import { createHash } from "crypto";
import * as authService from "./authService";
import { installFetchMock, makeFakeJwt, mockResponse } from "../test/httpMock";

const TOKEN_ENDPOINT = "http://localhost:8080/realms/word-versioning/protocol/openid-connect/token";

function base64Url(buffer: Buffer): string {
  return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}

interface OfficeDialogMock {
  displayDialogAsync: jest.Mock;
  dialog: { close: jest.Mock };
  capturedUrl: () => string;
  sendMessage: (payload: unknown) => void;
  sendDialogEvent: () => void;
}

/** mock Office.context.ui.displayDialogAsync + dialog event handlers (FR-8 flow ผ่าน Dialog API) */
function installOfficeDialogMock(): OfficeDialogMock {
  const globalAny = globalThis as unknown as Record<string, unknown>;
  const messageHandlers: Array<(args: unknown) => void> = [];
  const eventHandlers: Array<(args: unknown) => void> = [];
  let capturedAuthUrl = "";

  const dialog = {
    close: jest.fn(),
    addEventHandler: (eventType: string, handler: (args: unknown) => void) => {
      (eventType === "dialogMessageReceived" ? messageHandlers : eventHandlers).push(handler);
    },
  };

  const displayDialogAsync = jest.fn(
    (startAddress: string, _options: unknown, callback: (result: unknown) => void) => {
      capturedAuthUrl = startAddress;
      callback({ status: "succeeded", value: dialog });
    }
  );
  globalAny.Office = {
    EventType: {
      DialogMessageReceived: "dialogMessageReceived",
      DialogEventReceived: "dialogEventReceived",
    },
    AsyncResultStatus: { Succeeded: "succeeded", Failed: "failed" },
    context: { ui: { displayDialogAsync } },
  } as unknown as typeof Office;

  return {
    displayDialogAsync,
    dialog: dialog as OfficeDialogMock["dialog"],
    capturedUrl: () => capturedAuthUrl,
    sendMessage: (payload: unknown) => {
      messageHandlers.forEach((handler) => handler({ message: JSON.stringify(payload) }));
    },
    sendDialogEvent: () => {
      eventHandlers.forEach((handler) => handler({ error: 12006 }));
    },
  };
}

/** รอจนกว่า login จะเรียก displayDialogAsync จริง (ต้องผ่าน crypto.subtle.digest ก่อน — ในเครื่องโหลดอาจช้ากว่า setTimeout(0)) */
async function waitForDialog(office: OfficeDialogMock): Promise<void> {
  for (
    let attempt = 0;
    attempt < 200 && office.displayDialogAsync.mock.calls.length === 0;
    attempt++
  ) {
    await new Promise((resolve) => setTimeout(resolve, 5));
  }
  expect(office.displayDialogAsync).toHaveBeenCalled();
}

beforeEach(() => {
  authService.signOut();
});

afterEach(() => {
  authService.signOut(); // เคลียร์ auto-refresh timer กัน handle ค้าง
});

describe("PKCE", () => {
  it("code_verifier ยาว 43–128 chars และอยู่ในชุดตัวอักษร base64url ที่ RFC 7636 อนุญาต", () => {
    for (let i = 0; i < 20; i++) {
      const verifier = authService.createCodeVerifier();
      expect(verifier.length).toBeGreaterThanOrEqual(43);
      expect(verifier.length).toBeLessThanOrEqual(128);
      expect(verifier).toMatch(/^[A-Za-z0-9\-_]+$/);
      expect(verifier).not.toContain("=");
    }
  });

  it("code_challenge = BASE64URL(SHA256(verifier)) — ตรวจกับ test vector ของ RFC 7636 appendix B", async () => {
    // vector จาก RFC 7636 เอง
    const challenge = await authService.createS256Challenge(
      "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
    );
    expect(challenge).toBe("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
  });

  it("code_challenge ของ verifier สุ่มตรงกับที่คำนวณเองด้วย node crypto", async () => {
    const verifier = authService.createCodeVerifier();
    const expected = base64Url(createHash("sha256").update(verifier).digest());
    await expect(authService.createS256Challenge(verifier)).resolves.toBe(expected);
  });
});

