import { expect, test } from "vitest";
import { readFileSync } from "node:fs";
import path from "node:path";
import {
  PI_0803_CREDENTIAL_ENV_NAMES,
  buildPiChildEnv,
  canonicalPiProvider,
  piProviderCredentialStatus,
} from "../src/pi/provider-credentials.js";

test("canonical provider aliases resolve to packaged Pi 0.80.3 IDs", () => {
  expect(canonicalPiProvider(" OpenAI ")).toBe("openai");
  expect(canonicalPiProvider("gemini")).toBe("google");
  expect(canonicalPiProvider("Google")).toBe("google");
  expect(() => buildPiChildEnv({
    ambient: {}, provider: "cohere", credentialFile: "/unused",
  })).toThrow("model provider credential is unavailable");
});

test("credential scrub list matches the audited Pi AI 0.80.3 provider definitions", () => {
  const lock = JSON.parse(readFileSync(path.resolve("../docker/pi-runtime/package-lock.json"), "utf8"));
  expect(lock.packages["node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-ai"].version)
    .toBe("0.80.3");
  expect(PI_0803_CREDENTIAL_ENV_NAMES).toEqual([
    "AI_GATEWAY_API_KEY", "ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "ANT_LING_API_KEY",
    "AWS_ACCESS_KEY_ID", "AWS_BEARER_TOKEN_BEDROCK", "AWS_CONFIG_FILE",
    "AWS_CONTAINER_AUTHORIZATION_TOKEN", "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
    "AWS_CONTAINER_CREDENTIALS_FULL_URI", "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "AWS_PROFILE",
    "AWS_ROLE_ARN", "AWS_ROLE_SESSION_NAME", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
    "AWS_SHARED_CREDENTIALS_FILE", "AWS_WEB_IDENTITY_TOKEN_FILE", "AZURE_OPENAI_API_KEY",
    "CEREBRAS_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_API_KEY",
    "CLOUDFLARE_GATEWAY_ID", "COPILOT_GITHUB_TOKEN", "DEEPSEEK_API_KEY", "FIREWORKS_API_KEY",
    "GCLOUD_PROJECT", "GEMINI_API_KEY", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_API_KEY",
    "GOOGLE_CLOUD_LOCATION", "GOOGLE_CLOUD_PROJECT", "GROQ_API_KEY", "HF_TOKEN",
    "KIMI_API_KEY", "MINIMAX_API_KEY", "MINIMAX_CN_API_KEY", "MISTRAL_API_KEY",
    "MOONSHOT_API_KEY", "NVIDIA_API_KEY", "OPENCODE_API_KEY", "OPENAI_API_KEY",
    "OPENROUTER_API_KEY", "TOGETHER_API_KEY", "XAI_API_KEY", "XIAOMI_API_KEY",
    "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_CN_API_KEY",
    "XIAOMI_TOKEN_PLAN_SGP_API_KEY", "ZAI_API_KEY", "ZAI_CODING_CN_API_KEY",
  ]);
  expect(PI_0803_CREDENTIAL_ENV_NAMES).not.toContain("COHERE_API_KEY");
});

test("credential file replacement between lstat and open is rejected before read", () => {
  let reads = 0;
  const stat = (ino: number) => ({
    dev: 7, ino, uid: process.getuid?.() ?? 0, mode: 0o100600, nlink: 1, size: 6,
    isFile: () => true, isDirectory: () => false, isSymbolicLink: () => false,
  });
  expect(() => buildPiChildEnv({
    ambient: {}, provider: "openai", credentialFile: "/safe/key",
    fsOps: {
      lstat: () => stat(1) as any,
      open: () => 9,
      fstat: () => stat(2) as any,
      read: () => { reads += 1; return "secret"; },
      close: () => undefined,
    },
  })).toThrow("model provider credential is unavailable");
  expect(reads).toBe(0);
});

