// @effect-diagnostics nodeBuiltinImport:off - Hand-builds Safari's binary jar
// format byte by byte.
import * as NodeServices from "@effect/platform-node/NodeServices";
import { assert, describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as FileSystem from "effect/FileSystem";
import * as PlatformError from "effect/PlatformError";

import {
  isPermissionDenied,
  parseBinaryCookies,
  readSafariCookies,
  safariAccessDenied,
  SafariCookieReadError,
} from "./SafariCookies.ts";

const APPLE_EPOCH_OFFSET_SECONDS = 978_307_200;

interface FixtureCookie {
  readonly domain: string;
  readonly name: string;
  readonly path: string;
  readonly value: string;
  readonly flags: number;
  /** Seconds since 2001-01-01, as Safari stores them. */
  readonly expiry: number;
}

/** Encodes one cookie exactly as Safari lays it out. */
function encodeCookie(cookie: FixtureCookie): Buffer {
  const strings = [cookie.domain, cookie.name, cookie.path, cookie.value];
  const headerSize = 56;
  const offsets: number[] = [];
  let cursor = headerSize;
  for (const value of strings) {
    offsets.push(cursor);
    cursor += Buffer.byteLength(value) + 1;
  }
  const size = cursor;

  const buffer = Buffer.alloc(size);
  buffer.writeUInt32LE(size, 0);
  buffer.writeUInt32LE(0, 4);
  buffer.writeUInt32LE(cookie.flags, 8);
  buffer.writeUInt32LE(0, 12);
  buffer.writeUInt32LE(offsets[0]!, 16);
  buffer.writeUInt32LE(offsets[1]!, 20);
  buffer.writeUInt32LE(offsets[2]!, 24);
  buffer.writeUInt32LE(offsets[3]!, 28);
  buffer.writeUInt32LE(0, 32);
  buffer.writeUInt32LE(0, 36);
  buffer.writeDoubleLE(cookie.expiry, 40);
  buffer.writeDoubleLE(0, 48);
  strings.forEach((value, index) => {
    buffer.write(value, offsets[index]!, "utf8");
  });
  return buffer;
}

/** Builds a single-page `Cookies.binarycookies` file. */
function encodeBinaryCookies(cookies: ReadonlyArray<FixtureCookie>): Buffer {
  const encoded = cookies.map(encodeCookie);
  const headerSize = 12 + encoded.length * 4;
  const offsets: number[] = [];
  let cursor = headerSize;
  for (const cookie of encoded) {
    offsets.push(cursor);
    cursor += cookie.length;
  }

  const page = Buffer.alloc(cursor);
  page.writeUInt32BE(0x0000_0100, 0);
  page.writeUInt32LE(encoded.length, 4);
  offsets.forEach((offset, index) => page.writeUInt32LE(offset, 8 + index * 4));
  encoded.forEach((cookie, index) => cookie.copy(page, offsets[index]!));

  const header = Buffer.alloc(8 + 4);
  header.write("cook", 0, "latin1");
  header.writeUInt32BE(1, 4);
  header.writeUInt32BE(page.length, 8);
  return Buffer.concat([header, page]);
}

describe("parseBinaryCookies", () => {
  it("reads Safari's format and rebases its 2001 epoch", () => {
    const file = encodeBinaryCookies([
      {
        domain: ".apple.com",
        name: "session",
        path: "/",
        value: "abc",
        // secure | httpOnly
        flags: 0x1 | 0x4,
        expiry: 800_000_000,
      },
      {
        domain: "example.test",
        name: "plain",
        path: "/app",
        value: "v",
        flags: 0,
        expiry: 0,
      },
    ]);

    expect(parseBinaryCookies(file)).toEqual([
      {
        url: "https://apple.com/",
        name: "session",
        value: "abc",
        domain: ".apple.com",
        path: "/",
        secure: true,
        httpOnly: true,
        // Safari counts from 2001-01-01, Electron from 1970.
        expirationDate: 800_000_000 + APPLE_EPOCH_OFFSET_SECONDS,
        // The format predates SameSite; Lax is the safe modern default.
        sameSite: "lax",
      },
      {
        url: "http://example.test/app",
        name: "plain",
        value: "v",
        // Host-only: no leading dot in the jar, so no `domain` for Electron,
        // which would otherwise re-add the dot and widen it to subdomains.
        domain: undefined,
        path: "/app",
        secure: false,
        httpOnly: false,
        expirationDate: undefined,
        sameSite: "lax",
      },
    ]);
  });

