/**
 * @vitest-environment node
 */
import { beforeEach, describe, expect, it, vi } from 'vitest'
import { resolveCookieRewriteLocalScopeKey, toScopedLocalCookieName } from './cookies'
import { buildUpstreamUrl, createDevProxyApp, isAllowedDevOrigin } from './server'

describe('dev proxy server', () => {
  beforeEach(() => {
    vi.clearAllMocks()
  })

  // Scenario: target paths should not be duplicated when the incoming route already includes them.
  it('should preserve prefixed targets when building upstream URLs', () => {
    // Act
    const url = buildUpstreamUrl('https://api.example.com/console/api', '/console/api/apps', '?page=1')

    // Assert
    expect(url.href).toBe('https://api.example.com/console/api/apps?page=1')
  })

  // Scenario: only localhost dev origins should be reflected for credentialed CORS by default.
  it('should only allow local development origins by default', () => {
    // Assert
    expect(isAllowedDevOrigin('http://localhost:3000')).toBe(true)
    expect(isAllowedDevOrigin('http://127.0.0.1:3000')).toBe(true)
    expect(isAllowedDevOrigin('https://example.com')).toBe(false)
  })

  // Scenario: explicit CORS origins should support non-local development hosts.
  it('should allow explicitly configured origins', () => {
    // Assert
    expect(isAllowedDevOrigin('https://app.example.com', ['https://app.example.com'])).toBe(true)
    expect(isAllowedDevOrigin('https://other.example.com', ['https://app.example.com'])).toBe(false)
  })

  // Scenario: proxy requests should rewrite cookies and surface credentialed CORS headers when configured.
  it('should proxy api requests with configured local cookie rewriting', async () => {
    // Arrange
    const fetchImpl = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok', {
      status: 200,
      headers: [
        ['content-encoding', 'br'],
        ['content-length', '123'],
        ['set-cookie', '__Host-access_token=abc; Path=/console/api; Domain=cloud.example.com; Secure; SameSite=None'],
        ['transfer-encoding', 'chunked'],
      ],
    }))
    const app = createDevProxyApp({
      routes: [
        {
          paths: '/console/api',
          target: 'https://cloud.example.com',
          cookieRewrite: {
            hostPrefixCookies: ['access_token'],
          },
        },
      ],
      fetchImpl,
    })

    // Act
    const response = await app.request('http://127.0.0.1:5001/console/api/apps?page=1', {
      headers: {
        'Origin': 'http://localhost:3000',
        'Cookie': 'access_token=abc; theme=dark',
        'Accept-Encoding': 'zstd, br, gzip',
      },
    })

    // Assert
    expect(fetchImpl).toHaveBeenCalledTimes(1)
    expect(fetchImpl).toHaveBeenCalledWith(
      new URL('https://cloud.example.com/console/api/apps?page=1'),
      expect.objectContaining({
        method: 'GET',
        headers: expect.any(Headers),
      }),
    )

    const requestHeaders = fetchImpl.mock.calls[0]?.[1]?.headers
    if (!(requestHeaders instanceof Headers))
      throw new Error('Expected proxy request headers to be Headers')

    expect(requestHeaders.get('cookie')).toBe('__Host-access_token=abc; theme=dark')
    expect(requestHeaders.get('origin')).toBe('https://cloud.example.com')
    expect(requestHeaders.get('accept-encoding')).toBe('identity')
    expect(response.headers.get('access-control-allow-origin')).toBe('http://localhost:3000')
    expect(response.headers.get('access-control-allow-credentials')).toBe('true')
    expect(response.headers.get('content-encoding')).toBeNull()
    expect(response.headers.get('content-length')).toBeNull()
    expect(response.headers.get('transfer-encoding')).toBeNull()
    expect(response.headers.getSetCookie()).toEqual([
      'access_token=abc; Path=/; SameSite=Lax',
    ])
  })

  // Scenario: generic proxy routes should not know Dify cookie names by default.
  it('should not rewrite cookie names when cookie rewriting is not configured', async () => {
    // Arrange
    const fetchImpl = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok'))
    const app = createDevProxyApp({
      routes: [
        {
          paths: '/api',
          target: 'https://api.example.com',
        },
      ],
      fetchImpl,
    })

    // Act
    await app.request('http://127.0.0.1:5001/api/messages', {
      headers: {
        Cookie: 'access_token=abc; refresh_token=def',
      },
    })

    // Assert
    const requestHeaders = fetchImpl.mock.calls[0]?.[1]?.headers
    if (!(requestHeaders instanceof Headers))
      throw new Error('Expected proxy request headers to be Headers')

    expect(requestHeaders.get('cookie')).toBe('access_token=abc; refresh_token=def')
  })

  // Scenario: local HTTP upstreams expect local cookie names even when cookie rewriting is configured.
  it('should keep local cookie names for HTTP upstream targets', async () => {
    // Arrange
    const fetchImpl = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok'))
    const app = createDevProxyApp({
      routes: [
        {
          paths: '/console/api',
          target: 'http://127.0.0.1:5001',
          cookieRewrite: {
            hostPrefixCookies: ['access_token', 'refresh_token'],
          },
        },
      ],
      fetchImpl,
    })

    // Act
    await app.request('http://127.0.0.1:5010/console/api/account/profile', {
      headers: {
        Cookie: 'access_token=abc; refresh_token=def',
      },
    })

