import { describe, expect, it } from 'vitest';
import { createHash } from 'node:crypto';
import { Sha1Stream, computeSha1StateV } from '@snowluma/protocol/highway/sha1-stream';

// SHA1 标准填充：msg + 0x80 + 0x00...(k 个) + 8 字节大端 bit 长度，总长为 64 倍数。
// 用于把任意输入变成「已 finalize」的完整 block 序列——这样 Sha1Stream 对它逐 block
// transform 后取大端 state，应当等于 Node crypto 对原始 msg 的 digest。
function sha1Pad(msg: Uint8Array): Uint8Array {
    const msgLen = msg.length;
    const k = (56 - ((msgLen + 1) % 64) + 64) % 64;
    const padded = new Uint8Array(msgLen + 1 + k + 8);
    padded.set(msg, 0);
    padded[msgLen] = 0x80;
    const view = new DataView(padded.buffer, padded.byteOffset + padded.byteLength - 8, 8);
    view.setBigUint64(0, BigInt(msgLen) * 8n, false); // 大端 bit 长度
    return padded;
}

// padding oracle 的核心：Node crypto 的 SHA1 digest 内部就是对 padding 后的输入逐 block
// transform、取最终 state 的大端表示。Sha1Stream 自行实现 transform 且不 finalize，
// 因此对「已 padding 的输入」transform 后大端输出必须等于 digest。Node crypto 走
// OpenSSL，与本实现完全独立，是验证 transform 正确性的可靠参照。
function expectSha1StreamMatchesCrypto(msg: Uint8Array): void {
    const expected = createHash('sha1').update(Buffer.from(msg)).digest();
    const stream = new Sha1Stream();
    stream.update(sha1Pad(msg));
    const bigEndian = stream.hash(false);
    expect(Buffer.from(bigEndian).equals(expected)).toBe(true);
}

describe('Sha1Stream transform (padding oracle vs Node crypto)', () => {
    it('matches for empty input (single padded block)', () => {
        expectSha1StreamMatchesCrypto(Buffer.alloc(0));
    });

    it('matches for "abc" (single padded block)', () => {
        expectSha1StreamMatchesCrypto(Buffer.from('abc', 'utf8'));
    });

    it('matches across the 56-byte boundary (forces a second padded block)', () => {
        // 56 字节：0x80 后只剩 0 字节给 zeros 不够放 8 字节长度，padding 溢出到第二块。
        expectSha1StreamMatchesCrypto(Buffer.alloc(56, 0x41));
    });

    it('matches for exactly one block (64 bytes → two padded blocks)', () => {
        expectSha1StreamMatchesCrypto(Buffer.alloc(64, 0x42));
    });

    it('matches for multi-block input (200 bytes → four padded blocks)', () => {
        expectSha1StreamMatchesCrypto(Buffer.alloc(200, 0x43));
    });

    it('matches for pseudo-random multi-block input', () => {
        const data = Buffer.alloc(313, 0);

        for (let i = 0; i < data.length; i++) {
            data[i] = (i * 1103515245 + 12345) & 0xff;
        }

        expectSha1StreamMatchesCrypto(data);
    });
});

describe('Sha1Stream update chunk-equivalence', () => {
    // update 内部维护 64 字节 buffer + 128 位 bit 计数；分块喂入必须与一次性喂入
    // 产生相同的内部 state。切分点覆盖 block 边界附近以暴露 buffer/count 管理 bug。
    it('two-chunk split at various boundaries yields the same state as one update', () => {
        const data = Buffer.alloc(200, 0x44);
        const full = new Sha1Stream();
        full.update(data);
        const fullHash = Buffer.from(full.hash(true));

        for (const split of [0, 1, 32, 63, 64, 65, 127, 128, 129, 199]) {
            const s = new Sha1Stream();
            s.update(data.subarray(0, split));
            s.update(data.subarray(split));
            expect(Buffer.from(s.hash(true)).equals(fullHash)).toBe(true);
        }
    });

    it('three-chunk split yields the same state as one update', () => {
        const data = Buffer.alloc(300, 0x45);
        const full = new Sha1Stream();
        full.update(data);
        const fullHash = Buffer.from(full.hash(true));
        const s = new Sha1Stream();
        s.update(data.subarray(0, 100));
        s.update(data.subarray(100, 200));
        s.update(data.subarray(200));
        expect(Buffer.from(s.hash(true)).equals(fullHash)).toBe(true);
    });

    it('empty updates do not change the state', () => {
        const data = Buffer.alloc(130, 0x46);
        const full = new Sha1Stream();
        full.update(data);
        const fullHash = Buffer.from(full.hash(true));
        const s = new Sha1Stream();
        s.update(Buffer.alloc(0));
        s.update(data);
        s.update(Buffer.alloc(0));
        expect(Buffer.from(s.hash(true)).equals(fullHash)).toBe(true);
    });
});

