import { expect, it, vi } from "vite-plus/test";

import { handleRequest, type GitHubEventsEnv } from "./app.ts";

const WEBHOOK_SECRET = "w".repeat(32);
const FEED_TOKEN = "f".repeat(32);

async function sign(body: Uint8Array, secret: string): Promise<string> {
  const key = await crypto.subtle.importKey(
    "raw",
    new TextEncoder().encode(secret),
    { hash: "SHA-256", name: "HMAC" },
    false,
    ["sign"],
  );
  const digest = new Uint8Array(await crypto.subtle.sign("HMAC", key, body.buffer as ArrayBuffer));
  return `sha256=${Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
}

it("verifies, normalizes, and persists github webhook deliveries", async () => {
  const payload = {
    action: "created",
    repository: {
      id: 1,
      full_name: "pingdotgg/t3code",
      html_url: "https://github.com/pingdotgg/t3code",
    },
    sender: { id: 2, login: "contributor" },
    issue: {
      number: 42,
      title: "fix the thing",
      state: "open",
      locked: false,
      user: { id: 2, login: "contributor" },
      labels: [],
      pull_request: {
        url: "https://api.github.com/repos/pingdotgg/t3code/pulls/42",
        html_url: "https://github.com/pingdotgg/t3code/pull/42",
      },
    },
    comment: {
      id: 99,
      body: "please add a regression test",
      user: { id: 2, login: "contributor" },
    },
  };
  const body = new TextEncoder().encode(JSON.stringify(payload));
  let forwarded: Request | undefined;
  const hubFetch = vi.fn(async (request: Request) => {
    forwarded = request;
    return new Response(null, { status: 201 });
  });
  const env = {
    GITHUB_WEBHOOK_SECRET: WEBHOOK_SECRET,
    GITHUB_EVENTS_FEED_TOKEN: FEED_TOKEN,
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: {
      getByName: () => ({ fetch: hubFetch }),
    },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(
    new Request("https://events.example/v1/github/webhook", {
      method: "POST",
      body,
      headers: {
        "content-type": "application/json",
        "x-github-delivery": "delivery-1",
        "x-github-event": "issue_comment",
        "x-hub-signature-256": await sign(body, WEBHOOK_SECRET),
      },
    }),
    env,
  );

  expect(response.status).toBe(202);
  expect(hubFetch).toHaveBeenCalledOnce();
  if (!forwarded) throw new Error("webhook was not forwarded");
  expect(await forwarded.json()).toMatchObject({
    deliveryId: "delivery-1",
    details: { comment: { body: "please add a regression test" } },
  });
});

it("authenticates and forwards resumable pull request feeds", async () => {
  let forwarded: Request | undefined;
  const hubFetch = vi.fn(async (request: Request) => {
    forwarded = request;
    return new Response('id: 18\nevent: github\ndata: {"sequence":18}\n\n', {
      headers: { "content-type": "text/event-stream" },
    });
  });
  const env = {
    GITHUB_WEBHOOK_SECRET: WEBHOOK_SECRET,
    GITHUB_EVENTS_FEED_TOKEN: FEED_TOKEN,
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: {
      getByName: () => ({ fetch: hubFetch }),
    },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(
    new Request("https://events.example/v1/repos/pingdotgg/t3code/events?pull=42", {
      headers: {
        authorization: `Bearer ${FEED_TOKEN}`,
        "last-event-id": "17",
      },
    }),
    env,
  );

  expect(response.status).toBe(200);
  expect(response.headers.get("content-type")).toBe("text/event-stream");
  expect(await response.text()).toContain("id: 18");
  if (!forwarded) throw new Error("feed was not forwarded");
  expect(new URL(forwarded.url).searchParams.get("after")).toBe("17");
  expect(new URL(forwarded.url).searchParams.get("pull")).toBe("42");
});

it("rejects oversized webhook payloads before reading them", async () => {
  const hubFetch = vi.fn(async () => new Response(null, { status: 201 }));
  const env = {
    GITHUB_WEBHOOK_SECRET: WEBHOOK_SECRET,
    GITHUB_EVENTS_FEED_TOKEN: FEED_TOKEN,
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: { getByName: () => ({ fetch: hubFetch }) },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(
    new Request("https://events.example/v1/github/webhook", {
      method: "POST",
      body: "{}",
      headers: {
        "content-length": String(1024 * 1024 + 1),
        "x-github-delivery": "delivery-large",
        "x-github-event": "pull_request",
        "x-hub-signature-256": "sha256=invalid",
      },
    }),
    env,
  );

