// @effect-diagnostics nodeBuiltinImport:off - Encrypts fixtures with the same
// OSCrypt primitives the module under test decrypts.
import * as NodeServices from "@effect/platform-node/NodeServices";
import { describe, expect, it } from "@effect/vitest";
import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient";
import * as NodeCrypto from "node:crypto";
import * as Effect from "effect/Effect";
import * as FileSystem from "effect/FileSystem";
import * as SqlClient from "effect/unstable/sql/SqlClient";

import {
  decryptChromiumValue,
  readChromiumCookieDatabase,
  readChromiumCookies,
} from "./ChromiumCookies.ts";
import { ChromiumKeyError } from "./ChromiumKeys.ts";
import { LinuxBrowserSecretPath } from "./LinuxBrowserSecret.ts";
import { cookieScope } from "./CookieDatabase.ts";

const encryptChromium = (
  prefix: "v10" | "v11",
  value: string | Buffer,
  key: Buffer,
): Uint8Array => {
  const cipher = NodeCrypto.createCipheriv("aes-128-cbc", key, Buffer.alloc(16, 0x20));
  return Buffer.concat([Buffer.from(prefix), cipher.update(value), cipher.final()]);
};

const encryptV10 = (value: string | Buffer, key: Buffer): Uint8Array =>
  encryptChromium("v10", value, key);

const encryptWindowsV10 = (value: string | Buffer, key: Buffer): Uint8Array => {
  const nonce = Buffer.from("0123456789ab");
  const cipher = NodeCrypto.createCipheriv("aes-256-gcm", key, nonce);
  const encrypted = Buffer.concat([cipher.update(value), cipher.final()]);
  return Buffer.concat([Buffer.from("v10"), nonce, encrypted, cipher.getAuthTag()]);
};

describe("cookieScope", () => {
  it("keeps a host-only cookie host-only", () => {
    // Chromium stores a host-only cookie without a leading dot. Passing any
    // `domain` to Electron makes it a domain cookie and re-adds the dot, which
    // would expose the cookie to every subdomain it was never scoped to.
    expect(cookieScope("example.test", "/", true)).toEqual({
      url: "https://example.test/",
      domain: undefined,
    });
  });

  it("preserves a domain cookie's leading dot", () => {
    expect(cookieScope(".example.test", "/app", true)).toEqual({
      url: "https://example.test/app",
      domain: ".example.test",
    });
  });

  it("matches the scheme to the secure flag", () => {
    expect(cookieScope("example.test", "/", false).url).toBe("http://example.test/");
  });

  it("brackets bare IPv6 hosts without duplicating existing brackets", () => {
    expect(cookieScope("::1", "/", false)).toEqual({
      url: "http://[::1]/",
      domain: undefined,
    });
    expect(cookieScope("[::1]", "/app", true)).toEqual({
      url: "https://[::1]/app",
      domain: undefined,
    });
  });
});

describe("readChromiumCookieDatabase", () => {
  it("decrypts Windows v10 AES-GCM records and rejects app-bound v20 records", () => {
    const key = Buffer.from("0123456789abcdef0123456789abcdef");
    const host = ".example.test";
    const bound = Buffer.concat([
      NodeCrypto.createHash("sha256").update(host).digest(),
      Buffer.from("windows value"),
    ]);

    expect(
      decryptChromiumValue(encryptWindowsV10(bound, key), { gcmV10: key }, host, 24, "win32"),
    ).toBe("windows value");
    expect(
      decryptChromiumValue(Buffer.from("v20app-bound"), { gcmV10: key }, host, 24, "win32"),
    ).toBeNull();
    expect(
      decryptChromiumValue(
        encryptWindowsV10(bound, Buffer.alloc(32, 1)),
        { gcmV10: key },
        host,
        24,
        "win32",
      ),
    ).toBeNull();
  });

  it.effect(
    "reports the missing key when no cookies can be read, while preserving partial imports",
    () =>
      Effect.gen(function* () {
        const fileSystem = yield* FileSystem.FileSystem;
        const directory = yield* fileSystem.makeTempDirectoryScoped({
          prefix: "t3code-missing-key-",
        });
        const filename = `${directory}/Cookies`;
        const key = Buffer.from("0123456789abcdef");
        yield* Effect.gen(function* () {
          const sql = yield* SqlClient.SqlClient;
          yield* sql`create table meta (key text primary key, value text not null)`;
          yield* sql`insert into meta values ('version', 23)`;
          yield* sql`create table cookies (
          host_key text not null, name text not null, value text not null,
          encrypted_value blob not null, path text not null, expires_utc integer not null,
          is_secure integer not null, is_httponly integer not null, samesite integer not null,
          top_frame_site_key text not null default ''
        )`;
          yield* sql`insert into cookies values ('v11.example', 'session', '', ${encryptChromium("v11", "secret", key)}, '/', 0, 1, 1, 1, '')`;
        }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

