/* oxlint-disable executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: tests use fixture server cleanup and hard-fail setup errors */
import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
import { mkdir, readFile, symlink, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { deflateSync } from "node:zlib";

import { describe, expect, it } from "@effect/vitest";
import { Effect, Exit } from "effect";

import { FLUSH, parseInfoRefs, pktLine, resolveWant } from "../git-client/pktline";
import { handFetch } from "../git-client/hand";
import { parsePack, walkTree } from "../git-client/packfile";
import { authForHost, checkRefs, uploadPack } from "../git-client/transport";
import { PUBLISH_LIMITS } from "../pipeline/publish";
import { checkGitAppSourceRefs, fetchGitAppSource, parseGitSourceUrl } from "./git-source";
import { fetchLocalDirectoryAppSource } from "./local-directory-source";

const run = <A, E>(effect: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(effect);
const textDecoder = new TextDecoder();
const textEncoder = new TextEncoder();

const concat = (parts: readonly Uint8Array[]): Uint8Array => {
  const out = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0));
  let offset = 0;
  for (const part of parts) {
    out.set(part, offset);
    offset += part.length;
  }
  return out;
};

const sideBand = (bytes: Uint8Array): Uint8Array => {
  const chunks: Uint8Array[] = [pktLine("NAK\n")];
  for (let offset = 0; offset < bytes.length; offset += 60_000) {
    const chunk = bytes.subarray(offset, offset + 60_000);
    const payload = new Uint8Array(chunk.length + 1);
    payload[0] = 1;
    payload.set(chunk, 1);
    chunks.push(pktLine(payload));
  }
  chunks.push(FLUSH);
  return concat(chunks);
};

const advertisement = (sha: string): Uint8Array =>
  concat([
    pktLine("# service=git-upload-pack\n"),
    FLUSH,
    pktLine(
      `${sha} HEAD\0symref=HEAD:refs/heads/main multi_ack side-band-64k thin-pack ofs-delta\n`,
    ),
    pktLine(`${sha} refs/heads/main\n`),
    pktLine(`${sha} refs/tags/v1\n`),
    pktLine(`${sha} refs/tags/v1^{}\n`),
    FLUSH,
  ]);

const gitObjectId = async (type: string, data: Uint8Array): Promise<string> => {
  const header = textEncoder.encode(`${type} ${data.length}\0`);
  const full = concat([header, data]);
  const digest = new Uint8Array(await crypto.subtle.digest("SHA-1", full as BufferSource));
  return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
};

const hexBytes = (hex: string): Uint8Array => {
  const out = new Uint8Array(hex.length / 2);
  for (let index = 0; index < out.length; index += 1) {
    out[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
  }
  return out;
};

const packObjectHeader = (type: number, size: number): Uint8Array => {
  const bytes: number[] = [];
  let first = (type << 4) | (size & 0x0f);
  size = Math.floor(size / 16);
  if (size > 0) first |= 0x80;
  bytes.push(first);
  while (size > 0) {
    let next = size & 0x7f;
    size = Math.floor(size / 128);
    if (size > 0) next |= 0x80;
    bytes.push(next);
  }
  return Uint8Array.from(bytes);
};

const packFile = (objects: readonly Uint8Array[]): Uint8Array => {
  const header = new Uint8Array(12);
  header.set(textEncoder.encode("PACK"), 0);
  const view = new DataView(header.buffer);
  view.setUint32(4, 2);
  view.setUint32(8, objects.length);
  return concat([header, ...objects, new Uint8Array(20)]);
};

const packedObject = (type: number, data: Uint8Array): Uint8Array =>
  concat([packObjectHeader(type, data.length), deflateSync(data)]);

const deltaVarint = (value: number): Uint8Array => {
  const bytes: number[] = [];
  do {
    let next = value & 0x7f;
    value = Math.floor(value / 128);
    if (value > 0) next |= 0x80;
    bytes.push(next);
  } while (value > 0);
  return Uint8Array.from(bytes);
};

const readFixture = async () => {
  const dir = join(import.meta.dirname, "fixtures");
  const [shas, pack1, pack2] = await Promise.all([
    readFile(join(dir, "git-fixture-shas.txt"), "utf8"),
    readFile(join(dir, "git-fixture-v1.pack")),
    readFile(join(dir, "git-fixture-v2.pack")),
  ]);
  const [sha1, sha2] = shas.trim().split("\n");
  return { sha1: sha1!, sha2: sha2!, pack1, pack2 };
};

