import { Pool } from 'pg';
import { generateKeyPairSync, randomUUID, sign } from 'node:crypto';
import { postgresConfig } from '../server/market/postgres-config.ts';
import { auditPostgres } from '../server/market/postgres-custody.ts';
import { custodyMessage, CUSTODY_POLICY, type CustodyCommand, type CustodyPage } from '../shared/custody.ts';
import { address } from '../server/testnet/consensus.ts';

// Run inside the new sandbox application container. Optional explicit fictitious credit probe only.
const credit = process.argv.slice(2);
if (credit.length && (credit.length !== 1 || credit[0] !== '--credit')) throw new Error('Expected no arguments or --credit');
const configuration = await postgresConfig();
const pool = new Pool(configuration);
try {
  // Verify server policy too: correct credentials must NOT authenticate over plaintext TCP.
  const plaintext = new Pool({ ...configuration, ssl: false, connectionTimeoutMillis: 3000 });
  try {
    let rejected = false;
    try { await plaintext.query('SELECT 1'); } catch { rejected = true; }
    if (!rejected) throw new Error('Database unexpectedly permits plaintext authentication');
  } finally { await plaintext.end(); }
  const c = await pool.connect();
  try {
    const tls = await c.query('SELECT ssl,version FROM pg_stat_ssl WHERE pid=pg_backend_pid()');
    if (tls.rows[0]?.ssl !== true) throw new Error('Database connection is not encrypted');
    const role = await c.query('SELECT current_user AS role');
    if (role.rows[0].role !== 'custody_runtime') throw new Error('Expected restricted sandbox runtime role');
    const page = await fetch('http://127.0.0.1:3001/api/custody', { signal: AbortSignal.timeout(10000) });
    if (!page.ok) throw new Error('Custody API unavailable');
    const data = await page.json() as CustodyPage;
    if (data.info.mode !== 'sandbox' || data.info.liveDeposits || data.info.liveWithdrawals || data.info.nftSettlement) throw new Error('Unexpected custody capabilities');
    if (credit.length) {
      const keys = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
      const publicKey = keys.publicKey.export({ type: 'spki', format: 'der' }).toString('base64');
      const terms: Omit<CustodyCommand, 'signature'> = { version: 1, mode: 'sandbox', policy: CUSTODY_POLICY,
        network: data.info.network, chainId: data.info.chainId, custodianId: data.info.custodianId,
        actor: address(publicKey), publicKey, nonce: randomUUID(), expiresAt: Date.now() + 60000, action: { type: 'mock-credit' } };
      const signature = sign('sha256', Buffer.from(custodyMessage(terms)), { key: keys.privateKey, dsaEncoding: 'ieee-p1363' }).toString('base64');
      const result = await fetch('http://127.0.0.1:3001/api/custody/command', { method: 'POST',
        headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ ...terms, signature }), signal: AbortSignal.timeout(10000) });
      if (!result.ok || (await result.json()).availableAtomicXmr !== '1000000000000') throw new Error('Fictitious credit probe failed');
      // Test key never printed/persisted. The resulting fictitious liability remains in the sandbox journal.
    }
    await c.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
    const audit = await auditPostgres(c); await c.query('COMMIT');
    console.log(JSON.stringify({ custodianId: data.info.custodianId, tls: tls.rows[0].version,
      role: role.rows[0].role, sandbox: true, ...audit }));
  } finally { c.release(); }
} catch {
  console.error('Sandbox deployment check failed; no connection secrets logged.'); process.exitCode = 1;
} finally { await pool.end(); }