        const error = yield* readChromiumCookies({
          cookieDatabasePath: filename,
          platform: "linux",
          linuxSecretApplication: "chromium",
          keychainService: undefined,
          keychainAccount: undefined,
        }).pipe(Effect.provideService(LinuxBrowserSecretPath, undefined), Effect.flip);
        expect(error.reason).toBe("keychainUnavailable");

        yield* Effect.gen(function* () {
          const sql = yield* SqlClient.SqlClient;
          yield* sql`insert into cookies values ('v10.example', 'readable', '', ${encryptV10("kept", key)}, '/', 0, 1, 1, 1, '')`;
        }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));
        const keys = {
          cbcV10: key,
          cbcV11Error: new ChromiumKeyError({ reason: "keychainUnavailable" }),
        };
        const partial = yield* readChromiumCookieDatabase(filename, keys, "linux");
        expect(partial.cookies.map((cookie) => cookie.value)).toEqual(["kept"]);
        expect(partial.undecryptable).toBe(1);

        // A partitioned-only jar does not need its key: it is skipped separately.
        yield* Effect.gen(function* () {
          const sql = yield* SqlClient.SqlClient;
          yield* sql`delete from cookies where name = 'readable'`;
          yield* sql`update cookies set top_frame_site_key = 'https://top.example'`;
        }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));
        const partitioned = yield* readChromiumCookieDatabase(filename, keys, "linux");
        expect(partitioned.cookies).toEqual([]);
        expect(partitioned.undecryptable).toBe(1);
      }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("reads plaintext, encrypted, and genuinely empty cookie values", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const filename = `${directory}/Cookies`;
      const key = Buffer.from("0123456789abcdef");

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value text not null)`;
        yield* sql`insert into meta values ('version', 23)`;
        yield* sql`
          create table cookies (
            host_key text not null,
            name text not null,
            value text not null,
            encrypted_value blob not null,
            path text not null,
            expires_utc integer not null,
            is_secure integer not null,
            is_httponly integer not null,
            samesite integer not null,
            top_frame_site_key text not null default ''
          )
        `;
        yield* sql`
          insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
            ('plain.example', 'plain', 'stored plaintext', ${new Uint8Array()}, '/', 0, 0, 0, -1)
        `;
        yield* sql`
          insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
            ('secure.example', 'encrypted', '', ${encryptV10("stored encrypted", key)}, '/', 0, 1, 1, 2)
        `;
        yield* sql`
          insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
            ('empty.example', 'empty', '', ${new Uint8Array()}, '/', 0, 0, 0, 0)
        `;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

      const result = yield* readChromiumCookieDatabase(filename, { cbcV10: key }, "darwin");

      expect(result.undecryptable).toBe(0);
      expect(result.cookies.map(({ name, value }) => ({ name, value }))).toEqual([
        { name: "plain", value: "stored plaintext" },
        { name: "encrypted", value: "stored encrypted" },
        { name: "empty", value: "" },
      ]);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("enforces domain binding only for schema 24 and newer", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const filename = `${directory}/Cookies`;
      const key = Buffer.from("0123456789abcdef");
      const boundValue = (host: string, value: string) =>
        Buffer.concat([NodeCrypto.createHash("sha256").update(host).digest(), Buffer.from(value)]);

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value text not null)`;
        yield* sql`insert into meta values ('version', 24)`;
        yield* sql`
          create table cookies (
            host_key text not null, name text not null, value text not null,
            encrypted_value blob not null, path text not null, expires_utc integer not null,
            is_secure integer not null, is_httponly integer not null, samesite integer not null,
            top_frame_site_key text not null default ''
          )
        `;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('bound.example', 'valid', '', ${encryptV10(boundValue("bound.example", "kept"), key)}, '/', 0, 1, 0, 0)`;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('wrong.example', 'mismatch', '', ${encryptV10(boundValue("another.example", "drop"), key)}, '/', 0, 1, 0, 0)`;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('short.example', 'short', '', ${encryptV10("short value", key)}, '/', 0, 1, 0, 0)`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

      const result = yield* readChromiumCookieDatabase(filename, { cbcV10: key }, "darwin");

      expect(result.cookies.map(({ name, value }) => ({ name, value }))).toEqual([
        { name: "valid", value: "kept" },
      ]);
      expect(result.undecryptable).toBe(2);
      expect(result.undecryptableHosts).toEqual(["wrong.example", "short.example"]);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("decrypts mixed v10 and v11 cookies with their respective keys", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const filename = `${directory}/Cookies`;
      const cbcV10 = Buffer.from("0123456789abcdef");
      const cbcV11 = Buffer.from("fedcba9876543210");
      const boundValue = (host: string, value: string) =>
        Buffer.concat([NodeCrypto.createHash("sha256").update(host).digest(), Buffer.from(value)]);