  it("keeps __Host- cookies host-only so Electron accepts them", () => {
    const file = encodeBinaryCookies([
      { domain: "example.test", name: "__Host-id", path: "/", value: "v", flags: 0x1, expiry: 0 },
    ]);

    expect(parseBinaryCookies(file)[0]).toMatchObject({
      url: "https://example.test/",
      name: "__Host-id",
      domain: undefined,
    });
  });

  it("brackets IPv6 hosts in the cookie URL", () => {
    const file = encodeBinaryCookies([
      { domain: "::1", name: "local", path: "/", value: "v", flags: 0, expiry: 0 },
    ]);

    expect(parseBinaryCookies(file)[0]).toMatchObject({
      url: "http://[::1]/",
      domain: undefined,
    });
  });

  it("reads cookies spread across multiple pages", () => {
    // Safari pages its cookie file, and a single-page reader would silently
    // return only the first slice.
    const first = encodeBinaryCookies([
      { domain: "a.test", name: "one", path: "/", value: "1", flags: 0, expiry: 1 },
    ]);
    const second = encodeBinaryCookies([
      { domain: "b.test", name: "two", path: "/", value: "2", flags: 0, expiry: 1 },
    ]);
    // Splice the two single-page files into one two-page file.
    const firstPage = first.subarray(12);
    const secondPage = second.subarray(12);
    const header = Buffer.alloc(16);
    header.write("cook", 0, "latin1");
    header.writeUInt32BE(2, 4);
    header.writeUInt32BE(firstPage.length, 8);
    header.writeUInt32BE(secondPage.length, 12);

    const parsed = parseBinaryCookies(Buffer.concat([header, firstPage, secondPage]));

    expect(parsed.map((cookie) => cookie.name)).toEqual(["one", "two"]);
  });

  it("rejects a page that runs past the end of the file", () => {
    // `Buffer.subarray` clamps rather than throwing, so an overlong first page
    // swallows the second one's bytes and advances the cursor past the end.
    // Every cookie after the boundary then vanishes from a "successful" import.
    const first = encodeBinaryCookies([
      { domain: "a.test", name: "one", path: "/", value: "1", flags: 0, expiry: 1 },
    ]);
    const second = encodeBinaryCookies([
      { domain: "b.test", name: "two", path: "/", value: "2", flags: 0, expiry: 1 },
    ]);
    const firstPage = first.subarray(12);
    const secondPage = second.subarray(12);
    const header = Buffer.alloc(16);
    header.write("cook", 0, "latin1");
    header.writeUInt32BE(2, 4);
    // Declares more bytes for page one than the file holds in total.
    header.writeUInt32BE(firstPage.length + secondPage.length + 32, 8);
    header.writeUInt32BE(secondPage.length, 12);

    expect(() => parseBinaryCookies(Buffer.concat([header, firstPage, secondPage]))).toThrow(
      SafariCookieReadError,
    );
  });

  it("rejects a record whose declared size runs past its page", () => {
    const valid = encodeBinaryCookies([
      { domain: "a.test", name: "n", path: "/", value: "v", expiry: 1_000, flags: 0 },
    ]);
    // The record's own length is what bounds its string offsets; an inflated
    // one lets them read the following record's bytes as this cookie's value.
    const pageStart = 8 + 4;
    const recordStart = pageStart + valid.readUInt32LE(pageStart + 8);
    const corrupt = Buffer.from(valid);
    corrupt.writeUInt32LE(0xffff, recordStart);

    expect(() => parseBinaryCookies(corrupt)).toThrow(SafariCookieReadError);
  });

  it("rejects records truncated inside the 56-byte header", () => {
    const valid = encodeBinaryCookies([
      { domain: "a.test", name: "n", path: "/", value: "v", expiry: 1_000, flags: 0 },
    ]);
    const pageStart = 8 + 4;
    const recordStart = pageStart + valid.readUInt32LE(pageStart + 8);

    for (let size = 48; size < 56; size += 1) {
      const corrupt = Buffer.from(valid);
      corrupt.writeUInt32LE(size, recordStart);
      expect(() => parseBinaryCookies(corrupt), `record size ${size}`).toThrow(
        SafariCookieReadError,
      );
    }
  });

  it("rejects record offsets that point into the page header or an earlier record", () => {
    const valid = encodeBinaryCookies([
      { domain: "a.test", name: "n", path: "/", value: "v", expiry: 1_000, flags: 0 },
      { domain: "b.test", name: "m", path: "/", value: "w", expiry: 1_000, flags: 0 },
    ]);
    const pageStart = 8 + 4;
    const firstRecord = valid.readUInt32LE(pageStart + 8);

