import { chmodSync, mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { basename, join } from "node:path";
import { afterEach, expect, test, vi } from "vitest";
import { createAuthDiagnoser } from "../src/auth/diagnostics.js";
import { createAuthenticationConfigProvider } from "../src/auth/config.js";
import { createAuthentikGroupCatalog } from "../src/auth/authentik-group-catalog.js";
import { createLocalUserRegistry } from "../src/auth/local-registry.js";
import { createOidcProtocol, OidcJwksUnavailableError } from "../src/auth/oidc-client.js";
import type { LoadedAuthConfig } from "../src/auth/types.js";

const sentinels = [
  "oidc-client-secret-UNIQUE-7P3", "authentik-api-token-UNIQUE-9Q7",
  "cookie-UNIQUE-5M1", "$argon2id$v=19$password-hash-UNIQUE-2T8", "/private/path-UNIQUE-4K6",
];
const roots: string[] = [];
const acceptSessionRoot = () => undefined;
const validPasswordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";

afterEach(() => {
  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
});

function privateRoot(): string {
  const root = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-diagnostics-"));
  chmodSync(root, 0o700);
  roots.push(root);
  return root;
}

function oidcConfig(): LoadedAuthConfig {
  return {
    revision: "a".repeat(64), sourcePath: "/safe/auth.yaml",
    value: {
      version: 1, mode: "oidc", publicUrl: "https://thothii.example.test",
      session: { regularTtlSeconds: 1, regularIdleSeconds: 1, rememberTtlSeconds: 1, rememberIdleSeconds: 1, oidcTtlSeconds: 1 },
      oidc: { issuer: "https://issuer.example.test/application/o/thothii/", clientId: "thothii", clientSecretRef: "THT_OIDC_CLIENT_SECRET", scopes: ["openid"], groupsClaim: "groups" },
      groupCatalog: { driver: "authentik", baseUrl: "https://authentik.example.test", apiTokenRef: "THT_AUTHENTIK_API_TOKEN" },
      authorization: { groupRoles: { "TOT Users": ["user"], "TOT Admin": ["admin"] } },
    },
  };
}

function localConfig(sourcePath: string): LoadedAuthConfig {
  return {
    revision: "b".repeat(64), sourcePath,
    value: {
      version: 1, mode: "local", publicUrl: "http://127.0.0.1:8080",
      session: { regularTtlSeconds: 1, regularIdleSeconds: 1, rememberTtlSeconds: 1, rememberIdleSeconds: 1, oidcTtlSeconds: 1 },
      local: { usersFile: "users.yaml" },
    },
  };
}

function registryYaml(role: "user" | "admin", passwordHash = validPasswordHash): string {
  return [
    "version: 1", "users:", "  - id: 6ba7b810-9dad-4ed1-80b4-00c04fd430c8",
    "    username: Admin", "    displayName: Admin", `    passwordHash: ${passwordHash}`,
    "    roles:", `      - ${role}`, "    enabled: true", "    authRevision: 1", "",
  ].join("\n");
}

test("reports deterministic live OIDC checks and silently ignores unrelated groups", async () => {
  const oidcDiagnose = vi.fn(async () => undefined);
  const fetch = vi.fn<typeof globalThis.fetch>(async (input) => {
    const requested = new URL(String(input)).searchParams.get("name");
    return Response.json({
      pagination: { next: null },
      results: [{ name: requested }, { name: "Unmapped Corporate Group" }],
    });
  });
  const groupCatalog = createAuthentikGroupCatalog({
    baseUrl: "https://authentik.example.test", apiToken: sentinels[1]!, fetch,
  });
  const report = await createAuthDiagnoser({
    authMode: "oidc", authentication: { current: oidcConfig }, authStateRoot: "/safe/auth-state",
    sessionRootValidator: acceptSessionRoot,
    secrets: new Map([["THT_OIDC_CLIENT_SECRET", sentinels[0]!], ["THT_AUTHENTIK_API_TOKEN", sentinels[1]!]]),
    oidcProtocol: { diagnose: oidcDiagnose }, groupCatalog,
  }).inspect({ live: true });

  expect(report).toEqual({ ready: true, mode: "oidc", checks: [expect.objectContaining({ level: "info", code: "auth_ready" })] });
  expect(oidcDiagnose).toHaveBeenCalledOnce();
  expect(fetch).toHaveBeenCalledTimes(2);
  expect(fetch.mock.calls.map(([input]) => new URL(String(input)).searchParams.get("name")))
    .toEqual(["TOT Admin", "TOT Users"]);
  expect(report.checks).not.toContainEqual(expect.objectContaining({ level: "warning" }));
  expect(JSON.stringify(report)).not.toContain("Unmapped Corporate Group");
  expect(report.checks.map((item) => item.message).join("\n")).not.toContain("Unmapped Corporate Group");
});