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value text not null)`;
        yield* sql`insert into meta values ('version', '24')`;
        yield* sql`
          create table cookies (
            host_key text not null, name text not null, value text not null,
            encrypted_value blob not null, path text not null, expires_utc integer not null,
            is_secure integer not null, is_httponly integer not null, samesite integer not null,
            top_frame_site_key text not null default ''
          )
        `;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('v10.example', 'v10-cookie', '', ${encryptChromium("v10", boundValue("v10.example", "v10 value"), cbcV10)}, '/', 0, 1, 0, 0)`;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('v11.example', 'v11-cookie', '', ${encryptChromium("v11", boundValue("v11.example", "v11 value"), cbcV11)}, '/', 0, 1, 0, 0)`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

      const complete = yield* readChromiumCookieDatabase(filename, { cbcV10, cbcV11 }, "linux");
      expect(complete.cookies.map(({ name, value }) => ({ name, value }))).toEqual([
        { name: "v10-cookie", value: "v10 value" },
        { name: "v11-cookie", value: "v11 value" },
      ]);
      expect(complete.undecryptable).toBe(0);

      const v10Only = yield* readChromiumCookieDatabase(filename, { cbcV10 }, "linux");
      expect(v10Only.cookies.map(({ name, value }) => ({ name, value }))).toEqual([
        { name: "v10-cookie", value: "v10 value" },
      ]);
      expect(v10Only.undecryptable).toBe(1);
      expect(v10Only.undecryptableHosts).toEqual(["v11.example"]);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("recovers records written with the empty-passphrase key", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const filename = `${directory}/Cookies`;
      const cbcV10 = Buffer.from("0123456789abcdef");
      const cbcV11 = Buffer.from("fedcba9876543210");
      // The key some Linux clients actually encrypted with (crbug.com/1195256):
      // OSCrypt's derivation over an empty passphrase.
      const cbcEmpty = NodeCrypto.pbkdf2Sync("", "saltysalt", 1, 16, "sha1");

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value text not null)`;
        yield* sql`insert into meta values ('version', '23')`;
        yield* sql`
          create table cookies (
            host_key text not null, name text not null, value text not null,
            encrypted_value blob not null, path text not null, expires_utc integer not null,
            is_secure integer not null, is_httponly integer not null, samesite integer not null,
            top_frame_site_key text not null default ''
          )
        `;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('ev10.example', 'empty-v10', '', ${encryptChromium("v10", "empty v10 value", cbcEmpty)}, '/', 0, 1, 0, 0)`;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('ev11.example', 'empty-v11', '', ${encryptChromium("v11", "empty v11 value", cbcEmpty)}, '/', 0, 1, 0, 0)`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

      // The records' own keys fail, and the empty key recovers both — the
      // retry Chromium itself performs.
      const recovered = yield* readChromiumCookieDatabase(
        filename,
        { cbcV10, cbcV11, cbcEmpty },
        "linux",
      );
      expect(recovered.cookies.map(({ name, value }) => ({ name, value }))).toEqual([
        { name: "empty-v10", value: "empty v10 value" },
        { name: "empty-v11", value: "empty v11 value" },
      ]);
      expect(recovered.undecryptable).toBe(0);

      // Matching Chromium: a record whose own key is missing entirely is not
      // retried with the empty key.
      const noV11 = yield* readChromiumCookieDatabase(filename, { cbcV10, cbcEmpty }, "linux");
      expect(noV11.cookies.map(({ name }) => name)).toEqual(["empty-v10"]);
      expect(noV11.undecryptableHosts).toEqual(["ev11.example"]);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("preserves arbitrary long encrypted values from pre-24 schemas", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const filename = `${directory}/Cookies`;
      const key = Buffer.from("0123456789abcdef");
      const value = "x".repeat(32) + " legacy value";