    // Pointing the second offset at the page's offset table would let those
    // table bytes parse as a fabricated record.
    const intoTable = Buffer.from(valid);
    intoTable.writeUInt32LE(4, pageStart + 12);
    expect(() => parseBinaryCookies(intoTable)).toThrow(SafariCookieReadError);

    // Pointing it back at the first record makes the same bytes count twice.
    const overlapping = Buffer.from(valid);
    overlapping.writeUInt32LE(firstRecord, pageStart + 12);
    expect(() => parseBinaryCookies(overlapping)).toThrow(SafariCookieReadError);

    // And a well-formed two-record page still parses.
    expect(parseBinaryCookies(valid)).toHaveLength(2);
  });

  it("rejects string offsets that point into the record header", () => {
    const valid = encodeBinaryCookies([
      { domain: "a.test", name: "n", path: "/", value: "v", expiry: 1_000, flags: 0 },
    ]);
    const pageStart = 8 + 4;
    const recordStart = pageStart + valid.readUInt32LE(pageStart + 8);

    for (const offsetField of [16, 20, 24, 28]) {
      const corrupt = Buffer.from(valid);
      corrupt.writeUInt32LE(55, recordStart + offsetField);
      expect(() => parseBinaryCookies(corrupt), `offset field ${offsetField}`).toThrow(
        SafariCookieReadError,
      );
    }
  });

  it("accepts the checksum and property-list trailer Safari writes", () => {
    const file = encodeBinaryCookies([
      { domain: "a.test", name: "c", path: "/", value: "v", flags: 0, expiry: 0 },
    ]);
    const checksum = Buffer.alloc(8);
    const plist = Buffer.from("bplist00 stub");
    const plistLength = Buffer.alloc(4);
    plistLength.writeUInt32BE(plist.length, 0);

    expect(parseBinaryCookies(Buffer.concat([file, checksum]))).toHaveLength(1);
    expect(parseBinaryCookies(Buffer.concat([file, checksum, plistLength, plist]))).toHaveLength(1);
  });

  it("rejects a jar whose page table stops short of its contents", () => {
    // A second, undeclared page after the first would be silently dropped —
    // the cookies it holds vanish from the import with no error — so a file
    // the header does not fully describe is refused instead.
    const first = encodeBinaryCookies([
      { domain: "a.test", name: "c", path: "/", value: "v", flags: 0, expiry: 0 },
    ]);
    const extraPage = encodeBinaryCookies([
      { domain: "b.test", name: "d", path: "/", value: "w", flags: 0, expiry: 0 },
    ]).subarray(12);

    expect(() => parseBinaryCookies(Buffer.concat([first, extraPage]))).toThrow(
      SafariCookieReadError,
    );
    // A trailer that claims a property list it doesn't contain is refused too.
    const badLength = Buffer.alloc(4);
    badLength.writeUInt32BE(99, 0);
    expect(() =>
      parseBinaryCookies(Buffer.concat([first, Buffer.alloc(8), badLength, Buffer.from("x")])),
    ).toThrow(SafariCookieReadError);
  });

  it("rejects a file that is not binarycookies", () => {
    expect(() => parseBinaryCookies(Buffer.from("not a cookie jar"))).toThrow(
      SafariCookieReadError,
    );
  });
});

describe("readSafariCookies", () => {
  it.effect("adds the cookie path and parser cause to malformed jar failures", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3code-safari-" });
      const jar = `${directory}/Cookies.binarycookies`;
      yield* fileSystem.writeFileString(jar, "not a cookie jar");

      const error = yield* readSafariCookies(jar).pipe(Effect.flip);

