import { describe, expect, test, vi } from "vitest";
import { runSelfTest } from "./self-test";

describe("Peach crypto KAT (self-test)", () => {
  test("passes with the correct crypto stack", async () => {
    const result = await runSelfTest();
    expect(result.ok).toBe(true);
    expect(result.error).toBeUndefined();
  });

  // PCH-01-020: a real KAT must reject a ciphertext that diverges from the
  // pinned vector, not merely a failed round-trip. Simulate a WebCrypto whose
  // AES-GCM output differs from the committed expectation.
  test("fails when the produced ciphertext diverges from the pinned vector", async () => {
    const realEncrypt = crypto.subtle.encrypt.bind(crypto.subtle);
    const spy = vi
      .spyOn(crypto.subtle, "encrypt")
      .mockImplementation(async (...args: Parameters<typeof realEncrypt>) => {
        const ct = new Uint8Array(await realEncrypt(...args));
        ct[0] ^= 0xff; // diverge from the pinned vector
        return ct.buffer;
      });

    const result = await runSelfTest();
    expect(result.ok).toBe(false);
    expect(result.error).toContain("does not match the pinned test vector");

    spy.mockRestore();
  });
});