-- Copyright (c) 2026 Huawei Technologies Co., Ltd.
-- openUBMC is licensed under Mulan PSL v2.
-- You can use this software according to the terms and conditions of the Mulan PSL v2.
-- You may obtain a copy of Mulan PSL v2 at:
--          http://license.coscl.org.cn/MulanPSL2
-- THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
-- EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
-- MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
-- See the Mulan PSL v2 for more details.

local lu = require 'luaunit'
local cpld_security_test = require 'cpld_security_test.cpld_security_check'
local log = require 'mc.logging'
local ctx = require 'mc.context'
local fw_mgmt_client = require 'general_hardware.client'
local cmn = require 'common'
local utils = require 'mc.utils'
local vos = require 'utils.vos'
local file_sec = require 'utils.file'
local cfg = require 'unit_manager.class.logic_fw.upgrade.fw_cfgs'
local drivers = require 'unit_manager.class.logic_fw.upgrade.drivers_api'
local chip = require 'unit_manager.class.logic_fw.cpld_chip'
local defs = require 'unit_manager.class.logic_fw.comm_defs'
local skynet = require 'skynet'

TestCpldSecurityCheck = {}

function TestCpldSecurityCheck:setUp()
    -- 保存原始函数
    self.original_get_file_accessible = vos.get_file_accessible
    self.original_get_package_info = cmn.get_package_info
    self.original_check_shell_special_character_s = file_sec.check_shell_special_character_s
    self.original_get_cfg_list = cfg.get_cfg_list
    self.original_get_file_length = vos.get_file_length
    self.original_secure_tar_unzip = utils.secure_tar_unzip
    self.original_remove_file = utils.remove_file
    self.original_skynet_sleep = skynet.sleep
    self.original_GetBypassMode = nil
    self.original_set_upg_cpld_chip = nil
    self.original_get_cpld_device_info = nil
    self.original_get_cpld_upgrade_file_id = nil
    self.original_check_has_pango = nil
    self.original_update_chip_lock = nil
    self.original_update_chip_unlock = nil
    self.original_Write = nil
    self.original_FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply
    self.original_SubscribeFirmwareRestoreFirmwareRestoreFirmwareRestoreCheckSignal = fw_mgmt_client.SubscribeFirmwareRestoreFirmwareRestoreFirmwareRestoreCheckSignal

    -- 初始化测试变量
    self.test_hpm_path = '/dev/shm/test_hpm.hpm'
    self.test_dir_path = '/dev/shm/test_dir/'
    self.test_cfg_path = self.test_dir_path .. 'update.cfg'
    self.verify_file_path = self.test_dir_path .. 'verify.svf'
    self.verify_file_path_01 = self.test_dir_path .. 'verify01.svf'
    self.verify_file_path_02 = self.test_dir_path .. 'verify02.svf'
end

function TestCpldSecurityCheck:tearDown()
    -- 恢复原始函数
    if self.original_get_file_accessible then
        vos.get_file_accessible = self.original_get_file_accessible
    end
    if self.original_get_package_info then
        cmn.get_package_info = self.original_get_package_info
    end
    if self.original_check_shell_special_character_s then
        file_sec.check_shell_special_character_s = self.original_check_shell_special_character_s
    end
    if self.original_get_cfg_list then
        cfg.get_cfg_list = self.original_get_cfg_list
    end
    if self.original_get_file_length then
        vos.get_file_length = self.original_get_file_length
    end
    if self.original_secure_tar_unzip then
        utils.secure_tar_unzip = self.original_secure_tar_unzip
    end
    if self.original_remove_file then
        utils.remove_file = self.original_remove_file
    end
    if self.original_skynet_sleep then
        skynet.sleep = self.original_skynet_sleep
    end
    if self.original_FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply then
        fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = self.original_FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply
    end
    if self.original_SubscribeFirmwareRestoreFirmwareRestoreFirmwareRestoreCheckSignal then
        fw_mgmt_client.SubscribeFirmwareRestoreFirmwareRestoreFirmwareRestoreCheckSignal = self.original_SubscribeFirmwareRestoreFirmwareRestoreFirmwareRestoreCheckSignal
    end
end

