import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest";
import { existsSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { acquireDataDirOwnership } from "./db/data-dir-ownership";
import { startServer, type ServerInstance } from "./serve";

let clientDir: string;
let dataDir: string;
let server: ServerInstance | null = null;

const TOKEN = "test-token";

const testHandlers = () => ({
  api: {
    handler: async () => new Response("ok"),
    dispose: async () => {},
  },
  mcp: {
    handleRequest: async () => new Response("ok"),
    handleApprovalRequest: async () => new Response("ok"),
    handlePausedRequest: async () => new Response("ok"),
    close: async () => {},
  },
});

const startTestServer = async (
  opts: { authToken?: string; hostname?: string } = {},
): Promise<string> => {
  server = await startServer({
    port: 0,
    hostname: opts.hostname ?? "127.0.0.1",
    clientDir,
    authToken: opts.authToken ?? TOKEN,
    handlers: testHandlers(),
  });
  return `http://127.0.0.1:${server.port}`;
};

beforeEach(() => {
  clientDir = mkdtempSync(join(tmpdir(), "exec-local-serve-"));
  dataDir = mkdtempSync(join(tmpdir(), "exec-local-data-"));
  // Isolate auth.json writes and dynamic plugin lookup from the real ~/.executor/workspace.
  process.env.EXECUTOR_DATA_DIR = dataDir;
  process.env.EXECUTOR_SCOPE_DIR = dataDir;
  mkdirSync(join(clientDir, "assets"), { recursive: true });
  writeFileSync(
    join(clientDir, "index.html"),
    "<!doctype html><html><body>index-shell</body></html>",
  );
  writeFileSync(join(clientDir, "assets", "app.js"), "console.log('ok')");
});

afterEach(async () => {
  if (server) {
    await server.stop();
    server = null;
  }
  delete process.env.EXECUTOR_DATA_DIR;
  delete process.env.EXECUTOR_SCOPE_DIR;
  rmSync(clientDir, { recursive: true, force: true });
  rmSync(dataDir, { recursive: true, force: true });
});

describe("startServer static/SPA routing (unauthenticated)", () => {
  it("returns 404 for missing asset-like paths", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/assets/missing.js`);

    expect(response.status).toBe(404);
    expect(await response.text()).toBe("Not Found");
  });

  it("falls back to index.html for extension-less SPA routes without a token", async () => {
    const baseUrl = await startTestServer();
    // No Authorization header — the shell must still load so the browser can
    // read its `?_token` and authenticate subsequent /api calls.
    const response = await fetch(`${baseUrl}/integrations/add`);

    expect(response.status).toBe(200);
    expect(response.headers.get("content-type")).toContain("text/html");
    expect(await response.text()).toContain("index-shell");
  });
});

describe("startServer startup cleanup", () => {
  it("releases the owned DB when a default-handler server stops", async () => {
    server = await startServer({ port: 0, clientDir, authToken: TOKEN });
    await server.stop();
    server = null;

    const ownership = await acquireDataDirOwnership(dataDir);
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- test boundary: release the proof lock even if the assertion fails
    try {
      expect(ownership.lockPath).toContain("data.db.owner-lock");
    } finally {
      await ownership.release();
    }
  });

  it("releases the owned DB if Bun.serve fails after handler boot", async () => {
    const blocker = Bun.serve({
      port: 0,
      hostname: "127.0.0.1",
      fetch: () => new Response("busy"),
    });

    // oxlint-disable-next-line executor/no-try-catch-or-throw -- test boundary: keep the busy-port blocker alive only for this assertion and always stop it
    try {
      await expect(
        startServer({
          port: blocker.port,
          hostname: "127.0.0.1",
          clientDir,
          authToken: TOKEN,
        }),
      ).rejects.toThrow();

      const ownership = await acquireDataDirOwnership(dataDir);
      // oxlint-disable-next-line executor/no-try-catch-or-throw -- test boundary: release the proof lock even if the assertion fails
      try {
        expect(ownership.lockPath).toContain("data.db.owner-lock");
      } finally {
        await ownership.release();
      }
    } finally {
      blocker.stop(true);
    }
  });
});

