// ---------------------------------------------------------------------------
// Fidelity tests for the OAuth popup HTML generator + callback wrapper.
// Locks in the escaping rules, postMessage/BroadcastChannel behavior, and
// the completeOAuth-to-popup-payload conversion semantics so the google-
// discovery port is provably behavior-preserving.
// ---------------------------------------------------------------------------

import { describe, expect, it } from "vitest";
import { Effect } from "effect";

import {
  OAUTH_POPUP_MESSAGE_TYPE,
  popupDocument,
  runOAuthCallback,
  type OAuthPopupResult,
} from "./http";

type GoogleAuth = {
  kind: "oauth2";
  accessTokenSecretId: string;
  refreshTokenSecretId: string | null;
};

// ---------------------------------------------------------------------------
// popupDocument
// ---------------------------------------------------------------------------

describe("popupDocument", () => {
  const successPayload: OAuthPopupResult<GoogleAuth> = {
    type: OAUTH_POPUP_MESSAGE_TYPE,
    ok: true,
    sessionId: "session-abc",
    kind: "oauth2",
    accessTokenSecretId: "secret_1",
    refreshTokenSecretId: "secret_2",
  };

  it("renders a success page with Connected title and the green check icon", () => {
    const html = popupDocument(successPayload, "channel-x");
    expect(html).toContain("<title>Connected</title>");
    expect(html).toContain("#22c55e");
    expect(html).toContain("Authentication complete");
  });

  it("renders a failure page with the error text escaped", () => {
    const html = popupDocument(
      {
        type: OAUTH_POPUP_MESSAGE_TYPE,
        ok: false,
        sessionId: null,
        error: "Token endpoint returned 400 <script>alert(1)</script>",
      },
      "channel-x",
    );
    expect(html).toContain("<title>Connection failed</title>");
    expect(html).toContain("#ef4444");
    expect(html).toContain("Token endpoint returned 400 &lt;script&gt;alert(1)&lt;/script&gt;");
    expect(html).not.toContain("<script>alert(1)</script>");
  });

  it("HTML-escapes the BroadcastChannel name so attacker-controlled names cannot break out", () => {
    const html = popupDocument(successPayload, 'evil"name');
    expect(html).toContain('new BroadcastChannel("evil&quot;name")');
  });

  it("escapes < > & in the serialized script payload to prevent </script> breakout", () => {
    const html = popupDocument(
      {
        type: OAUTH_POPUP_MESSAGE_TYPE,
        ok: false,
        sessionId: null,
        error: "</script><img/src=x onerror=alert(1)>",
      },
      "channel-x",
    );
    // The raw `</script>` must not appear in the inline script literal.
    const scriptLiteralMatch = /const p=(\{.*?\});/.exec(html);
    expect(scriptLiteralMatch).not.toBeNull();
    const scriptLiteral = scriptLiteralMatch![1]!;
    expect(scriptLiteral).not.toContain("</script>");
    expect(scriptLiteral).toContain("\\u003c/script\\u003e");
  });

  it("posts to window.opener AND falls back to BroadcastChannel with the given channel name", () => {
    const html = popupDocument(successPayload, "executor:openapi-oauth-result");
    expect(html).toContain("window.opener.postMessage(p,window.location.origin)");
    expect(html).toContain('new BroadcastChannel("executor:openapi-oauth-result")');
    expect(html).toContain("window.close()");
  });

  it("includes dark-mode CSS", () => {
    const html = popupDocument(successPayload, "c");
    expect(html).toContain("@media(prefers-color-scheme:dark)");
  });
});

// ---------------------------------------------------------------------------
// runOAuthCallback
// ---------------------------------------------------------------------------

describe("runOAuthCallback", () => {
  it("renders a success popup when completeOAuth succeeds", async () => {
    const html = await Effect.runPromise(
      runOAuthCallback<GoogleAuth, never, never>({
        complete: () =>
          Effect.succeed({
            kind: "oauth2",
            accessTokenSecretId: "s1",
            refreshTokenSecretId: "s2",
          }),
        urlParams: { state: "session-xyz", code: "abc" },
        toErrorMessage: () => "should not reach",
        channelName: "channel-x",
      }),
    );
    expect(html).toContain("<title>Connected</title>");
    expect(html).toContain("session-xyz");
    expect(html).toContain("s1");
  });

  it("passes code and error through to the complete callback verbatim", async () => {
    const received: Array<{ state: string; code: string | null; error: string | null }> = [];
    await Effect.runPromise(
      runOAuthCallback<GoogleAuth, never, never>({
        complete: (params) => {
          received.push(params);
          return Effect.succeed({
            kind: "oauth2",
            accessTokenSecretId: "s",
            refreshTokenSecretId: null,
          });
        },
        urlParams: { state: "s1", code: "code1", error: null },
        toErrorMessage: () => "",
        channelName: "c",
      }),
    );
    expect(received).toEqual([{ state: "s1", code: "code1", error: null }]);
  });

  it("prefers `error` over `error_description` but falls back when absent", async () => {
    const received: Array<{ state: string; code: string | null; error: string | null }> = [];
    const complete = (params: { state: string; code: string | null; error: string | null }) => {
      received.push(params);
      return Effect.succeed({
        kind: "oauth2" as const,
        accessTokenSecretId: "s",
        refreshTokenSecretId: null,
      });
    };
    await Effect.runPromise(
      runOAuthCallback<GoogleAuth, never, never>({
        complete,
        urlParams: { state: "s1", error: "access_denied" },
        toErrorMessage: () => "",
        channelName: "c",
      }),
    );
    await Effect.runPromise(
      runOAuthCallback<GoogleAuth, never, never>({
        complete,
        urlParams: { state: "s2", error_description: "user cancelled" },
        toErrorMessage: () => "",
        channelName: "c",
      }),
    );
    expect(received[0]!.error).toBe("access_denied");
    expect(received[1]!.error).toBe("user cancelled");
  });

  it("renders a failure popup when completeOAuth fails and uses toErrorMessage", async () => {
    class DomainError {
      readonly _tag = "DomainError";
      constructor(readonly message: string) {}
    }
    const html = await Effect.runPromise(
      runOAuthCallback<GoogleAuth, DomainError, never>({
        complete: () => Effect.fail(new DomainError("Code expired")),
        urlParams: { state: "s1" },
        toErrorMessage: (error) =>
          error instanceof DomainError ? error.message : "unknown",
        channelName: "c",
      }),
    );
    expect(html).toContain("<title>Connection failed</title>");
    expect(html).toContain("Code expired");
  });

  it("never rejects — even defects are rendered as a failure popup", async () => {
    const html = await Effect.runPromise(
      runOAuthCallback<GoogleAuth, never, never>({
        complete: () => Effect.die("boom"),
        urlParams: { state: "s1" },
        toErrorMessage: () => "transport error",
        channelName: "c",
      }),
    );
    expect(html).toContain("<title>Connection failed</title>");
    expect(html).toContain("transport error");
  });
});