-- 测试 parse_hpm_update_cfg: hpm_path 为 nil
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_nil_path()
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg(nil)
    lu.assertEquals(cfg_list, {})
    lu.assertEquals(dir_path, nil)
end

-- 测试 parse_hpm_update_cfg: hpm_path 为空字符串
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_empty_path()
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg('')
    lu.assertEquals(cfg_list, {})
    lu.assertEquals(dir_path, nil)
end

-- 测试 parse_hpm_update_cfg: 文件不可访问
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_file_not_accessible()
    vos.get_file_accessible = function(path)
        return false
    end
    
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg(self.test_hpm_path)
    lu.assertEquals(cfg_list, {})
    lu.assertEquals(dir_path, nil)
end

-- 测试 parse_hpm_update_cfg: get_package_info 失败
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_get_package_info_failed()
    vos.get_file_accessible = function(path)
        return true
    end
    
    cmn.get_package_info = function(path)
        return nil
    end
    
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg(self.test_hpm_path)
    lu.assertEquals(cfg_list, {})
    lu.assertEquals(dir_path, nil)
end

-- 测试 parse_hpm_update_cfg: FirmwareDirectory 缺失
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_firmware_directory_missing()
    vos.get_file_accessible = function(path)
        return true
    end
    
    cmn.get_package_info = function(path)
        return {}
    end
    
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg(self.test_hpm_path)
    lu.assertEquals(cfg_list, {})
    lu.assertEquals(dir_path, nil)
end

-- 测试 parse_hpm_update_cfg: FirmwareDirectory 无效
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_firmware_directory_invalid()
    vos.get_file_accessible = function(path)
        return true
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return -1  -- 返回错误
    end
    
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg(self.test_hpm_path)
    lu.assertEquals(cfg_list, {})
    lu.assertEquals(dir_path, nil)
end

-- 测试 parse_hpm_update_cfg: get_cfg_list 失败
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_get_cfg_list_failed()
    vos.get_file_accessible = function(path)
        return true
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0  -- 成功
    end
    
    cfg.get_cfg_list = function(path)
        return {}
    end
    
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg(self.test_hpm_path)
    lu.assertEquals(cfg_list, {})
    lu.assertEquals(dir_path, nil)
end

-- 测试 parse_hpm_update_cfg: 成功解析
function TestCpldSecurityCheck:test_parse_hpm_update_cfg_success()
    vos.get_file_accessible = function(path)
        return true
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg_list = {
        {
            name = 'Firmware0',
            uid = '00000001020302031825',
            chip_num = 2,
            supplier_mode = defs.CPLD_SUPPLIER_MODE.SINGLE
        }
    }
    
    cfg.get_cfg_list = function(path)
        return mock_cfg_list
    end
    
    local security_test = cpld_security_test.new()
    local cfg_list, dir_path = security_test:parse_hpm_update_cfg(self.test_hpm_path)
    lu.assertEquals(#cfg_list, 1)
    lu.assertEquals(cfg_list[1].name, 'Firmware0')
    lu.assertEquals(dir_path, self.test_dir_path)
end

-- 测试 filter_cpld_fw_list_for_verify: logic_fw_list 无效
function TestCpldSecurityCheck:test_filter_cpld_fw_list_for_verify_invalid_list()
    local security_test = cpld_security_test.new()
    security_test.logic_fw_list = nil
    
    local result = security_test:filter_cpld_fw_list_for_verify(1, 24, 0, {})
    lu.assertEquals(result, nil)
end

-- 测试 filter_cpld_fw_list_for_verify: logic_fw_list 不是表
function TestCpldSecurityCheck:test_filter_cpld_fw_list_for_verify_not_table()
    local security_test = cpld_security_test.new()
    security_test.logic_fw_list = 'not a table'
    
    local result = security_test:filter_cpld_fw_list_for_verify(1, 24, 0, {})
    lu.assertEquals(result, nil)
end