describe("startServer bearer auth", () => {
  it("mints and persists a 0600 auth.json when no token is supplied", async () => {
    server = await startServer({ port: 0, clientDir, handlers: testHandlers() });
    const tokenPath = join(dataDir, "server-control", "auth.json");
    expect(existsSync(tokenPath)).toBe(true);
    // Owner read/write only.
    expect(statSync(tokenPath).mode & 0o777).toBe(0o600);
    expect(typeof server.authToken).toBe("string");
    expect(server.authToken.length).toBeGreaterThan(0);
  });

  it("serves /api/health without a token", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/api/health`);
    expect(response.status).toBe(200);
    expect(await response.text()).toBe("ok");
  });

  it("requires the bearer token on /api", async () => {
    const baseUrl = await startTestServer();

    const unauthorized = await fetch(`${baseUrl}/api/scope`);
    expect(unauthorized.status).toBe(401);
    expect(unauthorized.headers.get("www-authenticate")).toBe('Bearer realm="executor"');

    const authorized = await fetch(`${baseUrl}/api/scope`, {
      headers: { authorization: `Bearer ${TOKEN}` },
    });
    expect(authorized.status).toBe(200);
    expect(await authorized.text()).toBe("ok");
  });

  it("requires the bearer token on /mcp", async () => {
    const baseUrl = await startTestServer();

    const unauthorized = await fetch(`${baseUrl}/mcp`, { method: "POST" });
    expect(unauthorized.status).toBe(401);

    const authorized = await fetch(`${baseUrl}/mcp`, {
      method: "POST",
      headers: { authorization: `Bearer ${TOKEN}` },
    });
    expect(authorized.status).toBe(200);
  });

  it("leaves the OAuth provider callback unauthenticated (state-gated)", async () => {
    const baseUrl = await startTestServer();
    // Reaches the api handler ("ok") rather than a 401 — the callback path is
    // exempt because the external provider browser can't carry the bearer.
    const response = await fetch(`${baseUrl}/api/oauth/callback?state=abc`);
    expect(response.status).toBe(200);
  });

  it("serves the CIMD client metadata document without a bearer", async () => {
    const baseUrl = await startTestServer();
    const documentUrl = `${baseUrl}/api/oauth/client-id-metadata/local.json`;
    const response = await fetch(documentUrl);
    expect(response.status).toBe(200);
    const metadata = (await response.json()) as {
      readonly client_id: string;
      readonly redirect_uris: readonly string[];
      readonly application_type: string;
    };
    expect(metadata.client_id).toBe(documentUrl);
    expect(metadata.redirect_uris).toEqual([
      "http://127.0.0.1/api/oauth/callback",
      "http://localhost/api/oauth/callback",
      "http://[::1]/api/oauth/callback",
    ]);
    expect(metadata.application_type).toBe("native");
  });

  it("requires the bearer token on the OAuth await poll", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/api/oauth/await/session-1`);
    expect(response.status).toBe(401);
  });

  it("auto-mints a token on a non-loopback bind instead of refusing", async () => {
    server = await startServer({
      port: 0,
      hostname: "0.0.0.0",
      clientDir,
      handlers: testHandlers(),
    });
    expect(server.authToken.length).toBeGreaterThan(0);
  });
});

describe("startServer CORS hardening", () => {
  it("reflects credentialed CORS only for allowed loopback origins", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/api/health`, {
      headers: { origin: "http://127.0.0.1:4789" },
    });
    expect(response.headers.get("access-control-allow-origin")).toBe("http://127.0.0.1:4789");
    expect(response.headers.get("access-control-allow-credentials")).toBe("true");
  });

  it("does not send CORS headers to a disallowed origin", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/api/health`, {
      headers: { origin: "https://evil.example" },
    });
    expect(response.headers.get("access-control-allow-origin")).toBeNull();
  });

  it("answers browser CORS preflights before auth", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/api/scope`, {
      method: "OPTIONS",
      headers: {
        origin: "http://127.0.0.1:4789",
        "access-control-request-method": "GET",
        "access-control-request-headers": "authorization,b3,traceparent",
      },
    });

    expect(response.status).toBe(204);
    expect(response.headers.get("access-control-allow-origin")).toBe("http://127.0.0.1:4789");
    expect(response.headers.get("access-control-allow-credentials")).toBe("true");
    expect(response.headers.get("access-control-allow-headers")).toContain("traceparent");
  });
});