describe('Sha1Stream hash endianness', () => {
    // hash(true) 小端与 hash(false) 大端是同一组 5 个 state word 的不同字节序表示。
    // 结合上面的 padding oracle（大端 == digest），即可间接确认小端中间 state 的值。
    it('little-endian is the per-word byte-swap of big-endian', () => {
        const s = new Sha1Stream();
        s.update(Buffer.alloc(64, 0x47));
        const le = Buffer.from(s.hash(true));
        const be = Buffer.from(s.hash(false));
        expect(le.length).toBe(20);

        for (let i = 0; i < 5; i++) {
            expect(le.readUInt32LE(i * 4)).toBe(be.readUInt32BE(i * 4));
        }
    });

    it('reset restores the initial SHA1 state', () => {
        const s = new Sha1Stream();
        s.update(Buffer.alloc(200, 0x48));
        s.reset();
        const initial = Buffer.from(s.hash(false));
        const expected = Buffer.from([
            0x67, 0x45, 0x23, 0x01, 0xef, 0xcd, 0xab, 0x89, 0x98, 0xba, 0xdc, 0xfe, 0x10, 0x32,
            0x54, 0x76, 0xc3, 0xd2, 0xe1, 0xf0,
        ]);
        expect(initial.equals(expected)).toBe(true);
    });
});

describe('computeSha1StateV', () => {
    const SLICE = 1024 * 1024; // 1 MB，与上传链路一致，且是 64 的倍数

    it('returns one 20-byte state per slice', () => {
        const data = Buffer.alloc(SLICE + 100, 0x49); // 2 片
        const states = computeSha1StateV(data, 2, SLICE);
        expect(states.length).toBe(2);

        for (const st of states) {
            expect(st.length).toBe(20);
        }
    });

    // 末片定义为「标准整文件 SHA1（有 finalize/padding）」，直接对齐 Node crypto。
    it('last slice equals the standard full-file SHA1 digest', () => {
        const data = Buffer.alloc(SLICE + 100, 0x4a);
        const states = computeSha1StateV(data, 2, SLICE);
        const expected = createHash('sha1').update(data).digest();
        expect(Buffer.from(states[1]).equals(expected)).toBe(true);
    });

    it('last slice equals full-file SHA1 for a three-slice file', () => {
        const data = Buffer.alloc(SLICE * 2 + 1, 0x4b);
        const states = computeSha1StateV(data, 3, SLICE);
        expect(Buffer.from(states[2]).equals(createHash('sha1').update(data).digest())).toBe(true);
    });

    // 非末片是「累积 SHA1 中间 state（不 finalize，小端）」。若误用标准 finalize
    // 计算，会得到 file[0:slice] 的完整 digest，与本实现必然不等——以此锁定
    // 「中间 state 而非独立片 digest」的语义。
    it('non-last slice is NOT the finalized digest of the prefix', () => {
        const data = Buffer.alloc(SLICE + 100, 0x4c);
        const states = computeSha1StateV(data, 2, SLICE);
        const prefixDigest = createHash('sha1').update(data.subarray(0, SLICE)).digest();
        expect(Buffer.from(states[0]).equals(prefixDigest)).toBe(false);
    });

    // 非末片中间 state 的正确性来自 transform（padding oracle 已验）与 update
    // 分块等价（已验）。这里再做一次直接对照：computeSha1StateV 对首片的处理
    // 等价于手动 reset + update(prefix) + 小端输出。
    it('non-last slice equals manual Sha1Stream reset+update of the prefix', () => {
        const data = Buffer.alloc(SLICE + 100, 0x4d);
        const states = computeSha1StateV(data, 2, SLICE);
        const manual = new Sha1Stream();
        manual.update(data.subarray(0, SLICE));
        expect(Buffer.from(states[0]).equals(Buffer.from(manual.hash(true)))).toBe(true);
    });

    // 单片文件只有末片，直接是整文件 digest。
    it('single-slice file has only the finalized digest', () => {
        const data = Buffer.alloc(100, 0x4e);
        const states = computeSha1StateV(data, 1, SLICE);
        expect(states.length).toBe(1);
        expect(Buffer.from(states[0]).equals(createHash('sha1').update(data).digest())).toBe(true);
    });

    // 中间 state 与「把它当末片算出的 digest」必须不同——这是 sliceupload 服务端
    // 校验「累积 state 而非独立片 digest」的核心区分点。
    it('non-last slice differs from a single-slice digest of the same prefix', () => {
        const data = Buffer.alloc(SLICE + 100, 0x4f);
        const multiFirst = computeSha1StateV(data, 2, SLICE)[0];
        const singleAsLast = computeSha1StateV(data.subarray(0, SLICE), 1, SLICE)[0];
        expect(Buffer.from(multiFirst).equals(Buffer.from(singleAsLast))).toBe(false);
    });
});