describe("buildAuthorizationUrl", () => {
  it("ประกอบ authorization URL ครบทุกพารามิเตอร์ (client_id/redirect/response_type/scope/state/PKCE)", () => {
    const url = new URL(
      authService.buildAuthorizationUrl({ codeChallenge: "the-challenge", state: "the-state" })
    );

    expect(url.origin).toBe("http://localhost:8080");
    expect(url.pathname).toBe("/realms/word-versioning/protocol/openid-connect/auth");
    expect(url.searchParams.get("client_id")).toBe("word-addin-officejs");
    expect(url.searchParams.get("redirect_uri")).toBe("http://localhost/auth-callback.html");
    expect(url.searchParams.get("response_type")).toBe("code");
    expect(url.searchParams.get("scope")).toBe("openid");
    expect(url.searchParams.get("state")).toBe("the-state");
    expect(url.searchParams.get("code_challenge")).toBe("the-challenge");
    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
  });
});

describe("decodeJwtExpiry", () => {
  it("อ่าน exp จาก JWT payload เป็น ms epoch", () => {
    const expiresAt = Date.now() + 300_000;
    expect(authService.decodeJwtExpiry(makeFakeJwt(expiresAt))).toBe(
      Math.floor(expiresAt / 1000) * 1000
    );
  });

  it("token ไม่ใช่รูป JWT → null", () => {
    expect(authService.decodeJwtExpiry("not-a-jwt")).toBeNull();
  });
});

describe("login (Office Dialog + token exchange)", () => {
  it("เต็ม flow: URL มี PKCE → dialog ส่ง code+state → แลก token ด้วย verifier ที่ pair กัน → isTokenValid", async () => {
    const office = installOfficeDialogMock();
    let exchangedBody: URLSearchParams | null = null;
    const fetchMock = installFetchMock();
    fetchMock.mockImplementation(async (input: unknown, init?: { body?: string }) => {
      expect(String(input)).toBe(TOKEN_ENDPOINT);
      exchangedBody = new URLSearchParams(String(init?.body));
      return mockResponse({
        status: 200,
        body: {
          access_token: makeFakeJwt(Date.now() + 300_000),
          refresh_token: "refresh-1",
          expires_in: 300,
        },
      });
    });

    const loginPromise = authService.login();
    await waitForDialog(office);

    // authorization URL ที่ส่งเข้า dialog
    const authUrl = new URL(office.capturedUrl());
    const challenge = authUrl.searchParams.get("code_challenge") ?? "";
    const state = authUrl.searchParams.get("state") ?? "";
    expect(challenge).not.toBe("");
    expect(state).not.toBe("");

    office.sendMessage({ code: "the-auth-code", state });
    await expect(loginPromise).resolves.toEqual({ ok: true });
    expect(authService.isTokenValid()).toBe(true);
    expect(office.dialog.close).toHaveBeenCalled();

    // verifier ที่ใช้แลก token ต้อง hash ได้ = challenge ใน URL (pair กันจริง)
    const verifier = exchangedBody?.get("code_verifier") ?? "";
    expect(exchangedBody?.get("grant_type")).toBe("authorization_code");
    expect(exchangedBody?.get("code")).toBe("the-auth-code");
    expect(exchangedBody?.get("client_id")).toBe("word-addin-officejs");
    expect(base64Url(createHash("sha256").update(verifier).digest())).toBe(challenge);
  });

  it("state ไม่ตรง (CSRF) → login fail และไม่ยิง token endpoint", async () => {
    const office = installOfficeDialogMock();
    const fetchMock = installFetchMock();

    const loginPromise = authService.login();
    await waitForDialog(office);
    office.sendMessage({ code: "code", state: "tampered-state" });

    const result = await loginPromise;
    expect(result).toEqual({ ok: false, error: expect.stringContaining("state") });
    expect(fetchMock).not.toHaveBeenCalled();
    expect(authService.isTokenValid()).toBe(false);
  });