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value text not null)`;
        yield* sql`insert into meta values ('version', 23)`;
        yield* sql`
          create table cookies (
            host_key text not null, name text not null, value text not null,
            encrypted_value blob not null, path text not null, expires_utc integer not null,
            is_secure integer not null, is_httponly integer not null, samesite integer not null,
            top_frame_site_key text not null default ''
          )
        `;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('legacy.example', 'legacy', '', ${encryptV10(value, key)}, '/', 0, 0, 0, 0)`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

      const result = yield* readChromiumCookieDatabase(filename, { cbcV10: key }, "darwin");
      expect(result.cookies[0]?.value).toBe(value);
      expect(result.undecryptable).toBe(0);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("rejects a malformed text schema version", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const filename = `${directory}/Cookies`;

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value text not null)`;
        yield* sql`insert into meta values ('version', 'not-a-version')`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

      const error = yield* readChromiumCookieDatabase(
        filename,
        { cbcV10: Buffer.from("0123456789abcdef") },
        "darwin",
      ).pipe(Effect.flip);

      expect(error._tag).toBe("SchemaError");
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("treats unversioned encrypted values as legacy plaintext on macOS and Linux", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const filename = `${directory}/Cookies`;
      const key = Buffer.from("0123456789abcdef");

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value integer not null)`;
        yield* sql`insert into meta values ('version', 23)`;
        yield* sql`
          create table cookies (
            host_key text not null, name text not null, value text not null,
            encrypted_value blob not null, path text not null, expires_utc integer not null,
            is_secure integer not null, is_httponly integer not null, samesite integer not null,
            top_frame_site_key text not null default ''
          )
        `;
        yield* sql`insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
          ('legacy.example', 'legacy', '', ${Buffer.from("legacy cleartext")}, '/', 0, 0, 0, 0)`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));

      // Chromium's OSCrypt returns unprefixed data as-is on both platforms
      // (os_crypt_mac.mm and os_crypt_linux.cc: "old data saved as clear
      // text"), so neither counts it as undecryptable.
      const mac = yield* readChromiumCookieDatabase(filename, { cbcV10: key }, "darwin");
      const linux = yield* readChromiumCookieDatabase(filename, { cbcV10: key }, "linux");

      expect(mac.cookies[0]?.value).toBe("legacy cleartext");
      expect(mac.undecryptable).toBe(0);
      expect(linux.cookies[0]?.value).toBe("legacy cleartext");
      expect(linux.undecryptable).toBe(0);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("skips partitioned cookies without breaking pre-CHIPS schemas", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({
        prefix: "t3code-chromium-cookies-",
      });
      const legacyFilename = `${directory}/LegacyCookies`;
      const chipsFilename = `${directory}/ChipsCookies`;
      const key = Buffer.from("0123456789abcdef");

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value integer not null)`;
        yield* sql`insert into meta values ('version', 14)`;
        yield* sql`
          create table cookies (
            host_key text not null, name text not null, value text not null,
            encrypted_value blob not null, path text not null, expires_utc integer not null,
            is_secure integer not null, is_httponly integer not null, samesite integer not null
          )
        `;
        yield* sql`insert into cookies values
          ('legacy.example', 'legacy', 'kept', ${new Uint8Array()}, '/', 0, 0, 0, 0)`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename: legacyFilename })));

      yield* Effect.gen(function* () {
        const sql = yield* SqlClient.SqlClient;
        yield* sql`create table meta (key text primary key, value integer not null)`;
        yield* sql`insert into meta values ('version', 23)`;
        yield* sql`
          create table cookies (
            host_key text not null, name text not null, value text not null,
            encrypted_value blob not null, path text not null, expires_utc integer not null,
            is_secure integer not null, is_httponly integer not null, samesite integer not null,
            top_frame_site_key text not null
          )
        `;
        yield* sql`insert into cookies values
          ('plain.example', 'plain', 'kept', ${new Uint8Array()}, '/', 0, 0, 0, 0, '')`;
        yield* sql`insert into cookies values
          ('partitioned.example', 'partitioned', 'must skip', ${new Uint8Array()}, '/', 0, 1, 0, 0, 'https://top.example')`;
      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename: chipsFilename })));

      const legacy = yield* readChromiumCookieDatabase(legacyFilename, { cbcV10: key }, "darwin");
      const chips = yield* readChromiumCookieDatabase(chipsFilename, { cbcV10: key }, "darwin");

      expect(legacy.cookies.map(({ name }) => name)).toEqual(["legacy"]);
      expect(legacy.undecryptable).toBe(0);
      expect(chips.cookies.map(({ name }) => name)).toEqual(["plain"]);
      expect(chips.undecryptable).toBe(1);
      expect(chips.undecryptableHosts).toEqual(["partitioned.example"]);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );
});