-- 测试 filter_cpld_fw_list_for_verify: 成功过滤
function TestCpldSecurityCheck:test_filter_cpld_fw_list_for_verify_success()
    local security_test = cpld_security_test.new()
    
    local mock_hpm_cfg = {
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    security_test.logic_fw_list = {
        {
            system_id = 1,
            uid = '00000001020302031825',
            name = 'CPLD_FW_1',
            component_id = 24,
            component_id_ex = 0
        },
        {
            system_id = 2,
            uid = '00000001020302044488',
            name = 'CPLD_FW_2',
            component_id = 24,
            component_id_ex = 0
        }
    }
    
    local result = security_test:filter_cpld_fw_list_for_verify(1, 24, 0, mock_hpm_cfg)
    lu.assertEquals(#result, 1)
    lu.assertEquals(result[1].name, 'CPLD_FW_1')
end

-- 测试 filter_cpld_fw_list_for_verify: 使用 ALL_SYSTEM_ID
function TestCpldSecurityCheck:test_filter_cpld_fw_list_for_verify_all_system_id()
    local security_test = cpld_security_test.new()
    
    local mock_hpm_cfg = {
        check_fw_uid_exist = function(self, fw)
            return true
        end
    }
    
    security_test.logic_fw_list = {
        {
            system_id = 1,
            uid = '00000001020302031825',
            name = 'CPLD_FW_1'
        },
        {
            system_id = 2,
            uid = '00000001020302044488',
            name = 'CPLD_FW_2'
        }
    }
    
    local result = security_test:filter_cpld_fw_list_for_verify(defs.ALL_SYSTEM_ID, 24, 0, mock_hpm_cfg)
    lu.assertEquals(#result, 2)
end

-- 测试 on_firmware_restore_check: 非 CPLD 固件类型
function TestCpldSecurityCheck:test_on_firmware_restore_check_non_cpld_type()
    local security_test = cpld_security_test.new()
    local test_ctx = ctx.new()
    
    local reply_called = false
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
        reply_called = true
    end
    
    security_test:on_firmware_restore_check(test_ctx, 1, 'FPGA', 24, 0, {})
    lu.assertEquals(reply_called, false)
end

-- 测试 on_firmware_restore_check: 非 Security 类型
function TestCpldSecurityCheck:test_on_firmware_restore_check_non_security_type()
    local security_test = cpld_security_test.new()
    local test_ctx = ctx.new()
    
    local reply_called = false
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
        reply_called = true
    end
    
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Other'
    })
    lu.assertEquals(reply_called, false)
end

-- 测试 on_firmware_restore_check: 解析 HPM 失败
function TestCpldSecurityCheck:test_on_firmware_restore_check_parse_hpm_failed()
    local security_test = cpld_security_test.new()
    security_test.logic_fw_list = {}
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    vos.get_file_accessible = function(path)
        return false
    end
    
    -- Mock remove_file 以处理 nil 参数
    utils.remove_file = function(path)
        if path == nil then
            return
        end
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: 没有匹配的 logic_fw
function TestCpldSecurityCheck:test_on_firmware_restore_check_no_matched_fw()
    local security_test = cpld_security_test.new()
    security_test.logic_fw_list = {}
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path then
            return true
        end
        return false
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        check_fw_uid_exist = function(self, fw)
            return false
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: 单供应商模式验证成功
function TestCpldSecurityCheck:test_on_firmware_restore_check_single_supplier_success()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                return true
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path or path == self.verify_file_path then
            return true
        end
        return false
    end
    
    vos.get_file_length = function(path)
        if path == self.verify_file_path then
            return 1024
        end
        return 0
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.SINGLE,
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: 验证失败
function TestCpldSecurityCheck:test_on_firmware_restore_check_verify_failed()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                error("Write failed")  -- 抛出异常模拟写入失败
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path or path == self.verify_file_path then
            return true
        end
        return false
    end
    