      assert.equal(error.reason, "readFailed");
      assert.equal(error.cookieDatabasePath, jar);
      assert.instanceOf(error.cause, SafariCookieReadError);
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("reports a TCC denial as a permission the user can grant", () =>
    Effect.gen(function* () {
      // What Full Disk Access actually looks like: the file is there, the read
      // is refused with EPERM. Effect tags that `Unknown`, not
      // `PermissionDenied`, so the reader has to look at the errno. Reporting
      // it as a generic failure would send the user looking for a missing
      // browser instead of a checkbox.
      const denied = PlatformError.systemError({
        _tag: "Unknown",
        module: "FileSystem",
        method: "readFile",
        pathOrDescriptor: "/protected/Cookies.binarycookies",
        cause: Object.assign(new Error("operation not permitted"), { code: "EPERM" }),
      });

      const error = yield* readSafariCookies("/protected/Cookies.binarycookies").pipe(
        Effect.flip,
        Effect.provide(FileSystem.layerNoop({ readFile: () => Effect.fail(denied) })),
      );

      assert.equal(error.reason, "needsFullDiskAccess");
    }),
  );

  it.effect("reports an ordinary permission failure as a plain read failure", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3code-safari-" });
      const jar = `${directory}/Cookies.binarycookies`;
      yield* fileSystem.writeFile(jar, new Uint8Array([0x63, 0x6f, 0x6f, 0x6b]));
      // A mode-bits refusal is EACCES: granting Full Disk Access cannot fix
      // it, so it must not be routed to that grant.
      yield* fileSystem.chmod(jar, 0o000);

      const error = yield* readSafariCookies(jar).pipe(Effect.flip);

      assert.equal(error.reason, "readFailed");
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );

  it.effect("reports a missing jar as a plain read failure", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3code-safari-" });

      const error = yield* readSafariCookies(`${directory}/absent.binarycookies`).pipe(Effect.flip);

      assert.equal(error.reason, "readFailed");
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );
});

describe("safariAccessDenied", () => {
  const eperm = PlatformError.systemError({
    _tag: "Unknown",
    module: "FileSystem",
    method: "open",
    pathOrDescriptor: "/protected/Cookies.binarycookies",
    cause: Object.assign(new Error("operation not permitted"), { code: "EPERM" }),
  });
  const denied = (error: PlatformError.PlatformError) =>
    FileSystem.layerNoop({ open: () => Effect.fail(error) });

  it.effect("reports TCC's EPERM as a missing Full Disk Access grant", () =>
    Effect.gen(function* () {
      // `stat` finds the jar without the grant, so only an open tells the
      // listing whether the import would actually be allowed.
      assert.isTrue(
        yield* safariAccessDenied("/protected/Cookies.binarycookies").pipe(
          Effect.provide(denied(eperm)),
        ),
      );
    }),
  );

  it.effect("does not read a readable jar, or any other failure, as denied", () =>
    Effect.gen(function* () {
      const fileSystem = yield* FileSystem.FileSystem;
      const directory = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3code-safari-" });
      const jar = `${directory}/Cookies.binarycookies`;
      yield* fileSystem.writeFile(jar, new Uint8Array([0x63, 0x6f, 0x6f, 0x6b]));
      assert.isFalse(yield* safariAccessDenied(jar));
      // Missing entirely is "not installed", not "denied".
      assert.isFalse(yield* safariAccessDenied(`${directory}/absent.binarycookies`));
    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
  );
});

describe("isPermissionDenied", () => {
  // Shapes taken from a real `FileSystem.readFile` failure on macOS — verified
  // against Safari's TCC-protected jar, whose denial is EPERM, tagged
  // `Unknown` rather than `PermissionDenied`.
  const platformError = (reasonTag: string, code: string): PlatformError.PlatformError =>
    ({ _tag: "PlatformError", reason: { _tag: reasonTag, cause: { code } } }) as never;

  it("treats a TCC EPERM denial as permission denied", () => {
    // The regression: EPERM is tagged `Unknown`, so checking the tag alone
    // reported Safari's Full Disk Access refusal as a generic read failure.
    expect(isPermissionDenied(platformError("Unknown", "EPERM"))).toBe(true);
  });

  it("does not send an ordinary EACCES failure to the Full Disk Access grant", () => {
    // A POSIX permission or ACL refusal cannot be fixed by granting Full Disk
    // Access, so it stays a plain read failure; only TCC's EPERM routes there.
    expect(isPermissionDenied(platformError("PermissionDenied", "EACCES"))).toBe(false);
  });

  it("does not treat an unrelated failure as permission denied", () => {
    expect(isPermissionDenied(platformError("Unknown", "EIO"))).toBe(false);
  });
});