'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const os = require('node:os');
const path = require('node:path');
const { PassThrough } = require('node:stream');

const {
  AppRuntime,
  PairingController,
  createBridgeHandler,
  loadPairingEnvelope,
} = require('../src/electron-runtime');
const { APT_EXTENSION_ORIGIN, BridgeAuth } = require('../src/bridge-auth');
const { createSessionStore } = require('../src/session-store');

const ROOT = path.join(__dirname, '..');
const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');

function responseHarness() {
  return {
    statusCode: 0,
    headers: {},
    body: '',
    setHeader(name, value) { this.headers[name.toLowerCase()] = value; },
    writeHead(statusCode, headers = {}) {
      this.statusCode = statusCode;
      for (const [name, value] of Object.entries(headers)) this.setHeader(name, value);
    },
    end(chunk = '') { this.body += chunk; },
  };
}

function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, secret, body = '{}' } = {}) {
  const request = new PassThrough();
  request.method = method;
  request.url = '/cookie';
  request.headers = { origin };
  if (secret !== undefined) request.headers['x-apt-pairing'] = secret;
  process.nextTick(() => request.end(body));
  return request;
}

test('runtime keeps Alta credentials in main-owned modules and exposes only non-secret state', async () => {
  const sessionStore = createSessionStore();
  sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
  const calls = [];
  const proxyManager = {
    launchProxy(request) { calls.push(request); return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' }; },
    stopProxy(processId) { calls.push({ processId }); return { success: true, processId, status: 'stop-requested' }; },
    listTrackedProxies() { return []; },
  };
  const runtime = new AppRuntime({
    sessionStore,
    altaClient: {
      getDevices: async () => [{ guid: '550e8400-e29b-41d4-a716-446655440000' }],
      getDeviceSites: async () => [],
      getAuthInfo: async () => ({ user: 'safe' }),
    },
    proxyManager,
    checkForUpdate: async ({ currentVersion }) => ({ status: 'up-to-date', currentVersion }),
    currentVersion: '1.0.0',
    openExternal: async () => {},
  });

  assert.deepEqual(await runtime.getDevices(), { success: true, devices: [{ guid: '550e8400-e29b-41d4-a716-446655440000' }] });
  const launched = await runtime.launchProxy('550e8400-e29b-41d4-a716-446655440000');
  assert.equal(launched.success, true);
  assert.deepEqual(calls[0], {
    deploymentHost: 'customer.avasecurity.com',
    cookie: 'top-secret-cookie',
    deviceId: '550e8400-e29b-41d4-a716-446655440000',
  });
  assert.deepEqual(runtime.getConnectionState(), {
    connected: true,
    origin: 'https://customer.avasecurity.com',
    activeProxies: [{ deviceId: '550e8400-e29b-41d4-a716-446655440000', processId: 91 }],
  });
  assert.equal(JSON.stringify(launched).includes('top-secret-cookie'), false);
  assert.equal(JSON.stringify(runtime.getConnectionState()).includes('top-secret-cookie'), false);

  assert.equal((await runtime.stopProxy('550e8400-e29b-41d4-a716-446655440000')).success, true);
  assert.deepEqual(calls[1], { processId: 91 });
  assert.equal((await runtime.stopProxy(999)).success, false);
});

test('bridge rejects unknown preflight and unauthenticated requests before reading their body', async () => {
  const auth = new BridgeAuth();
  const secret = auth.rotate().secret;
  const sessionStore = createSessionStore();
  let stateNotifications = 0;
  const handler = createBridgeHandler({
    bridgeAuth: auth,
    sessionStore,
    onConnectionStateChanged: () => { stateNotifications += 1; },
  });

  const unknownPreflight = requestHarness({ method: 'OPTIONS', origin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' });
  const unknownResponse = responseHarness();
  await handler(unknownPreflight, unknownResponse);
  assert.equal(unknownResponse.statusCode, 403);
  assert.equal(unknownResponse.headers['access-control-allow-origin'], undefined);

  const unauthenticated = requestHarness({ body: '{'.repeat(1000) });
  let dataRead = false;
  unauthenticated.on('data', () => { dataRead = true; });
  const unauthenticatedResponse = responseHarness();
  await handler(unauthenticated, unauthenticatedResponse);
  assert.equal(unauthenticatedResponse.statusCode, 403);
  assert.equal(dataRead, false);

  const allowedPreflight = requestHarness({ method: 'OPTIONS', secret });
  const allowedResponse = responseHarness();
  await handler(allowedPreflight, allowedResponse);
  assert.equal(allowedResponse.statusCode, 204);
  assert.equal(allowedResponse.headers['access-control-allow-origin'], APT_EXTENSION_ORIGIN);
  assert.match(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/);