const fixtureServer = async () => {
  const fixture = await readFixture();
  let current = { sha: fixture.sha1, pack: new Uint8Array(fixture.pack1) };
  let packRequests = 0;
  const server = createServer((request: IncomingMessage, response: ServerResponse) => {
    if (request.url === "/repo.git/info/refs?service=git-upload-pack") {
      response.writeHead(200, {
        "content-type": "application/x-git-upload-pack-advertisement",
      });
      response.end(advertisement(current.sha));
      return;
    }
    if (request.url === "/repo.git/git-upload-pack" && request.method === "POST") {
      packRequests += 1;
      response.writeHead(200, { "content-type": "application/x-git-upload-pack-result" });
      response.end(sideBand(current.pack));
      return;
    }
    response.writeHead(404, { "content-type": "text/plain" });
    response.end("not found");
  });
  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
  const address = server.address();
  if (!address || typeof address === "string") throw new Error("fixture server did not bind");
  return {
    url: `https://example.test/repo`,
    fetch: ((rawUrl: string, init?: RequestInit) => {
      const incoming = new URL(rawUrl);
      const local = new URL(
        `http://127.0.0.1:${address.port}${incoming.pathname}${incoming.search}`,
      );
      return fetch(local, init);
    }) as typeof fetch,
    advance: () => {
      current = { sha: fixture.sha2, pack: new Uint8Array(fixture.pack2) };
    },
    packRequests: () => packRequests,
    close: () => new Promise<void>((resolve) => server.close(() => resolve())),
  };
};

const liveOrSkip = async (url: string): Promise<boolean> => {
  try {
    const response = await fetch(url, { method: "HEAD" });
    return response.ok || response.status < 500;
  } catch {
    return false;
  }
};

type FetchHandler = (
  input: Parameters<typeof fetch>[0],
  init?: Parameters<typeof fetch>[1],
) => ReturnType<typeof fetch>;

const testFetch = (handler: FetchHandler): typeof fetch =>
  Object.assign(handler, { preconnect: () => undefined }) as typeof fetch;

describe("git app sources", () => {
  it("parses github and gitlab advertisements", () => {
    const github = parseInfoRefs(advertisement("1111111111111111111111111111111111111111"));
    expect(github.headTarget).toBe("refs/heads/main");
    expect(github.refs.get("refs/tags/v1^{}")).toBe("1111111111111111111111111111111111111111");
    expect(resolveWant(github).resolvedRef).toBe("refs/heads/main");

    const gitlab = parseInfoRefs(
      concat([
        pktLine("# service=git-upload-pack\n"),
        FLUSH,
        pktLine(
          "2222222222222222222222222222222222222222 HEAD\0symref=HEAD:refs/heads/master multi_ack side-band-64k thin-pack ofs-delta\n",
        ),
        pktLine("2222222222222222222222222222222222222222 refs/heads/master\n"),
        pktLine("3333333333333333333333333333333333333333 refs/tags/v1\n"),
        pktLine("2222222222222222222222222222222222222222 refs/tags/v1^{}\n"),
        FLUSH,
      ]),
    );
    expect(resolveWant(gitlab).resolvedRef).toBe("refs/heads/master");
    expect(resolveWant(gitlab, "v1").sha).toBe("3333333333333333333333333333333333333333");
  });

  it("uses host-specific auth recipes", () => {
    expect(authForHost("github.com", "t").authorization).toBe(`Basic ${btoa("x-access-token:t")}`);
    expect(authForHost("gitlab.com", "t").authorization).toBe(`Basic ${btoa("oauth2:t")}`);
    expect(authForHost("bitbucket.org", "t").authorization).toBe(`Basic ${btoa("x-token-auth:t")}`);
    expect(authForHost("codeberg.org", "t").authorization).toBe(`Basic ${btoa("git:t")}`);
  });

  it("rejects truncated and malformed pkt-line responses", () => {
    expect(() =>
      parseInfoRefs(concat([pktLine("# service=git-upload-pack\n"), Uint8Array.from([48])])),
    ).toThrow(/truncated pkt-line/);
    expect(() => parseInfoRefs(textEncoder.encode("0002"))).toThrow(/bad pkt-line length/);
  });

  it("rejects truncated upload-pack side-band responses", async () => {
    await expect(
      uploadPack("https://example.test/repo", "1".repeat(40), {
        fetchImpl: testFetch(async () => new Response(textEncoder.encode("0009\u0001PAC"))),
      }),
    ).rejects.toThrow(/truncated upload-pack response/);
  });

