// fake-registry.mjs
// sig-registry.mjs
import http from 'node:http'
import fs from 'node:fs'
import os from 'node:os'
import path from 'node:path'
import crypto from 'node:crypto'
import { execFileSync } from 'node:child_process'

const port = Number(process.env.PORT || 4873)
const version = '1.0.0'

const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', {
  namedCurve: 'P-256',
})

const pub = publicKey.export({ type: 'spki', format: 'der' })
const keyid =
  'SHA256:' +
  crypto.createHash('sha256').update(pub).digest('base64').replace(/=+$/, '')

function integrityFor(data) {
  return 'sha512-' + crypto.createHash('sha512').update(data).digest('base64')
}

function makePackage(name, kind) {
  // Create a tiny real npm package and let `npm pack` produce the tarball.
  // This keeps the fixture close to actual registry metadata without needing
  // to hand-roll .tgz files.
  const dir = fs.mkdtempSync(path.join(os.tmpdir(), `${name}-`))
  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name, version }))
  fs.writeFileSync(path.join(dir, 'index.js'), `module.exports = ${JSON.stringify(name)}\n`)

  const [{ filename }] = JSON.parse(
    execFileSync('npm', ['pack', '--json'], { cwd: dir, encoding: 'utf8' })
  )

  const tarball = fs.readFileSync(path.join(dir, filename))
  const integrity = integrityFor(tarball)
  const shasum = crypto.createHash('sha1').update(tarball).digest('hex')

  const dist = {
    shasum,
    integrity,
    tarball: `http://127.0.0.1:${port}/${filename}`,
  }

  // The npm registry signature payload is:
  //
  //   `${name}@${version}:${dist.integrity}`
  //
  // For `valid`, sign the actual integrity.
  // For `tampered`, sign a different but valid-looking sha512 integrity.
  // That simulates a signature that may have been valid for a previous
  // package artifact, but no longer matches the current tarball metadata.
  // For `missing`, omit `dist.signatures` entirely.
  if (kind !== 'missing') {
    const oldTarball = Buffer.from(`previous contents for ${name}@${version}\n`)
    const signedIntegrity =
      kind === 'tampered'
        ? integrityFor(oldTarball)
        : integrity

    const payload = `${name}@${version}:${signedIntegrity}`

    dist.signatures = [{
      keyid,
      sig: crypto.sign('sha256', Buffer.from(payload), privateKey).toString('base64'),
    }]
  }

  return {
    filename,
    tarball,
    packument: {
      name,
      'dist-tags': { latest: version },
      versions: { [version]: { name, version, dist } },
    },
  }
}

const packages = {
  valid: makePackage('valid', 'valid'),
  tampered: makePackage('tampered', 'tampered'),
  missing: makePackage('missing', 'missing'),
}

const json = value => JSON.stringify(value)

http.createServer((req, res) => {
  const url = decodeURIComponent(req.url)

  // npm/pnpm signature verifiers fetch trusted registry keys here.
  // Keeping this endpoint present is what makes `missing` meaningful:
  // the registry claims to support signatures, but the package lacks one.
  if (req.method === 'GET' && url === '/-/npm/v1/keys') {
    res.setHeader('content-type', 'application/json')
    return res.end(json({
      keys: [{
        expires: null,
        keyid,
        keytype: 'ecdsa-sha2-nistp256',
        scheme: 'ecdsa-sha2-nistp256',
        key: pub.toString('base64'),
      }],
    }))
  }

  // Package metadata endpoint, e.g. GET /valid.
  const name = url.slice(1)
  if (req.method === 'GET' && packages[name]) {
    res.setHeader('content-type', 'application/json')
    return res.end(json(packages[name].packument))
  }

  // Tarball endpoint, e.g. GET /valid-1.0.0.tgz.
  const pkg = Object.values(packages).find(p => url === `/${p.filename}`)
  if (req.method === 'GET' && pkg) {
    res.setHeader('content-type', 'application/octet-stream')
    return res.end(pkg.tarball)
  }

  res.statusCode = 404
  res.end('not found')
}).listen(port, '127.0.0.1', () => {
  console.log(`registry=http://127.0.0.1:${port}`)
  console.log('packages: valid@1.0.0, tampered@1.0.0, missing@1.0.0')
})