    // Assert
    const requestHeaders = fetchImpl.mock.calls[0]?.[1]?.headers
    if (!(requestHeaders instanceof Headers))
      throw new Error('Expected proxy request headers to be Headers')

    expect(requestHeaders.get('cookie')).toBe('access_token=abc; refresh_token=def')
  })

  // Scenario: scoped Dify auth cookies should prevent stale local cookies from leaking across targets.
  it('should proxy target-scoped auth cookies and override stale CSRF headers', async () => {
    // Arrange
    const cookieRewrite = {
      hostPrefixCookies: ['access_token', 'csrf_token', 'refresh_token'],
      localCookieScope: 'target-origin' as const,
      csrfHeader: {
        cookieName: 'csrf_token',
        headerName: 'X-CSRF-Token',
      },
    }
    const targetUrl = new URL('https://cloud.example.com')
    const localScopeKey = resolveCookieRewriteLocalScopeKey(cookieRewrite, targetUrl)!
    const accessTokenCookieName = toScopedLocalCookieName('access_token', localScopeKey)
    const csrfTokenCookieName = toScopedLocalCookieName('csrf_token', localScopeKey)
    const otherScopeAccessTokenCookieName = toScopedLocalCookieName('access_token', 'other')
    const fetchImpl = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok', {
      status: 200,
      headers: [
        ['set-cookie', '__Host-access_token=next; Path=/console/api; Domain=cloud.example.com; Secure; SameSite=None'],
      ],
    }))
    const app = createDevProxyApp({
      routes: [
        {
          paths: '/console/api',
          target: targetUrl.origin,
          cookieRewrite,
        },
      ],
      fetchImpl,
    })

    // Act
    const response = await app.request('http://127.0.0.1:5001/console/api/apps', {
      headers: {
        'Cookie': [
          `${accessTokenCookieName}=current-access`,
          `${csrfTokenCookieName}=current-csrf`,
          'access_token=legacy-access',
          'csrf_token=legacy-csrf',
          `${otherScopeAccessTokenCookieName}=other-access`,
          'theme=dark',
        ].join('; '),
        'X-CSRF-Token': 'legacy-csrf',
      },
    })

    // Assert
    const requestHeaders = fetchImpl.mock.calls[0]?.[1]?.headers
    if (!(requestHeaders instanceof Headers))
      throw new Error('Expected proxy request headers to be Headers')

    expect(requestHeaders.get('cookie')).toBe('__Host-access_token=current-access; __Host-csrf_token=current-csrf; theme=dark')
    expect(requestHeaders.get('x-csrf-token')).toBe('current-csrf')
    expect(response.headers.getSetCookie()).toEqual([
      `${accessTokenCookieName}=next; Path=/; SameSite=Lax`,
    ])
  })

  // Scenario: custom route paths should support independent upstream targets.
  it('should proxy custom route paths to their configured targets', async () => {
    // Arrange
    const fetchImpl = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok'))
    const app = createDevProxyApp({
      routes: [
        {
          paths: '/api',
          target: 'https://api.example.com',
        },
        {
          paths: '/files',
          target: 'https://files.example.com/assets',
        },
      ],
      fetchImpl,
    })

    // Act
    await app.request('http://127.0.0.1:5001/api/messages')
    await app.request('http://127.0.0.1:5001/files/logo.png?size=small')

    // Assert
    expect(fetchImpl.mock.calls.map(([url]) => url.toString())).toEqual([
      'https://api.example.com/api/messages',
      'https://files.example.com/assets/files/logo.png?size=small',
    ])
  })

  // Scenario: routes are matched in config order so callers can put specific routes first.
  it('should prefer earlier route entries', async () => {
    // Arrange
    const fetchImpl = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok'))
    const app = createDevProxyApp({
      routes: [
        {
          paths: '/api/enterprise',
          target: 'https://enterprise.example.com',
        },
        {
          paths: '/api',
          target: 'https://api.example.com',
        },
      ],
      fetchImpl,
    })

    // Act
    await app.request('http://127.0.0.1:5001/api/enterprise/sso/login')

    // Assert
    expect(fetchImpl.mock.calls.map(([url]) => url.toString())).toEqual([
      'https://enterprise.example.com/api/enterprise/sso/login',
    ])
  })

  // Scenario: preflight requests should advertise allowed headers for credentialed cross-origin calls.
  it('should answer CORS preflight requests', async () => {
    // Arrange
    const app = createDevProxyApp({
      routes: [
        {
          paths: '/api',
          target: 'https://api.example.com',
        },
      ],
      fetchImpl: vi.fn<typeof fetch>(),
    })

    // Act
    const response = await app.request('http://127.0.0.1:5001/api/messages', {
      method: 'OPTIONS',
      headers: {
        'Origin': 'http://localhost:3000',
        'Access-Control-Request-Headers': 'authorization,content-type,x-csrf-token',
      },
    })

    // Assert
    expect(response.status).toBe(204)
    expect(response.headers.get('access-control-allow-origin')).toBe('http://localhost:3000')
    expect(response.headers.get('access-control-allow-credentials')).toBe('true')
    expect(response.headers.get('access-control-allow-headers')).toBe('authorization,content-type,x-csrf-token')
  })
})