import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest";
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { startServer, type ServerInstance } from "./serve";

let clientDir: string;
let server: ServerInstance | null = null;

const startTestServer = async (): Promise<string> => {
  server = await startServer({
    port: 0,
    hostname: "127.0.0.1",
    clientDir,
    handlers: {
      api: {
        handler: async () => new Response("ok"),
        dispose: async () => {},
      },
      mcp: {
        handleRequest: async () => new Response("ok"),
        handleApprovalRequest: async () => new Response("ok"),
        close: async () => {},
      },
    },
  });
  return `http://127.0.0.1:${server.port}`;
};

beforeEach(() => {
  clientDir = mkdtempSync(join(tmpdir(), "exec-local-serve-"));
  mkdirSync(join(clientDir, "assets"), { recursive: true });
  writeFileSync(
    join(clientDir, "index.html"),
    "<!doctype html><html><body>index-shell</body></html>",
  );
  writeFileSync(join(clientDir, "assets", "app.js"), "console.log('ok')");
});

afterEach(async () => {
  if (server) {
    await server.stop();
    server = null;
  }
  rmSync(clientDir, { recursive: true, force: true });
});

describe("startServer static/SPA routing", () => {
  it("returns 404 for missing asset-like paths", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/assets/missing.js`);

    expect(response.status).toBe(404);
    expect(await response.text()).toBe("Not Found");
  });

  it("falls back to index.html for extension-less SPA routes", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/sources/add`);

    expect(response.status).toBe(200);
    expect(response.headers.get("content-type")).toContain("text/html");
    expect(await response.text()).toContain("index-shell");
  });
});

describe("startServer network bind auth", () => {
  it("refuses non-loopback binds without a token or password", async () => {
    await expect(
      startServer({
        port: 0,
        hostname: "0.0.0.0",
        clientDir,
        handlers: {
          api: {
            handler: async () => new Response("ok"),
            dispose: async () => {},
          },
          mcp: {
            handleRequest: async () => new Response("ok"),
            handleApprovalRequest: async () => new Response("ok"),
            close: async () => {},
          },
        },
      }),
    ).rejects.toThrow("non-loopback host without an auth token or password");
  });

  it("requires the configured token when auth is enabled", async () => {
    server = await startServer({
      port: 0,
      hostname: "127.0.0.1",
      clientDir,
      authToken: "test-token",
      handlers: {
        api: {
          handler: async () => new Response("ok"),
          dispose: async () => {},
        },
        mcp: {
          handleRequest: async () => new Response("ok"),
          handleApprovalRequest: async () => new Response("ok"),
          close: async () => {},
        },
      },
    });

    const baseUrl = `http://127.0.0.1:${server.port}`;
    const unauthorized = await fetch(`${baseUrl}/api/health`);
    expect(unauthorized.status).toBe(401);

    const authorized = await fetch(`${baseUrl}/api/health`, {
      headers: { authorization: "Bearer test-token" },
    });
    expect(authorized.status).toBe(200);
    expect(await authorized.text()).toBe("ok");
  });

  it("answers browser CORS preflights before auth", async () => {
    server = await startServer({
      port: 0,
      hostname: "127.0.0.1",
      clientDir,
      authToken: "test-token",
      handlers: {
        api: {
          handler: async () => new Response("ok"),
          dispose: async () => {},
        },
        mcp: {
          handleRequest: async () => new Response("ok"),
          handleApprovalRequest: async () => new Response("ok"),
          close: async () => {},
        },
      },
    });

    const response = await fetch(`http://127.0.0.1:${server.port}/api/scope`, {
      method: "OPTIONS",
      headers: {
        origin: "http://127.0.0.1:4789",
        "access-control-request-method": "GET",
        "access-control-request-headers": "authorization,b3,traceparent",
      },
    });

    expect(response.status).toBe(204);
    expect(response.headers.get("access-control-allow-origin")).toBe("http://127.0.0.1:4789");
    expect(response.headers.get("access-control-allow-credentials")).toBe("true");
    expect(response.headers.get("access-control-allow-headers")).toContain("traceparent");
    expect(response.headers.get("access-control-allow-headers")).toContain("b3");
  });

  it("adds CORS headers to authenticated API failures", async () => {
    server = await startServer({
      port: 0,
      hostname: "127.0.0.1",
      clientDir,
      authToken: "test-token",
      handlers: {
        api: {
          handler: async () => new Response("ok"),
          dispose: async () => {},
        },
        mcp: {
          handleRequest: async () => new Response("ok"),
          handleApprovalRequest: async () => new Response("ok"),
          close: async () => {},
        },
      },
    });

    const response = await fetch(`http://127.0.0.1:${server.port}/api/scope`, {
      headers: { origin: "http://127.0.0.1:4789" },
    });

    expect(response.status).toBe(401);
    expect(response.headers.get("access-control-allow-origin")).toBe("http://127.0.0.1:4789");
    expect(response.headers.get("access-control-allow-credentials")).toBe("true");
    expect(response.headers.get("access-control-allow-headers")).toContain("traceparent");
  });

  it("does not expose unauthenticated loopback servers cross-origin", async () => {
    const baseUrl = await startTestServer();
    const response = await fetch(`${baseUrl}/api/scope`, {
      headers: { origin: "https://example.com" },
    });

    expect(response.status).toBe(200);
    expect(response.headers.get("access-control-allow-origin")).toBeNull();
  });
});