  const accepted = requestHarness({
    secret,
    body: JSON.stringify({ deploymentUrl: 'https://customer.avasecurity.com', cookieValue: 'valid-cookie' }),
  });
  const acceptedResponse = responseHarness();
  await handler(accepted, acceptedResponse);
  assert.equal(acceptedResponse.statusCode, 200);
  assert.deepEqual(sessionStore.describe(), { connected: true, origin: 'https://customer.avasecurity.com' });
  assert.equal(stateNotifications, 1);
  assert.equal(acceptedResponse.body.includes('valid-cookie'), false);
});

test('pairing envelope persists with restrictive permissions and secrets are returned once', () => {
  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-'));
  const envelopePath = path.join(directory, 'bridge-pairing.json');
  const controller = new PairingController({ envelopePath });

  const first = controller.initialize();
  assert.equal(first.paired, true);
  assert.match(first.secret, /^[A-Za-z0-9_-]{43}$/);
  assert.deepEqual(controller.getStatus(), { paired: true });
  const persisted = loadPairingEnvelope(envelopePath);
  assert.equal(Object.values(persisted).includes(first.secret), false);
  if (process.platform !== 'win32') assert.equal(fs.statSync(envelopePath).mode & 0o777, 0o600);

  const rotated = controller.rotate();
  assert.match(rotated.secret, /^[A-Za-z0-9_-]{43}$/);
  assert.notEqual(rotated.secret, first.secret);
  assert.deepEqual(controller.getStatus(), { paired: true });
  controller.revoke();
  assert.deepEqual(controller.getStatus(), { paired: false });
  assert.equal(fs.existsSync(envelopePath), false);
});

test('update runtime is check-only and opens only the fixed GitPeji releases page', async () => {
  const opened = [];
  const runtime = new AppRuntime({
    sessionStore: createSessionStore(),
    altaClient: {},
    proxyManager: {},
    checkForUpdate: async ({ currentVersion }) => ({ status: 'update-available', currentVersion, latestVersion: '1.1.0' }),
    currentVersion: '1.0.0',
    openExternal: async (url) => { opened.push(url); },
  });
  assert.deepEqual(await runtime.checkForUpdates(), {
    success: true,
    status: 'update-available',
    currentVersion: '1.0.0',
    latestVersion: '1.1.0',
  });
  assert.deepEqual(await runtime.openFixedReleasesPage(), { success: true });
  assert.deepEqual(opened, ['https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases']);
});

test('preload and renderer expose only narrow, credential-free contracts', () => {
  const preload = read('preload.js');
  const renderer = read('renderer.js');
  const html = read('index.html');
  const expectedMethods = [
    'getDevices', 'getDeviceSites', 'getAuthInfo', 'launchProxy', 'stopProxy', 'disconnect',
    'getConnectionState', 'checkForUpdates', 'openFixedReleasesPage', 'rotatePairing',
    'revokePairing', 'getPairingStatus', 'onConnectionStateChanged',
  ];
  for (const method of expectedMethods) assert.match(preload, new RegExp(`\\b${method}\\b`));
  assert.doesNotMatch(preload, /downloadAndInstall|download-and-install|onUpdateDownloadProgress|onExtensionCookie/);
  assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
  assert.doesNotMatch(html, /id="cookieKey"|updateProgress|Install Update/);
  assert.match(renderer, /openFixedReleasesPage/);
  assert.match(html, /Bridge Pairing/);
});

test('source policy removes legacy credential IPC, shell launch, broad kill, and executable updater', () => {
  const production = ['main.js', 'preload.js', 'renderer.js', 'index.html', 'src/electron-runtime.js']
    .map(read).join('\n');
  const forbidden = [
    /sanitizeBatchInput/, /taskkill/i, /\.bat\b/i, /download-and-install-update/,
    /httpsGetFollowRedirects/, /api\.github\.com/i, /github releases/i,
    /apt-local-bridge-token/, /X-APT-Token/, /cookie-proxy-/,
  ];
  for (const pattern of forbidden) assert.doesNotMatch(production, pattern);
  assert.doesNotMatch(read('main.js'), /axios/);
  assert.match(read('main.js'), /event\.sender === webContents/);
  assert.match(read('main.js'), /frame === webContents\.mainFrame/);
  assert.match(read('main.js'), /pathToFileURL\(path\.join\(__dirname, 'index\.html'\)\)/);
  assert.match(read('main.js'), /127\.0\.0\.1/);
  assert.match(read('main.js'), /18247/);
  assert.match(read('main.js'), /shell\.openExternal/);
});