    vos.get_file_length = function(path)
        if path == self.verify_file_path then
            return 1024
        end
        return 0
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.SINGLE,
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: 多供应商模式验证成功
function TestCpldSecurityCheck:test_on_firmware_restore_check_multi_supplier_success()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                return true
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path or path == self.verify_file_path_01 or path == self.verify_file_path_02 then
            return true
        end
        return false
    end
    
    vos.get_file_length = function(path)
        if path == self.verify_file_path_01 or path == self.verify_file_path_02 then
            return 1024
        end
        return 0
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.MULTIPLE,
        chip_num = 2,
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    drivers.get_cpld_device_info = function(chip_info, cpld_info)
        cpld_info.device1_id = 0x1234
        cpld_info.device2_id = 0x5678
        return defs.RET.OK
    end
    
    chip.get_cpld_upgrade_file_id = function(chip_id, chip_num, chip_index)
        if chip_index == 1 then
            return 1
        elseif chip_index == 2 then
            return 2
        end
        return 0
    end
    
    chip.check_has_pango = function(cpld_info)
        return false
    end
    
    drivers.set_upg_cpld_chip = function(chip_info, chip_index)
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 init: 正常初始化
function TestCpldSecurityCheck:test_init_success()
    local security_test = cpld_security_test.new()
    
    -- mock 订阅接口，避免真实 dbus 访问
    fw_mgmt_client.SubscribeFirmwareRestoreFirmwareRestoreFirmwareRestoreCheckSignal = function(callback)
        -- 这里不做实际订阅，只校验回调存在即可
        lu.assertNotNil(callback)
    end
    
    local mock_logic_fw_list = {
        {
            id = 1,
            name = 'CPLD_FW_1'
        }
    }
    
    security_test:init(nil, nil, mock_logic_fw_list)
    
    -- 验证 logic_fw_list 和 inited 状态
    lu.assertEquals(security_test.logic_fw_list, mock_logic_fw_list)
    lu.assertEquals(security_test.inited, true)
    
    -- 测试重复初始化（应该直接返回，不重复初始化）
    security_test:init(nil, nil, mock_logic_fw_list)
    lu.assertEquals(security_test.inited, true)
end

-- 测试 on_firmware_restore_check: 锁芯片失败
function TestCpldSecurityCheck:test_on_firmware_restore_check_lock_failed()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return false, -1  -- 锁失败
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                return true
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path or path == self.verify_file_path then
            return true
        end
        return false
    end
    
    vos.get_file_length = function(path)
        if path == self.verify_file_path then
            return 1024
        end
        return 0
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.SINGLE,
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    -- 测试锁芯片失败的情况
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: 多供应商模式 process_all_cpld_verify 验证失败
function TestCpldSecurityCheck:test_on_firmware_restore_check_multi_supplier_verify_failed_all()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                error("Write failed")  -- 抛出异常模拟写入失败
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path or path == self.verify_file_path_01 then
            return true
        end
        return false
    end
    
    vos.get_file_length = function(path)
        if path == self.verify_file_path_01 then
            return 1024
        end
        return 0
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.MULTIPLE,
        chip_num = 2,
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    drivers.get_cpld_device_info = function(chip_info, cpld_info)
        return defs.RET.OK
    end
    
    chip.check_has_pango = function(cpld_info)
        return false  -- 返回 false 以触发 process_all_cpld_verify 路径
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: 多供应商模式使用 hot_valid_list
function TestCpldSecurityCheck:test_on_firmware_restore_check_multi_supplier_hot_valid_list()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                return true
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path or path == self.verify_file_path_01 then
            return true
        end
        return false
    end
    
    vos.get_file_length = function(path)
        if path == self.verify_file_path_01 then
            return 1024
        end
        return 0
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.MULTIPLE,
        chip_num = 2,
        hot_valid_list = {1},  -- 使用 hot_valid_list 覆盖行205-207
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    drivers.get_cpld_device_info = function(chip_info, cpld_info)
        cpld_info.device1_id = 0x1234
        return defs.RET.OK
    end
    