  it("ผู้ใช้ปิด dialog เอง (DialogEventReceived) → คืน error แบบ graceful", async () => {
    const office = installOfficeDialogMock();
    installFetchMock();

    const loginPromise = authService.login();
    await waitForDialog(office);
    office.sendDialogEvent();

    const result = await loginPromise;
    expect(result.ok).toBe(false);
    expect(authService.isTokenValid()).toBe(false);
  });

  it("Keycloak ปฏิเสธ (error ใน callback) → ok:false พร้อมชื่อ error", async () => {
    const office = installOfficeDialogMock();
    installFetchMock();

    const loginPromise = authService.login();
    await waitForDialog(office);
    office.sendMessage({ error: "access_denied", errorDescription: "user cancelled" });

    const result = await loginPromise;
    expect(result).toEqual({ ok: false, error: expect.stringContaining("access_denied") });
  });

  it("เรียก login ซ้อนพร้อมกัน → เปิด dialog ครั้งเดียว ได้ผลเดียวกันทั้งสอง promise", async () => {
    const office = installOfficeDialogMock();
    installFetchMock(async () =>
      mockResponse({
        status: 200,
        body: { access_token: makeFakeJwt(Date.now() + 300_000), expires_in: 300 },
      })
    );

    const first = authService.login();
    const second = authService.login();
    await waitForDialog(office);

    const state = new URL(office.capturedUrl()).searchParams.get("state") ?? "";
    office.sendMessage({ code: "code", state });

    await expect(first).resolves.toEqual({ ok: true });
    await expect(second).resolves.toEqual({ ok: true });
    expect(office.displayDialogAsync).toHaveBeenCalledTimes(1);
  });
});

describe("silent refresh (AC-9)", () => {
  it("access token หมดอายุ + refresh token ใช้ได้ → getAccessToken refresh เงียบๆ แล้วคืน token ใหม่", async () => {
    authService.setSessionForTest("expired-access-token", "refresh-old", Date.now() - 60_000);
    const newToken = makeFakeJwt(Date.now() + 600_000);
    const fetchMock = installFetchMock(async () =>
      mockResponse({
        status: 200,
        body: { access_token: newToken, refresh_token: "refresh-new", expires_in: 600 },
      })
    );

    const token = await authService.getAccessToken();

    expect(token).toBe(newToken);
    expect(authService.isTokenValid()).toBe(true);
    expect(fetchMock).toHaveBeenCalledTimes(1);
    const body = new URLSearchParams(String((fetchMock.mock.calls[0][1] as { body: string }).body));
    expect(body.get("grant_type")).toBe("refresh_token");
    expect(body.get("refresh_token")).toBe("refresh-old");
    expect(body.get("client_id")).toBe("word-addin-officejs");
    // Keycloak หมุน refresh token — เก็บอันใหม่ไว้ใช้รอบหน้า
    expect(authService.hasRefreshToken()).toBe(true);
  });

  it("refresh token ตาย/ถูก revoke → getAccessToken คืน null ไม่ throw และล้าง session", async () => {
    authService.setSessionForTest("expired-access-token", "refresh-dead", Date.now() - 60_000);
    const fetchMock = installFetchMock(async () =>
      mockResponse({ status: 400, text: "invalid_grant" })
    );

    await expect(authService.getAccessToken()).resolves.toBeNull();
    expect(authService.isTokenValid()).toBe(false);
    expect(authService.hasRefreshToken()).toBe(false);

    // เรียกซ้ำหลัง session ถูกล้าง → null ทันทีโดยไม่ยิง fetch เพิ่ม
    await expect(authService.getAccessToken()).resolves.toBeNull();
    expect(fetchMock).toHaveBeenCalledTimes(1);
  });

  it("ไม่เคย login เลย → isTokenValid false, getAccessToken null", async () => {
    expect(authService.isTokenValid()).toBe(false);
    await expect(authService.getAccessToken()).resolves.toBeNull();
  });
});