test("requires both fixed OIDC and Authentik secrets only in OIDC mode", async () => {
  const oidc = createAuthDiagnoser({
    authMode: "oidc", authentication: { current: oidcConfig }, authStateRoot: "/safe/auth-state", secrets: new Map(),
    sessionRootValidator: acceptSessionRoot,
  });
  const local = createAuthDiagnoser({
    authMode: "local", authStateRoot: "/safe/auth-state", secrets: new Map(),
    sessionRootValidator: acceptSessionRoot,
    authentication: { current: () => localConfig("/safe/auth.yaml") },
    localUserRegistry: { hasEnabledAdmin: async () => false } as never,
  });

  await expect(oidc.inspect({ live: false })).resolves.toMatchObject({ ready: false, checks: [
    expect.objectContaining({ code: "oidc_secret_missing" }),
  ] });
  await expect(local.inspect({ live: false })).resolves.toMatchObject({ ready: false, checks: [
    expect.objectContaining({ code: "local_admin_missing" }),
  ] });
});

test("distinguishes a valid registry without an enabled admin from a malformed registry", async () => {
  const validRoot = privateRoot();
  const validUsers = join(validRoot, "users.yaml");
  writeFileSync(validUsers, registryYaml("user"), { encoding: "utf8", mode: 0o600 });
  chmodSync(validUsers, 0o600);
  const validReport = await createAuthDiagnoser({
    authMode: "local", authStateRoot: validRoot,
    authentication: { current: () => localConfig(join(validRoot, "auth.yaml")) },
    localUserRegistry: createLocalUserRegistry(validUsers),
  }).inspect({ live: false });
  expect(validReport.checks).toEqual([expect.objectContaining({ code: "local_admin_missing" })]);

  const malformedRoot = privateRoot();
  const malformedUsers = join(malformedRoot, "users.yaml");
  writeFileSync(malformedUsers, registryYaml("admin", sentinels[3]), { encoding: "utf8", mode: 0o600 });
  chmodSync(malformedUsers, 0o600);
  const malformedReport = await createAuthDiagnoser({
    authMode: "local", authStateRoot: malformedRoot,
    authentication: { current: () => localConfig(join(malformedRoot, "auth.yaml")) },
    localUserRegistry: createLocalUserRegistry(malformedUsers),
  }).inspect({ live: false });
  expect(malformedReport.checks).toEqual([expect.objectContaining({ code: "local_user_registry_invalid" })]);
  expect(JSON.stringify(malformedReport)).not.toContain(sentinels[3]);
  expect(JSON.stringify(malformedReport)).not.toContain(malformedUsers);
});

test("maps unsafe auth.yaml storage from the real provider to a redacted config failure", async () => {
  const root = privateRoot();
  const unsafePath = join(root, basename(sentinels[4]!));
  writeFileSync(unsafePath, [
    "version: 1", "mode: local", "publicUrl: http://127.0.0.1:8080", "local:", "  usersFile: users.yaml", "",
  ].join("\n"), { encoding: "utf8", mode: 0o640 });
  chmodSync(unsafePath, 0o640);
  const report = await createAuthDiagnoser({
    authMode: "local", authStateRoot: root,
    authentication: createAuthenticationConfigProvider(unsafePath),
  }).inspect({ live: false });

  expect(report.checks).toEqual([expect.objectContaining({ code: "auth_config_invalid" })]);
  expect(JSON.stringify(report)).not.toContain(unsafePath);
  expect(JSON.stringify(report)).not.toContain(sentinels[4]);
});

test("maps OIDC and group catalog failures to only the closed diagnostics code union", async () => {
  const report = await createAuthDiagnoser({
    authMode: "oidc", authentication: { current: oidcConfig }, authStateRoot: "/safe/auth-state",
    sessionRootValidator: acceptSessionRoot,
    secrets: new Map([["THT_OIDC_CLIENT_SECRET", sentinels[0]!], ["THT_AUTHENTIK_API_TOKEN", sentinels[1]!]]),
    oidcProtocol: { diagnose: async () => { throw new Error("issuer unavailable"); } },
    groupCatalog: { verifyConfiguredGroups: async () => [{ level: "error", code: "oidc_mapped_group_missing", message: "configured group is missing", field: "TOT Users" }] },
  }).inspect({ live: true });

  expect(report.ready).toBe(false);
  expect(report.checks.map((check) => check.code)).toEqual(["oidc_discovery_unreachable", "oidc_mapped_group_missing"]);
});

test("reports a JWKS validation failure through its closed diagnostic code", async () => {
  const report = await createAuthDiagnoser({
    authMode: "oidc", authentication: { current: oidcConfig }, authStateRoot: "/safe/auth-state",
    sessionRootValidator: acceptSessionRoot,
    secrets: new Map([["THT_OIDC_CLIENT_SECRET", sentinels[0]!], ["THT_AUTHENTIK_API_TOKEN", sentinels[1]!]]),
    oidcProtocol: { diagnose: async () => { throw new OidcJwksUnavailableError(); } },
    groupCatalog: { verifyConfiguredGroups: async () => [] },
  }).inspect({ live: true });