test("Docker secrets require a secure root-owned /run/secrets parent and 0444 file", () => {
  const stat = (kind: "parent" | "file") => ({
    dev: 7, ino: 1, uid: kind === "parent" ? 1000 : 0,
    mode: kind === "parent" ? 0o40755 : 0o100444, nlink: 1, size: 6,
    isFile: () => kind === "file", isDirectory: () => kind === "parent",
    isSymbolicLink: () => false,
  });
  expect(() => buildPiChildEnv({
    ambient: {}, provider: "openai", credentialFile: "/run/secrets/model-key",
    fsOps: {
      lstat: (file) => stat(file === "/run/secrets" ? "parent" : "file") as any,
      open: () => 9, fstat: () => stat("file") as any, read: () => "secret", close: () => undefined,
    },
  })).toThrow("model provider credential is unavailable");
});

test.each(["amazon-bedrock", "azure-openai-responses", "cloudflare-workers-ai", "cloudflare-ai-gateway"])(
  "compound provider %s fails closed before opening the generic secret", (provider) => {
    let opens = 0;
    expect(() => buildPiChildEnv({
      ambient: {}, provider, credentialFile: "/unused",
      fsOps: {
        lstat: () => { throw new Error("must not inspect file"); },
        open: () => { opens += 1; return 9; },
        fstat: () => { throw new Error("must not inspect file"); },
        read: () => "secret", close: () => undefined,
      },
    })).toThrow(
      "compound credential bundles are unsupported by THT_MODEL_API_KEY_FILE; dedicated provider configuration is required",
    );
    expect(opens).toBe(0);
  },
);

test("single-key providers scrub ambient compound companions before injecting their key", () => {
  const stat = {
    dev: 7, ino: 1, uid: process.getuid?.() ?? 0, mode: 0o100600, nlink: 1, size: 6,
    isFile: () => true, isDirectory: () => false, isSymbolicLink: () => false,
  };
  const env = buildPiChildEnv({
    ambient: {
      AWS_ACCESS_KEY_ID: "ambient", AWS_SECRET_ACCESS_KEY: "ambient",
      CLOUDFLARE_ACCOUNT_ID: "ambient", CLOUDFLARE_GATEWAY_ID: "ambient",
    },
    provider: "openai", credentialFile: "/safe/key",
    fsOps: {
      lstat: () => stat as any, open: () => 9, fstat: () => stat as any,
      read: () => "secret", close: () => undefined,
    },
  });
  expect(env.OPENAI_API_KEY).toBe("secret");
  expect(env).not.toHaveProperty("AWS_ACCESS_KEY_ID");
  expect(env).not.toHaveProperty("AWS_SECRET_ACCESS_KEY");
  expect(env).not.toHaveProperty("CLOUDFLARE_ACCOUNT_ID");
  expect(env).not.toHaveProperty("CLOUDFLARE_GATEWAY_ID");
});

test("a provider with a literal apiKey in models.json needs no code-level provider exception", () => {
  const env = buildPiChildEnv({
    ambient: {
      PI_PROVIDER_API_KEY: "must-not-leak",
      OPENAI_API_KEY: "must-not-leak",
      THT_MODEL_API_KEY_FILE: "/must/not/leak",
    },
    provider: "installation-local",
    configuredApiKey: "local",
  });
  expect(env).not.toHaveProperty("PI_PROVIDER_API_KEY");
  expect(env).not.toHaveProperty("OPENAI_API_KEY");
  expect(env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
});

test.each(["$PRIVATE_PROVIDER_API_KEY", "${PRIVATE_PROVIDER_API_KEY}"])(
  "a custom provider credential target is derived from models.json: %s",
  (configuredApiKey) => {
    const env = buildPiChildEnv({
      ambient: { PRIVATE_PROVIDER_API_KEY: "stale" },
      provider: "private-provider",
      configuredApiKey,
      credentialValue: "selected-secret",
    });
    expect(env.PRIVATE_PROVIDER_API_KEY).toBe("selected-secret");
  },
);

test("a custom provider cannot redirect a managed credential into a process-control variable", () => {
  expect(() => buildPiChildEnv({
    ambient: {}, provider: "private-provider", configuredApiKey: "$PATH",
    credentialValue: "selected-secret",
  })).toThrow("model provider credential is unavailable");
});

test("credential status reports only present or missing without treating local providers as credentialed", () => {
  expect(piProviderCredentialStatus({
    provider: "deepseek",
    authProviders: new Set(["deepseek"]),
    resolveCredentialValue: () => "must-not-be-returned",
  })).toBe("present");
  expect(piProviderCredentialStatus({ provider: "deepseek" })).toBe("missing");
  expect(piProviderCredentialStatus({
    provider: "installation-local",
    configuredApiKey: "local",
    resolveCredentialValue: () => "must-not-be-returned",
  })).toBe("missing");
});

