// 已读取AGENTS.md
import * as fs from 'fs';
import * as path from 'path';

/**
 * 第十八批回归闸门：生产环境不得使用仓库内置默认 admin 密钥
 */
describe('第十八批鉴权密钥安全闸门', () => {
  const rootDir = path.resolve(__dirname, '../../');
  const indexCode = fs.readFileSync(path.join(rootDir, 'server/src/index.ts'), 'utf-8');

  it('不得再以仓库内置默认密钥作为静默回落', () => {
    expect(indexCode).not.toContain("process.env.ADMIN_TOKEN_SECRET || 'peiwan_admin_token_secret_v1'");
  });

  it('必须存在默认密钥常量与 fail-closed 随机化闸门（不依赖 NODE_ENV）', () => {
    expect(indexCode).toContain('const DEFAULT_ADMIN_TOKEN_SECRET =');
    const start = indexCode.indexOf('const DEFAULT_ADMIN_TOKEN_SECRET =');
    const block = indexCode.slice(start, start + 1200);
    expect(block).toContain('if (SECURE_MODE)');
    expect(block).toContain('crypto.randomBytes');
    expect(block).toContain('SECURITY');
  });

  it('管理员 token 校验必须使用常量时间比较', () => {
    expect(indexCode).toContain('crypto.timingSafeEqual');
  });
});