  it.effect("rejects private git hosts under cloud posture", () =>
    Effect.gen(function* () {
      for (const url of [
        "https://localhost/repo.git",
        "https://127.0.0.1/repo.git",
        "https://[::ffff:127.0.0.1]/repo.git",
        "https://2130706433/repo.git",
        "https://0177.0.0.1/repo.git",
        "https://0x7f.0.0.1/repo.git",
        "https://10.1.2.3/repo.git",
        "https://169.254.1.1/repo.git",
      ]) {
        const exit = yield* Effect.exit(parseGitSourceUrl(url));
        expect(Exit.isFailure(exit)).toBe(true);
      }
      expect(yield* parseGitSourceUrl("https://gitlab.com/acme/tools.git")).toBeInstanceOf(URL);
    }),
  );

  it("rejects redirects to private or non-https git hosts", async () => {
    const exit = await Effect.runPromiseExit(
      checkGitAppSourceRefs({
        url: "https://example.test/repo",
        fetch: testFetch(
          async () =>
            new Response(null, {
              status: 302,
              headers: { location: "http://127.0.0.1/repo.git/info/refs" },
            }),
        ),
      }),
    );
    expect(Exit.isFailure(exit)).toBe(true);
  });

  it("drops the authorization header on cross-host redirects", async () => {
    const seenAuth: Array<string | null> = [];
    const fetchImpl = testFetch(async (input, init) => {
      const url = new URL(typeof input === "string" ? input : input instanceof URL ? input : "");
      const headers = new Headers(init?.headers);
      seenAuth.push(headers.get("authorization"));
      if (url.hostname === "example.test") {
        return new Response(null, {
          status: 302,
          headers: { location: "https://mirror.test/repo.git/info/refs?service=git-upload-pack" },
        });
      }
      return new Response(
        new Uint8Array(advertisement("1111111111111111111111111111111111111111")),
        {
          headers: { "content-type": "application/x-git-upload-pack-advertisement" },
        },
      );
    });
    const result = await checkRefs(
      "https://example.test/repo",
      { authorization: "Basic secret" },
      fetchImpl,
    );
    expect(result.adv.headTarget).toBe("refs/heads/main");
    expect(seenAuth).toEqual(["Basic secret", null]);
  });

  it("enforces pack expansion caps during parse and delta application", async () => {
    await expect(
      parsePack(packFile([packedObject(3, textEncoder.encode("tiny"))]), {
        limits: { maxObjectBytes: 3 },
      }),
    ).rejects.toThrow(/repository too large/);

    const base = textEncoder.encode("a");
    const baseSha = await gitObjectId("blob", base);
    const delta = concat([deltaVarint(base.length), deltaVarint(1024), Uint8Array.from([1, 120])]);
    const refDelta = concat([
      packObjectHeader(7, delta.length),
      hexBytes(baseSha),
      deflateSync(delta),
    ]);
    await expect(
      parsePack(packFile([packedObject(3, base), refDelta]), {
        limits: { maxDeltaResultBytes: 32 },
      }),
    ).rejects.toThrow(/repository too large/);
  });

  it("rejects truncated packs, oversized varints, and malformed trees", async () => {
    await expect(parsePack(textEncoder.encode("PACK"))).rejects.toThrow(/pack parse error/);
    await expect(
      parsePack(
        packFile([
          Uint8Array.from([0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0]),
        ]),
      ),
    ).rejects.toThrow(/varint is too long/);

    const malformedTree = textEncoder.encode("100644 missing-nul");
    const treeSha = await gitObjectId("tree", malformedTree);
    const commit = textEncoder.encode(`tree ${treeSha}\n\nbad tree\n`);
    const commitSha = await gitObjectId("commit", commit);
    const parsed = await parsePack(
      packFile([packedObject(1, commit), packedObject(2, malformedTree)]),
    );
    expect(() => walkTree(parsed, commitSha)).toThrow(/malformed tree/);
  });

  it("fetches a fixture git repo and avoids pack download when the sha is unchanged", async () => {
    const server = await fixtureServer();
    try {
      const firstRefs = await run(
        checkGitAppSourceRefs({
          url: server.url,
          fetch: server.fetch,
          allowPrivateHosts: true,
        }),
      );
      const first = await run(
        fetchGitAppSource({
          url: server.url,
          fetch: server.fetch,
          allowPrivateHosts: true,
        }),
      );
      expect(first.sourceRef).toBe(firstRefs.sourceRef);
      expect(first.files.map((file) => file.path).sort()).toEqual([
        "executor.json",
        "tools/greeter.ts",
      ]);
      expect(server.packRequests()).toBe(1);

      const unchanged = await run(
        checkGitAppSourceRefs({
          url: server.url,
          fetch: server.fetch,
          allowPrivateHosts: true,
        }),
      );
      expect(unchanged.sourceRef).toBe(first.sourceRef);
      expect(server.packRequests()).toBe(1);

