import { beforeEach, describe, expect, it } from 'vitest'
import { createHostPinStore } from '../src/host-pin-store'

describe('createHostPinStore (T8) — cache/audit of the API-sourced fingerprint', () => {
  beforeEach(() => localStorage.clear())

  it('record/get round-trips the API-verified fingerprint', () => {
    const pins = createHostPinStore(localStorage)
    expect(pins.get('h1')).toBeNull()
    pins.record('h1', 'fpr-api')
    expect(pins.get('h1')).toBe('fpr-api')
  })

  it('detects drift: a caller comparing get() vs a fresh API value sees the rotation', () => {
    const pins = createHostPinStore(localStorage)
    pins.record('h1', 'fpr-old')
    const cached = pins.get('h1')
    const freshApi = 'fpr-new'
    expect(cached).not.toBe(freshApi) // caller surfaces this as a 'cache' mismatch for review
  })

  it('keeps hosts isolated — one host_id never returns another host\'s pin', () => {
    const pins = createHostPinStore(localStorage)
    pins.record('h1', 'fpr-1')
    pins.record('h2', 'fpr-2')
    expect(pins.get('h1')).toBe('fpr-1')
    expect(pins.get('h2')).toBe('fpr-2')
  })

  it('persists only the public fingerprint (no key/secret material at rest)', () => {
    const pins = createHostPinStore(localStorage)
    pins.record('h1', 'fpr-abc')
    expect(JSON.stringify(localStorage)).toContain('fpr-abc')
    expect(JSON.stringify(localStorage)).not.toMatch(/BEGIN|PRIVATE|secret/i)
  })
})