELL_KNOWN_CAPABILITIES.dns_registrar.zone_enforced).toBe(false);
    });

    test('should have dns_internal capability', () => {
      expect(WELL_KNOWN_CAPABILITIES.dns_internal).toBeDefined();
      expect(WELL_KNOWN_CAPABILITIES.dns_internal.canonical_hostname).toBe('dns-int');
      // ISS-0156: the resolver moved to a protected zone (dmz) so it can see
      // protected-zone query sources for split-horizon views.
      expect(WELL_KNOWN_CAPABILITIES.dns_internal.required_zone).toBe('dmz');
      expect(WELL_KNOWN_CAPABILITIES.dns_internal.zone_enforced).toBe(true);
    });

    test('should have auth capability', () => {
      expect(WELL_KNOWN_CAPABILITIES.auth).toBeDefined();
      expect(WELL_KNOWN_CAPABILITIES.auth.canonical_hostname).toBe('auth');
      expect(WELL_KNOWN_CAPABILITIES.auth.required_zone).toBe('secure');
      expect(WELL_KNOWN_CAPABILITIES.auth.zone_enforced).toBe(true);
    });

    test('should have database capability', () => {
      expect(WELL_KNOWN_CAPABILITIES.database).toBeDefined();
      expect(WELL_KNOWN_CAPABILITIES.database.canonical_hostname).toBe('db');
      expect(WELL_KNOWN_CAPABILITIES.database.required_zone).toBe('secure');
      expect(WELL_KNOWN_CAPABILITIES.database.zone_enforced).toBe(true);
    });

    test('should have dhcp_server capability', () => {
      expect(WELL_KNOWN_CAPABILITIES.dhcp_server).toBeDefined();
      expect(WELL_KNOWN_CAPABILITIES.dhcp_server.canonical_hostname).toBe('dhcp');
      expect(WELL_KNOWN_CAPABILITIES.dhcp_server.required_zone).toBe('internal');
      expect(WELL_KNOWN_CAPABILITIES.dhcp_server.zone_enforced).toBe(false);
    });

    test('all capabilities should have required fields', () => {
      for (const [name, capability] of Object.entries(WELL_KNOWN_CAPABILITIES)) {
        expect(capability.canonical_hostname, `${name} missing canonical_hostname`).toBeDefined();
        expect(capability.required_zone, `${name} missing required_zone`).toBeDefined();
        expect(capability.zone_enforced, `${name} missing zone_enforced`).toBeDefined();
        expect(capability.data_schema, `${name} missing data_schema`).toBeDefined();
      }
    });
  });

  describe('isWellKnown', () => {
    test('should return true for well-known capabilities', () => {
      expect(isWellKnown('public_web')).toBe(true);
      expect(isWellKnown('dns_registrar')).toBe(true);
      expect(isWellKnown('dns_internal')).toBe(true);
      expect(isWellKnown('auth')).toBe(true);
      expect(isWellKnown('database')).toBe(true);
      expect(isWellKnown('dhcp_server')).toBe(true);
    });

    test('should return false for unknown capabilities', () => {
      expect(isWellKnown('unknown_capability')).toBe(false);
      expect(isWellKnown('custom_service')).toBe(false);
      expect(isWellKnown('')).toBe(false);
    });
  });

  describe('getWellKnownCapability', () => {
    test('should return capability for well-known name', () => {
      const capability = getWellKnownCapability('public_web');

      expect(capability.canonical_hostname).toBe('www');
      expect(capability.required_zone).toBe('dmz');
    });

    test('should throw error for unknown capability', () => {
      expect(() => getWellKnownCapability('unknown')).toThrow('Unknown capability: unknown');
      expect(() => getWellKnownCapability('unknown')).toThrow(
        'Supported capabilities: public_web, dns_registrar, dns_internal, auth, database, dhcp_server',
      );
    });
  });

  describe('getSupportedCapabilities', () => {
    test('should return all capability names', () => {
      const capabilities = getSupportedCapabilities();

      expect(capabilities).toContain('public_web');
      expect(capabilities).toContain('dns_registrar');
      expect(capabilities).toContain('dns_internal');
      expect(capabilities).toContain('auth');
      expect(capabilities).toContain('database');
      expect(capabilities).toContain('dhcp_server');
      expect(capabilities.length).toBe(6);
    });
  });

  describe('validateZoneRequirement', () => {
    test('should validate correct zone for public_web', () => {
      const result = validateZoneRequirement('public_web', 'dmz');

      expect(result.valid).toBe(true);
      expect(result.error).toBeUndefined();
    });

    test('should reject wrong zone for public_web', () => {
      const result = validateZoneRequirement('public_web', 'app');

      expect(result.valid).toBe(false);
      expect(result.required_zone).toBe('dmz');
      expect(result.error).toContain("Capability 'public_web' requires zone='dmz'");
      expect(result.error).toContain("Module specifies zone='app'");
    });

    test('should validate correct zone for auth', () => {
      const result = validateZoneRequirement('auth', 'secure');

      expect(result.valid).toBe(true);
    });

    test('should reject wrong zone for auth', () => {
      const result = validateZoneRequirement('auth', 'dmz');

      expect(result.valid).toBe(false);
      expect(result.required_zone).toBe('secure');
      expect(result.error).toContain("Capability 'auth' requires zone='secure'");
    });

    test('should validate correct zone for dns_internal (dmz — ISS-0156)', () => {
      expect(validateZoneRequirement('dns_internal', 'dmz').valid).toBe(true);
      // The old `internal` placement is now rejected — the resolver must be in a
      // protected zone to see protected-zone query sources for split-horizon.
      expect(validateZoneRequirement('dns_internal', 'internal').valid).toBe(false);
    });

    test('should allow dns_registrar in any zone (zone_enforced=false)', () => {
      const result = validateZoneRequirement('dns_registrar', 'dmz');
      expect(result.valid).toBe(true);

      const result2 = validateZoneRequirement('dns_registrar', 'app');
      expect(result2.valid).toBe(true);
    });

    test('should reject unknown capability', () => {
      const result = validateZoneRequirement('unknown_capability', 'dmz');

      expect(result.valid).toBe(false);
      expect(result.error).toContain('Unknown capability: unknown_capability');
      expect(result.error).toContain('Supported capabilities');
    });
  });

  describe('Security zone requirements', () => {
    test('home lab public-facing services must be in DMZ', () => {
      expect(WELL_KNOWN_CAPABILITIES.public_web.required_zone).toBe('dmz');
    });

    test('authentication services must be in secure zone', () => {
      expect(WELL_KNOWN_CAPABILITIES.auth.required_zone).toBe('secure');
      expect(WELL_KNOWN_CAPABILITIES.database.required_zone).toBe('secure');
    });

    test('the internal DNS resolver lives in the dmz (ISS-0156)', () => {
      // Moved out of `internal`: the resolver must see protected-zone query
      // sources for source-based split-horizon views (openspec/specs/internal-dns-zone-views/spec.md).
      expect(WELL_KNOWN_CAPABILITIES.dns_internal.required_zone).toBe('dmz');
    });
  });
});