import assert from "node:assert/strict"
import { test } from "node:test"

import { startAuthServer } from "../../src/auth-server.ts"

const STATE = "state-token-123"

function callbackUrl(port: number): string {
  return `http://127.0.0.1:${port}/callback`
}

test("callback POST completes the login and closes the server", async () => {
  const server = await startAuthServer({ expectedState: STATE, startPort: 0, portRange: 0 })

  const response = await fetch(callbackUrl(server.port), {
    method: "POST",
    headers: { "content-type": "application/json", origin: "https://commandcode.ai" },
    body: JSON.stringify({ apiKey: "user_abc", state: STATE, userId: "u1", userName: "tester", keyName: "cli" }),
  })

  assert.equal(response.status, 200)
  assert.equal(response.headers.get("access-control-allow-origin"), "https://commandcode.ai")
  assert.deepEqual(await server.waitForCallback, { apiKey: "user_abc", state: STATE })
})

test("browser preflight is answered for the Command Code origin", async () => {
  const server = await startAuthServer({ expectedState: STATE, startPort: 0, portRange: 0 })

  try {
    const response = await fetch(callbackUrl(server.port), {
      method: "OPTIONS",
      headers: {
        origin: "https://commandcode.ai",
        "access-control-request-headers": "content-type",
      },
    })

    assert.equal(response.status, 204)
    assert.equal(response.headers.get("access-control-allow-private-network"), "true")
    assert.equal(response.headers.get("access-control-allow-headers"), "content-type")
  } finally {
    server.close()
  }
})

test("a mismatched state token is rejected without completing the login", async () => {
  const server = await startAuthServer({ expectedState: STATE, startPort: 0, portRange: 0 })
  let settled = false
  void server.waitForCallback.then(() => {
    settled = true
  })

  try {
    const response = await fetch(callbackUrl(server.port), {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ apiKey: "user_abc", state: "other-state" }),
    })

    assert.equal(response.status, 403)
    assert.equal(settled, false)
  } finally {
    server.close()
  }
})

test("an access_denied payload fails the wait instead of hanging", async () => {
  const server = await startAuthServer({ expectedState: STATE, startPort: 0, portRange: 0 })

  const rejection = assert.rejects(server.waitForCallback, /User cancelled/)
  await fetch(callbackUrl(server.port), {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({ error: "access_denied", error_description: "User cancelled" }),
  })

  await rejection
})