  expect(response.status).toBe(413);
  expect(hubFetch).not.toHaveBeenCalled();
});

it("rejects webhook deliveries with invalid signatures", async () => {
  const hubFetch = vi.fn(async () => new Response(null, { status: 201 }));
  const env = {
    GITHUB_WEBHOOK_SECRET: WEBHOOK_SECRET,
    GITHUB_EVENTS_FEED_TOKEN: FEED_TOKEN,
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: { getByName: () => ({ fetch: hubFetch }) },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(
    new Request("https://events.example/v1/github/webhook", {
      method: "POST",
      body: "{}",
      headers: {
        "x-github-delivery": "forged-delivery",
        "x-github-event": "pull_request",
        "x-hub-signature-256": `sha256=${"0".repeat(64)}`,
      },
    }),
    env,
  );

  expect(response.status).toBe(401);
  expect(hubFetch).not.toHaveBeenCalled();
});

it("rejects malformed repository paths without reaching storage", async () => {
  const hubFetch = vi.fn(async () => new Response("unexpected"));
  const env = {
    GITHUB_WEBHOOK_SECRET: WEBHOOK_SECRET,
    GITHUB_EVENTS_FEED_TOKEN: FEED_TOKEN,
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: { getByName: () => ({ fetch: hubFetch }) },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(
    new Request("https://events.example/v1/repos/%E0%A4%A/t3code/events", {
      headers: { authorization: `Bearer ${FEED_TOKEN}` },
    }),
    env,
  );

  expect(response.status).toBe(400);
  expect(hubFetch).not.toHaveBeenCalled();
});

it("rejects feed requests with invalid bearer tokens", async () => {
  const hubFetch = vi.fn(async () => new Response("unexpected"));
  const env = {
    GITHUB_WEBHOOK_SECRET: WEBHOOK_SECRET,
    GITHUB_EVENTS_FEED_TOKEN: FEED_TOKEN,
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: { getByName: () => ({ fetch: hubFetch }) },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(
    new Request("https://events.example/v1/repos/pingdotgg/t3code/events", {
      headers: { authorization: "Bearer wrong-token" },
    }),
    env,
  );

  expect(response.status).toBe(401);
  expect(hubFetch).not.toHaveBeenCalled();
});

it("fails closed when secrets are too short", async () => {
  const env = {
    GITHUB_WEBHOOK_SECRET: "short",
    GITHUB_EVENTS_FEED_TOKEN: "short",
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: { getByName: () => ({ fetch: vi.fn() }) },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(new Request("https://events.example/health"), env);
  expect(response.status).toBe(503);

  const missingSecret = {
    ...env,
    GITHUB_WEBHOOK_SECRET: undefined,
  } as unknown as GitHubEventsEnv;
  const missingResponse = await handleRequest(
    new Request("https://events.example/health"),
    missingSecret,
  );
  expect(missingResponse.status).toBe(503);
});

it("returns a stable error when event storage is unavailable", async () => {
  const hubFetch = vi.fn(async () => {
    throw new Error("storage unavailable");
  });
  const env = {
    GITHUB_WEBHOOK_SECRET: WEBHOOK_SECRET,
    GITHUB_EVENTS_FEED_TOKEN: FEED_TOKEN,
    GITHUB_REPOSITORY: "pingdotgg/t3code",
    GITHUB_EVENT_HUB: { getByName: () => ({ fetch: hubFetch }) },
  } satisfies GitHubEventsEnv;

  const response = await handleRequest(
    new Request("https://events.example/v1/repos/pingdotgg/t3code/events", {
      headers: { authorization: `Bearer ${FEED_TOKEN}` },
    }),
    env,
  );
  expect(response.status).toBe(502);

  const lookupFailureEnv = {
    ...env,
    GITHUB_EVENT_HUB: {
      getByName: () => {
        throw new Error("namespace unavailable");
      },
    },
  } satisfies GitHubEventsEnv;
  const lookupFailure = await handleRequest(
    new Request("https://events.example/v1/repos/pingdotgg/t3code/events", {
      headers: { authorization: `Bearer ${FEED_TOKEN}` },
    }),
    lookupFailureEnv,
  );
  expect(lookupFailure.status).toBe(502);
});