// kcp parity for bidder-tangled-vouch: crates/policy/vectors.mjs (cases.go TrustCases, scope and full).
import assert from "node:assert/strict";
import { test } from "node:test";

import { hostCall } from "../../../atlibs/javascript/src/server/index.js";
import { loadPolicy, trustSuite } from "../../crates/policy/vectors.mjs";

await trustSuite("policy-bidder-tangled-vouch", "bidder-tangled-vouch", "tangled-vouch")();

// Live (ATLIBS_LIVE=1, public reads, no login): what hat-7 and hat-9 decide for bobvmbuilder's RFPs.
// The bidders run the same scope check (kcp market/bidder/adapters.go: SelfDid = the bidder,
// CounterpartyDid = the RFP's requester); both repos carry a vouch for bob, so both allow.

const BOB = "did:plc:ocnuqjlzgohypj3zoznermms";
const BIDDERS = { "hat-7": "did:plc:7q5lnitxv4meizdon5fmhzrq", "hat-9": "did:plc:4vcig7s43z3nyqrnepmcfzqt" };
test("live: hat-7 and hat-9 admit bob under bidder-tangled-vouch, a stranger is denied", { skip: !process.env.ATLIBS_LIVE }, async () => {
	const mod = await loadPolicy("policy-bidder-tangled-vouch");
	const call = hostCall({ ctx: { http: { fetch } } });
	const respond = async (request) => {
		try {
			return { ok: true, output: await call(request.nsid, request) };
		} catch (error) {
			return { ok: false, error: error.message };
		}
	};
	for (const [node, bidder] of Object.entries(BIDDERS)) {
		const reads = [];
		const ran = await mod.handle("evaluate", { selfDid: bidder, counterpartyDid: BOB, mode: "scope" }, { respond: (r) => (reads.push(`${r.params.repo}/${r.params.collection}/${r.params.rkey}`), respond(r)) });
		console.log(node, JSON.stringify(ran.result), `${reads.length} reads`);
		assert.deepEqual(ran.result, { allow: true, violations: [] }, node);
		const stranger = await mod.handle("evaluate", { selfDid: bidder, counterpartyDid: "did:plc:policyteststranger", mode: "scope" }, { respond });
		assert.equal(stranger.result.allow, false, `${node} stranger`);
	}
});