import assert from 'node:assert/strict';
import { test } from 'node:test';
import { createClient, createGatedClient, type Client } from '../src/client.js';
import { isConfigError, isDomainDeniedError } from '../src/errors.js';
import { checkGate, refreshGate, type GateRules } from '../src/gate.js';
import * as dns from '../src/dns.js';
import * as ipfs from '../src/ipfs.js';
import { bodyJson, caught, fakeFetch, noSleep, type Call, type Reply, type Responder } from './helpers.js';

const registrationsPage = {
  registrations: [
    { id: 'reg-1', domain: 'safe.ro' },
    { id: 'reg-2', domain: 'prod.ro' },
    { id: 'reg-3', domain: 'Sub.Prod.ro' },
  ],
  next_cursor: null,
};

const ok = (body: object = {}): Reply => ({ status: 200, body });

/** Answers the registrations listing with the fixed page and everything else with `{}`. */
const withRegistrations: Responder = (call) =>
  call.url.includes('/domains/registrations?') ? ok(registrationsPage) : ok();

/** Answers 404 to the single-registration lookup done on a cache miss. */
const registration404: Responder = () => ({
  status: 404,
  body: { error: { code: 'not-found', message: 'no such registration' } },
});

/** A gated client whose transport can be re-pointed after creation. */
const gatedClient = async (rules: GateRules) => {
  let responder: Responder = withRegistrations;
  const { fetch, calls } = fakeFetch((call, i) => responder(call, i));
  const client = await createGatedClient({ apiKey: 'ird_k', fetch, sleep: noSleep, ...rules });
  const use = (next: Responder) => {
    responder = next;
    calls.length = 0;
  };
  use(withRegistrations);
  return { client, calls, use };
};

const denied = (client: Client, op: string, target: Parameters<typeof checkGate>[2]) =>
  caught(() => checkGate(client, op, target));

test('matching', async (t) => {
  await t.test('exact match is case-insensitive and ignores a trailing dot', async () => {
    const { client } = await gatedClient({ deniedDomains: ['Prod.RO'] });
    assert.ok(isDomainDeniedError(await denied(client, 'POST /x', { domain: 'prod.ro.' })));
  });
  await t.test('a wildcard matches subdomains and the bare suffix', async () => {
    const { client } = await gatedClient({ deniedDomains: ['*.prod.ro'] });
    assert.ok(isDomainDeniedError(await denied(client, 'POST /x', { domain: 'api.prod.ro' })));
    assert.ok(isDomainDeniedError(await denied(client, 'POST /x', { domain: 'prod.ro' })));
    await checkGate(client, 'POST /x', { domain: 'notprod.ro' });
  });
  await t.test('an allow-list denies everything not listed', async () => {
    const { client } = await gatedClient({ allowedDomains: ['safe.ro'] });
    await checkGate(client, 'POST /x', { domain: 'safe.ro' });
    const e = await denied(client, 'POST /x', { domain: 'other.ro' });
    assert.ok(isDomainDeniedError(e));
    assert.equal(e.domain, 'other.ro');
    assert.equal(e.matchedPattern, null);
    assert.equal(e.op, 'POST /x');
  });
  await t.test('deny wins over allow', async () => {
    const { client } = await gatedClient({ allowedDomains: ['*.ro'], deniedDomains: ['prod.ro'] });
    await checkGate(client, 'POST /x', { domain: 'safe.ro' });
    const e = await denied(client, 'POST /x', { domain: 'prod.ro' });
    assert.ok(isDomainDeniedError(e));
    assert.equal(e.matchedPattern, 'prod.ro');
  });
  await t.test('an empty allow-list denies every domain mutation', async () => {
    const { client } = await gatedClient({ allowedDomains: [] });
    assert.ok(isDomainDeniedError(await denied(client, 'POST /x', { domain: 'anything.ro' })));
  });
});

