import assert from 'node:assert/strict'
import test from 'node:test'
import { readFileSync } from 'node:fs'
import ts from 'typescript'
import axios from 'axios'

function compile(name, dependencies = {}) {
  const source = readFileSync(new URL(name, import.meta.url), 'utf8')
    .replace('import.meta.env.VITE_API_BASE_URL', "'/api'")
  const code = ts.transpileModule(source, {
    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022, esModuleInterop: true },
  }).outputText
  const exports = {}
  new Function('require', 'exports', code)((id) => {
    assert.ok(id in dependencies, `unexpected dependency ${id}`)
    return dependencies[id]
  }, exports)
  return exports
}

function access(user, tenant = 1, membership = 1, nonce = 'original') {
  return `test.${Buffer.from(JSON.stringify({ user_id: user, tenant_id: tenant, membership_id: membership, app_code: 'MERCHANT', nonce })).toString('base64url')}.test`
}
const oldAccess = access(1)
const newAccess = access(1, 1, 1, 'rotated')
const otherAccess = access(2, 2, 2)

function harness(adapter) {
  let token = oldAccess
  let refreshToken = 'old-refresh'
  const http = compile('./http.ts', {
    axios: { ...axios, create: (config) => axios.create({ ...config, adapter }) },
    '@chongchong/shared': { parseApiJsonResponse: (data) => data },
    '@/api/session': {
      accessTokenIdentity: compile('./session.ts').accessTokenIdentity,
      getAccessToken: () => token, getRefreshToken: () => refreshToken,
      persistTokenPair: (tokens) => { token = tokens.accessToken; refreshToken = tokens.refreshToken },
      clearSessionTokens: () => { token = ''; refreshToken = '' },
    },
    '@/api/errorDetails': compile('./errorDetails.ts'),
    '@/api/types': compile('./types.ts'),
    '@/api/crossTabRefresh': compile('./crossTabRefresh.ts'),
  })
  return { ...http, setSession: (access, refresh) => { token = access; refreshToken = refresh }, session: () => ({ token, refreshToken }) }
}

test('order and lastleg 401s share one refresh and replay the unified access token', async () => {
  let refreshes = 0
  const calls = []
  const http = harness(async (config) => {
    calls.push({ url: config.url, base: config.baseURL, token: config.headers.Authorization })
    if (config.url === '/auth/refresh') {
      refreshes++
      await new Promise((resolve) => setTimeout(resolve, 10))
      return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: { accessToken: newAccess, refreshToken: 'new-refresh' } } }
    }
    if (config.headers.Authorization === `Bearer ${oldAccess}`) {
      throw new axios.AxiosError('Expired', 'ERR_BAD_REQUEST', config, null, { status: 401, data: { code: 'A0401', message: 'Expired' } })
    }
    return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: config.url } }
  })
  const urls = ['/merchant/v1/orders', '/merchant/v1/last-leg/inbound-plans']
  assert.deepEqual(await Promise.all(urls.map((url) => http.apiRequest({ url }))), urls)
  assert.equal(refreshes, 1)
  assert.ok(calls.every((call) => call.base === '/api'))
  assert.equal(calls.find((call) => call.url === '/auth/refresh').token, undefined)
  assert.equal(calls.filter((call) => call.token === `Bearer ${newAccess}`).length, 2)
})

test('successful order submit with explicit null data is accepted', async () => {
  const http = harness(async (config) => ({
    config, status: 200, headers: {}, data: { code: '200', message: 'success', data: null },
  }))
  assert.equal(await http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/order-1/submit' }), null)
})

test('data-less security failures preserve diagnostics and malformed success is rejected', async () => {
  for (const data of [{ code: 'A0403', message: 'Denied', traceId: 'trace-1', requestId: 'request-1' }, { code: '200', message: 'OK' }]) {
    const http = harness(async (config) => ({ config, status: 200, headers: {}, data }))
    await assert.rejects(http.apiRequest({ url: '/merchant/v1/last-leg/inbound-plans' }), (error) => {
      assert.equal(error.code, data.code === '200' ? 'INVALID_RESPONSE' : 'A0403')
      if (data.code !== '200') { assert.equal(error.traceId, 'trace-1'); assert.equal(error.requestId, 'request-1') }
      return true
    })
  }
})

test('late refresh response cannot overwrite a session changed in another tab', async () => {
  let complete, started
  const ready = new Promise(resolve => { started = resolve })
  const response = new Promise(resolve => { complete = resolve })
  const http = harness(async config => { started(); await response; return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: { accessToken: oldAccess, refreshToken: 'stale-refresh' } } } })
  const pending = http.refreshAuthenticatedSession()
  await ready
  http.setSession(otherAccess, 'other-refresh')
  complete()
  await pending.catch(error => assert.equal(error.code, 'SESSION_CHANGED'))
  assert.deepEqual(http.session(), { token: otherAccess, refreshToken: 'other-refresh' })
})