  expect(report.checks).toEqual([expect.objectContaining({ code: "oidc_jwks_unreachable" })]);
});

test("maps a concrete discovery adapter issuer mismatch to its dedicated code", async () => {
  const loaded = oidcConfig();
  const fetch = vi.fn<typeof globalThis.fetch>(async (input) => {
    const url = new URL(String(input));
    if (!url.pathname.includes(".well-known")) throw new Error("JWKS must not be requested after issuer mismatch");
    return Response.json({
      issuer: "https://different-issuer.example.test",
      authorization_endpoint: "https://issuer.example.test/authorize",
      token_endpoint: "https://issuer.example.test/token",
      jwks_uri: "https://issuer.example.test/jwks",
      response_types_supported: ["code"],
      grant_types_supported: ["authorization_code"],
      subject_types_supported: ["public"],
      id_token_signing_alg_values_supported: ["RS256"],
    });
  });
  const oidcProtocol = createOidcProtocol({
    issuer: loaded.value.mode === "oidc" ? loaded.value.oidc.issuer : "",
    clientId: "thothii", clientSecret: sentinels[0]!,
    callbackUrl: "https://thothii.example.test/api/auth/oidc/callback",
    scopes: ["openid"], groupsClaim: "groups", fetch,
  });
  const report = await createAuthDiagnoser({
    authMode: "oidc", authentication: { current: () => loaded }, authStateRoot: "/safe/auth-state",
    sessionRootValidator: acceptSessionRoot,
    secrets: new Map([["THT_OIDC_CLIENT_SECRET", sentinels[0]!], ["THT_AUTHENTIK_API_TOKEN", sentinels[1]!]]),
    oidcProtocol, groupCatalog: { verifyConfiguredGroups: async () => [] },
  }).inspect({ live: true });

  expect(report.checks).toEqual([expect.objectContaining({ code: "oidc_issuer_mismatch" })]);
  expect(fetch).toHaveBeenCalledOnce();
  expect(JSON.stringify(report)).not.toContain("different-issuer");
});

test("redacts exceptional configuration, registry, protocol, and catalog errors", async () => {
  const detail = sentinels.join(" ");
  const report = await createAuthDiagnoser({
    authMode: "oidc", authentication: { current: () => { throw new Error(detail); } }, authStateRoot: sentinels[4]!,
    secrets: new Map(), oidcProtocol: { diagnose: async () => { throw new Error(detail); } },
    groupCatalog: { verifyConfiguredGroups: async () => { throw new Error(detail); } },
  }).inspect({ live: true });

  const rendered = JSON.stringify(report);
  for (const sentinel of sentinels) expect(rendered).not.toContain(sentinel);
  expect(report.checks.every((check) => check.level === "error" || check.level === "info")).toBe(true);
});

test.skipIf(process.platform === "win32")("uses the runtime validator for canonical, private session roots", async () => {
  const valid = privateRoot();
  await expect(createAuthDiagnoser({ authMode: "none", authStateRoot: valid }).inspect({ live: false }))
    .resolves.toMatchObject({ ready: true, checks: [expect.objectContaining({ code: "auth_ready" })] });

  const realRoot = join(privateRoot(), "real-auth");
  mkdirSync(realRoot, { mode: 0o700 });
  chmodSync(realRoot, 0o700);
  const linkedRoot = join(privateRoot(), "linked-auth");
  symlinkSync(realRoot, linkedRoot);
  const absent = join(privateRoot(), "absent-auth");
  const blockedParent = join(privateRoot(), "not-a-directory");
  writeFileSync(blockedParent, "blocked", { mode: 0o600 });
  const traversal = `${valid}/../${basename(valid)}`;

  for (const unsafe of [traversal, linkedRoot, absent, join(blockedParent, "auth")]) {
    const report = await createAuthDiagnoser({ authMode: "none", authStateRoot: unsafe }).inspect({ live: false });
    expect(report).toMatchObject({ ready: false, checks: [expect.objectContaining({ code: "auth_session_store_invalid" })] });
    expect(JSON.stringify(report)).not.toContain(unsafe);
  }

  chmodSync(valid, 0o750);
  await expect(createAuthDiagnoser({ authMode: "none", authStateRoot: valid }).inspect({ live: false }))
    .resolves.toMatchObject({ ready: false, checks: [expect.objectContaining({ code: "auth_session_store_invalid" })] });
});

test("accepts a platform storage validator without exposing its root or failure", async () => {
  const platformRoot = "C:\\private-path-UNIQUE-6R2\\auth";
  const sessionRootValidator = vi.fn(async () => { throw new Error(`${platformRoot} denied`); });
  const report = await createAuthDiagnoser({
    authMode: "none", authStateRoot: platformRoot, sessionRootValidator,
  }).inspect({ live: false });

  expect(sessionRootValidator).toHaveBeenCalledWith(platformRoot);
  expect(report.checks).toEqual([expect.objectContaining({ code: "auth_session_store_invalid" })]);
  expect(JSON.stringify(report)).not.toContain(platformRoot);
});