    chip.get_cpld_upgrade_file_id = function(chip_id, chip_num, chip_index)
        if chip_index == 1 then
            return 1
        end
        return 0
    end
    
    chip.check_has_pango = function(cpld_info)
        return true
    end
    
    drivers.set_upg_cpld_chip = function(chip_info, chip_index)
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: get_need_upgrade_cpld_list 无效配置（覆盖行219-220）
function TestCpldSecurityCheck:test_on_firmware_restore_check_invalid_cpld_list()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                return true
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path then
            return true
        end
        return false
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.MULTIPLE,
        -- 不设置 chip_num，cold_valid_list 和 hot_valid_list 都为空，触发无效配置分支
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    drivers.get_cpld_device_info = function(chip_info, cpld_info)
        return defs.RET.OK
    end
    
    chip.check_has_pango = function(cpld_info)
        return false
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: 单供应商模式 verify_file 不可访问（覆盖行249-250）
function TestCpldSecurityCheck:test_on_firmware_restore_check_single_supplier_file_not_accessible()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                return true
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path then
            return true
        end
        -- verify.svf 文件不可访问，覆盖行249-250
        return false
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.SINGLE,
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end

-- 测试 on_firmware_restore_check: MIXED 模式验证成功（覆盖 process_cpld_verify_with_chip_id 路径）
function TestCpldSecurityCheck:test_on_firmware_restore_check_mixed_mode_success()
    local security_test = cpld_security_test.new()
    
    -- mock 固件恢复校验回复接口，避免访问真实 dbus
    fw_mgmt_client.FirmwareRestoreFirmwareRestoreFirmwareRestoreCheckReply = function(...)
    end
    
    local mock_logic_fw = {
        id = 1,
        name = 'CPLD_FW_1',
        system_id = 1,
        uid = '00000001020302031825',
        switch_to_firmware_route = function() end,
        switch_to_default_route = function() end,
        update_chip_lock = function(self, ctx, timeout)
            return true, 0
        end,
        update_chip_unlock = function(self, ctx)
            return true, 0
        end,
        chip_info = {
            SetBypassMode = function(self, ctx, mode)
                return true
            end
        },
        update_chip = {
            Write = function(self, ctx, mode, data)
                return true
            end
        }
    }
    
    security_test.logic_fw_list = {mock_logic_fw}
    
    vos.get_file_accessible = function(path)
        if path == self.test_hpm_path or path == self.verify_file_path_01 then
            return true
        end
        return false
    end
    
    vos.get_file_length = function(path)
        if path == self.verify_file_path_01 then
            return 1024
        end
        return 0
    end
    
    cmn.get_package_info = function(path)
        return {
            FirmwareDirectory = self.test_dir_path
        }
    end
    
    file_sec.check_shell_special_character_s = function(dir)
        return 0
    end
    
    local mock_cfg = {
        name = 'Firmware0',
        supplier_mode = defs.CPLD_SUPPLIER_MODE.MIXED,  -- 使用 MIXED 模式
        chip_num = 2,
        check_fw_uid_exist = function(self, fw)
            return fw.uid == '00000001020302031825'
        end
    }
    
    cfg.get_cfg_list = function(path)
        return {mock_cfg}
    end
    
    drivers.get_cpld_device_info = function(chip_info, cpld_info)
        cpld_info.device1_id = 0x1234
        return defs.RET.OK
    end
    
    chip.get_cpld_upgrade_file_id = function(chip_id, chip_num, chip_index)
        if chip_index == 1 then
            return 1
        end
        return 0
    end
    
    chip.check_has_pango = function(cpld_info)
        return false
    end
    
    drivers.set_upg_cpld_chip = function(chip_info, chip_index)
    end
    
    utils.secure_tar_unzip = function(...)
    end
    
    utils.remove_file = function(...)
    end
    
    skynet.sleep = function(...)
    end
    
    local test_ctx = ctx.new()
    security_test:on_firmware_restore_check(test_ctx, 1, 'EXUCpld', 24, 0, {
        restore_type = 'Security',
        hpm_path = self.test_hpm_path
    })
end