function deferred() { let resolve; const promise = new Promise(yes => { resolve = yes }); return { promise, resolve } }

test('logout after local clear sends only the original refresh token and never refreshes or clears a later login', async () => {
  const sent = deferred(), release = deferred(), calls = []
  const http = harness(async config => {
    calls.push(config); sent.resolve(); await release.promise; throw unauthorized(config)
  })
  http.setSession('', '')
  const api = compile('../modules/auth/api/auth.ts', { '@/api/http': http })
  const pending = api.logoutMerchant('old-refresh')
  const rejected = assert.rejects(pending, error => error.code === 'A0401')
  await sent.promise; http.setSession(otherAccess, 'refresh-b'); release.resolve(); await rejected
  assert.equal(calls.length, 1)
  assert.equal(calls[0].url, '/auth/logout')
  assert.equal(calls[0].headers.Authorization, undefined)
  assert.deepEqual(JSON.parse(calls[0].data), { refreshToken: 'old-refresh' })
  assert.deepEqual(http.session(), { token: otherAccess, refreshToken: 'refresh-b' })
})
function unauthorized(config) {
  return new axios.AxiosError('Expired', 'ERR_BAD_REQUEST', config, null, { status: 401, data: { code: 'A0401', message: 'Expired' } })
}

test('late A write 401 after user, customer or membership switch never refreshes or replays under B', async () => {
  for (const next of [access(2), access(1, 2), access(1, 1, 2)]) {
    const sent = deferred(), release = deferred(), calls = []
    const http = harness(async config => {
      calls.push(config.url); sent.resolve(); await release.promise
      throw unauthorized(config)
    })
    const pending = http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/one/submit', data: { expectedVersion: 1 } })
    const rejected = assert.rejects(pending, error => error.code === 'SESSION_CHANGED')
    await sent.promise; http.setSession(next, 'refresh-b'); release.resolve(); await rejected
    assert.deepEqual(calls, ['/merchant/v1/orders/first-leg/one/submit'])
    assert.deepEqual(http.session(), { token: next, refreshToken: 'refresh-b' })
  }
})

test('switch during in-flight refresh cannot reuse B token to replay an A write', async () => {
  const refreshing = deferred(), release = deferred(), calls = []
  const http = harness(async config => {
    calls.push(config.url)
    if (config.url === '/auth/refresh') {
      refreshing.resolve(); await release.promise
      return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: { accessToken: newAccess, refreshToken: 'new-refresh' } } }
    }
    throw unauthorized(config)
  })
  const pending = http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/one/submit' })
  const rejected = assert.rejects(pending, error => error.code === 'SESSION_CHANGED')
  await refreshing.promise; http.setSession(otherAccess, 'refresh-b'); release.resolve(); await rejected
  assert.deepEqual(calls, ['/merchant/v1/orders/first-leg/one/submit', '/auth/refresh'])
  assert.deepEqual(http.session(), { token: otherAccess, refreshToken: 'refresh-b' })
})

test('refresh lock wait reuses same-identity rotation but rejects changed-identity reuse', async t => {
  const originalNavigator = Object.getOwnPropertyDescriptor(globalThis, 'navigator')
  t.after(() => { if (originalNavigator) Object.defineProperty(globalThis, 'navigator', originalNavigator); else delete globalThis.navigator })
  for (const next of [newAccess, otherAccess]) {
    const waiting = deferred(), release = deferred(), calls = []
    Object.defineProperty(globalThis, 'navigator', { configurable: true, value: { locks: { request: async (_name, _options, run) => {
      waiting.resolve(); await release.promise; return run()
    } } } })
    const http = harness(async config => {
      calls.push({ url: config.url, authorization: config.headers.Authorization })
      if (config.headers.Authorization === `Bearer ${oldAccess}`) throw unauthorized(config)
      return { config, status: 200, headers: {}, data: { code: '200', message: 'OK', data: null } }
    })
    const pending = http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/one/submit' })
    const outcome = next === otherAccess ? assert.rejects(pending, error => error.code === 'SESSION_CHANGED') : pending
    await waiting.promise; http.setSession(next, 'rotated-refresh'); release.resolve(); await outcome
    assert.equal(calls.some(call => call.url === '/auth/refresh'), false)
    assert.equal(calls.length, next === otherAccess ? 1 : 2)
    assert.deepEqual(http.session(), { token: next, refreshToken: 'rotated-refresh' })
  }
})