// Catches the generic managed secret being read before providers that self-authenticate or need
// no credential have been classified.
test("credential status never resolves the generic secret for auth-store or local providers", () => {
  let secretReads = 0;
  const unreadableSecret = () => {
    secretReads += 1;
    throw new Error("unrelated generic secret is unreadable");
  };

  expect(piProviderCredentialStatus({
    provider: "deepseek",
    authProviders: new Set(["deepseek"]),
    resolveCredentialValue: unreadableSecret,
  })).toBe("present");
  expect(piProviderCredentialStatus({
    provider: "installation-local",
    configuredApiKey: "local",
    resolveCredentialValue: unreadableSecret,
  })).toBe("missing");
  expect(secretReads).toBe(0);
});

// Catches generic hosted providers skipping their managed-secret source or treating an absent or
// unreadable source as credentialed.
test("credential status resolves the generic secret only for providers that require it", () => {
  let presentReads = 0;
  expect(piProviderCredentialStatus({
    provider: "openai",
    resolveCredentialValue: () => {
      presentReads += 1;
      return "managed-openai-key";
    },
  })).toBe("present");
  expect(presentReads).toBe(1);

  let missingReads = 0;
  expect(piProviderCredentialStatus({
    provider: "openai",
    resolveCredentialValue: () => {
      missingReads += 1;
      return undefined;
    },
  })).toBe("missing");
  expect(missingReads).toBe(1);

  let unreadableReads = 0;
  expect(piProviderCredentialStatus({
    provider: "openai",
    resolveCredentialValue: () => {
      unreadableReads += 1;
      throw new Error("generic secret is unreadable");
    },
  })).toBe("missing");
  expect(unreadableReads).toBe(1);
});

test("bundle value is injected without exposing bundle metadata to Pi", () => {
  const env = buildPiChildEnv({
    ambient: {
      THT_SECRETS_FILE: "/run/secrets/thothii.secrets", THT_MODEL_API_KEY_FILE: "/run/secrets/model",
      THT_DWH_API_KEY: "dwh-secret", THT_VEC_API_KEY: "vec-reader-secret",
      THT_VEC_WRITE_API_KEY: "vec-writer-secret", THT_SSL_CA: "/run/secrets/ca.pem",
      THT_CA: "/run/secrets/ca.pem", THT_DWH_API_KEY_SECRET_FILE: "/run/secrets/dwh",
      THT_MODEL_API_KEY: "model-secret", THT_VECTOR_READER_PASSWORD: "reader-secret",
      THT_VECTOR_READER_PASSWORD_FILE: "/tmp/thothii-secrets/reader",
      THT_VECTOR_WRITER_PASSWORD_FILE: "/tmp/thothii-secrets/writer",
      THT_DWH_API_KEY_FILE: "/run/secrets/dwh", THT_VEC_API_KEY_FILE: "/run/secrets/vec",
    },
    provider: "openai", credentialValue: "bundle-secret",
  });
  expect(env.OPENAI_API_KEY).toBe("bundle-secret");
  expect(env).not.toHaveProperty("THT_SECRETS_FILE");
  expect(env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
  expect(env).not.toHaveProperty("THT_DWH_API_KEY");
  expect(env).not.toHaveProperty("THT_VEC_API_KEY");
  expect(env).not.toHaveProperty("THT_VEC_WRITE_API_KEY");
  expect(env).not.toHaveProperty("THT_MODEL_API_KEY");
  expect(env).not.toHaveProperty("THT_SSL_CA");
  expect(env).not.toHaveProperty("THT_CA");
  expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD");
  expect(env).not.toHaveProperty("THT_DWH_API_KEY_SECRET_FILE");
  expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD_FILE");
  expect(env).not.toHaveProperty("THT_VECTOR_WRITER_PASSWORD_FILE");
  expect(env).not.toHaveProperty("THT_DWH_API_KEY_FILE");
  expect(env).not.toHaveProperty("THT_VEC_API_KEY_FILE");
});