      server.advance();
      const second = await run(
        fetchGitAppSource({
          url: server.url,
          fetch: server.fetch,
          allowPrivateHosts: true,
        }),
      );
      expect(second.sourceRef).not.toBe(first.sourceRef);
      expect(
        textDecoder.decode(second.files.find((file) => file.path === "tools/greeter.ts")?.bytes),
      ).toContain("Greeting v2");
      expect(server.packRequests()).toBe(2);
    } finally {
      await server.close();
    }
  });

  it("surfaces oversized packfiles as source failures", async () => {
    const server = await fixtureServer();
    try {
      const exit = await Effect.runPromiseExit(
        fetchGitAppSource({
          url: server.url,
          fetch: server.fetch,
          allowPrivateHosts: true,
          maxBytes: 32,
        }),
      );
      expect(Exit.isFailure(exit)).toBe(true);
    } finally {
      await server.close();
    }
  });

  it("checks live github and gitlab refs when online", async () => {
    if (!(await liveOrSkip("https://github.com"))) return;
    if (!(await liveOrSkip("https://gitlab.com"))) return;
    const github = await run(
      checkGitAppSourceRefs({ url: "https://github.com/octocat/Hello-World" }),
    );
    const gitlab = await run(
      checkGitAppSourceRefs({ url: "https://gitlab.com/gitlab-org/gitlab-test" }),
    );
    expect(github.sourceRef).toMatch(/^[0-9a-f]{40}$/);
    expect(gitlab.sourceRef).toMatch(/^[0-9a-f]{40}$/);
  });

  it("fetches a tiny live public repo when online", async () => {
    if (!(await liveOrSkip("https://github.com"))) return;
    const source = await handFetch("https://github.com/octocat/Hello-World", undefined, {
      maxBytes: PUBLISH_LIMITS.maxTotalBytes,
    });
    expect(source.ok).toBe(true);
    expect(source.sha).toMatch(/^[0-9a-f]{40}$/);
    expect(source.files?.some((file) => file.path.toLowerCase().includes("readme"))).toBe(true);
  });
});

describe("local-directory app sources", () => {
  it("reads local directories and hashes content deterministically", async () => {
    const root = await mkdtemp();
    await mkdir(join(root, "tools"));
    await mkdir(join(root, "workflows"));
    await writeFile(join(root, "executor.json"), JSON.stringify({ description: "Local tools" }));
    await writeFile(join(root, "tools", "hello.ts"), "export default {};");
    await writeFile(join(root, "workflows", "later.ts"), "export default {};");
    await symlink(join(root, "tools", "hello.ts"), join(root, "tools", "link.ts"));

    const first = await run(fetchLocalDirectoryAppSource({ path: root }));
    const second = await run(fetchLocalDirectoryAppSource({ path: root }));
    expect(first.sourceRef).toBe(second.sourceRef);
    expect(first.description).toBe("Local tools");
    expect(first.files.map((file) => file.path).sort()).toEqual([
      "executor.json",
      "tools/hello.ts",
    ]);
    expect(first.skipped).toContainEqual({
      path: "tools/link.ts",
      reason: "unsupported file type",
    });
    expect(first.skipped).toContainEqual({
      path: "workflows/later.ts",
      reason: "not supported yet",
    });
  });

  it("rejects unsafe local-directory paths", async () => {
    const relative = await Effect.runPromiseExit(
      fetchLocalDirectoryAppSource({ path: "relative" }),
    );
    const parent = await Effect.runPromiseExit(
      fetchLocalDirectoryAppSource({ path: "/tmp/../bad" }),
    );
    expect(Exit.isFailure(relative)).toBe(true);
    expect(Exit.isFailure(parent)).toBe(true);
  });

  it("does not read symlinks that escape the source root", async () => {
    const root = await mkdtemp();
    const outside = await mkdtemp();
    await mkdir(join(root, "tools"));
    await writeFile(join(outside, "secret.ts"), "export default 'secret';");
    await symlink(join(outside, "secret.ts"), join(root, "tools", "secret.ts"));

    const result = await run(fetchLocalDirectoryAppSource({ path: root }));
    expect(result.files).toEqual([]);
    expect(result.skipped).toContainEqual({
      path: "tools/secret.ts",
      reason: "unsupported file type",
    });
  });
});

const mkdtemp = (): Promise<string> =>
  import("node:fs/promises").then(({ mkdtemp }) => mkdtemp(join(tmpdir(), "apps-src-")));