test('registration id resolution', async (t) => {
  await t.test('ids resolve to domains through the cache built at creation', async () => {
    const { client } = await gatedClient({ deniedDomains: ['prod.ro'] });
    assert.ok(isDomainDeniedError(await denied(client, 'POST /y', { registrationId: 'reg-2' })));
    await checkGate(client, 'POST /y', { registrationId: 'reg-1' });
  });
  await t.test('cached domains are normalized', async () => {
    const { client } = await gatedClient({ deniedDomains: ['sub.prod.ro'] });
    assert.ok(isDomainDeniedError(await denied(client, 'POST /y', { registrationId: 'reg-3' })));
  });
  await t.test('a cache miss fetches the single registration, applies the gate, and caches it', async () => {
    const { client, calls, use } = await gatedClient({ deniedDomains: ['prod.ro'] });
    use(() => ok({ registration: { id: 'reg-late', domain: 'prod.ro' } }));
    assert.ok(isDomainDeniedError(await denied(client, 'POST /y', { registrationId: 'reg-late' })));
    assert.equal(calls.length, 1);
    assert.match(calls[0]!.url, /\/domains\/registrations\/reg-late$/);
    use(registration404);
    assert.ok(isDomainDeniedError(await denied(client, 'POST /y', { registrationId: 'reg-late' })));
    assert.equal(calls.length, 0, 'served from the cache, no HTTP');
  });
  await t.test('an id unknown to cache and API passes under a pure deny-list', async () => {
    const { client, use } = await gatedClient({ deniedDomains: ['prod.ro'] });
    use(registration404);
    await checkGate(client, 'POST /y', { registrationId: 'reg-unknown' });
  });
  await t.test('an id unknown to cache and API fails closed under an allow-list', async () => {
    const { client, use } = await gatedClient({ allowedDomains: ['safe.ro'] });
    use(registration404);
    const e = await denied(client, 'POST /y', { registrationId: 'reg-unknown' });
    assert.ok(isDomainDeniedError(e));
    assert.equal(e.domain, null);
  });
});

test('gateway domain pins', async (t) => {
  await t.test('attaching pins to a denied gateway domain throws before the POST', async () => {
    const { client, calls, use } = await gatedClient({ deniedDomains: ['*.prod.ro'] });
    use(() => ok({ domain: { id: 'gw-1', domain: 'gw.prod.ro' } }));
    const e = await caught(() => ipfs.updateDomainPins(client, 'gw-1', { add: ['pin-1'] }));
    assert.ok(isDomainDeniedError(e));
    assert.equal(e.domain, 'gw.prod.ro');
    assert.deepEqual(
      calls.map((c: Call) => c.method),
      ['GET'],
    );
    assert.match(calls[0]!.url, /\/ipfs\/domains\/gw-1$/);
  });
  await t.test('an allowed gateway domain sends the delta', async () => {
    const { client, calls, use } = await gatedClient({ deniedDomains: ['*.prod.ro'] });
    use(() => ok({ domain: { id: 'gw-2', domain: 'gw.safe.ro', pin_count: 1 } }));
    const resp = await ipfs.updateDomainPins(client, 'gw-2', { add: ['pin-1'] });
    assert.equal(resp.domain.pin_count, 1);
    assert.deepEqual(
      calls.map((c) => c.method),
      ['GET', 'POST'],
    );
    assert.match(calls[1]!.url, /\/ipfs\/domains\/gw-2\/pins$/);
    assert.deepEqual(bodyJson(calls[1]!), { add: ['pin-1'] });
  });
  await t.test('an ungated client skips the lookup entirely', async () => {
    const { fetch, calls } = fakeFetch();
    const client = createClient({ apiKey: 'ird_k', fetch });
    await ipfs.updateDomainPins(client, 'gw-3', { remove: ['pin-1'] });
    assert.deepEqual(
      calls.map((c) => c.method),
      ['POST'],
    );
  });
});

test('claim mutations', async (t) => {
  await t.test('releasing a claim on a denied domain resolves the claim first and throws before the DELETE', async () => {
    const { client, calls, use } = await gatedClient({ deniedDomains: ['prod.ro'] });
    use(() => ok({ claim: { id: 'c1', domain: 'prod.ro' } }));
    const e = await caught(() => dns.releaseClaim(client, 'c1'));
    assert.ok(isDomainDeniedError(e));
    assert.equal(e.domain, 'prod.ro');
    assert.deepEqual(
      calls.map((c) => c.method),
      ['GET'],
    );
    assert.match(calls[0]!.url, /\/dns\/claims\/c1$/);
  });
  await t.test('seeding a claim on an allowed domain sends the body', async () => {
    const { client, calls, use } = await gatedClient({ allowedDomains: ['safe.ro'] });
    use(() => ok({ claim: { id: 'c2', domain: 'safe.ro' } }));
    await dns.seedClaim(client, 'c2', { snapshot_id: 's1' });
    assert.deepEqual(
      calls.map((c) => c.method),
      ['GET', 'PUT'],
    );
    assert.match(calls[1]!.url, /\/dns\/claims\/c2\/seed$/);
    assert.deepEqual(bodyJson(calls[1]!), { snapshot_id: 's1' });
  });
  await t.test('an ungated client skips the lookup entirely', async () => {
    const { fetch, calls } = fakeFetch();
    const client = createClient({ apiKey: 'ird_k', fetch });
    await dns.unseedClaim(client, 'c3');
    assert.deepEqual(
      calls.map((c) => c.method),
      ['DELETE'],
    );
  });
});

test('gate lifecycle', async (t) => {
  await t.test('a client without gate options has no gate and checkGate is a no-op', async () => {
    const client = createClient({ apiKey: 'ird_k', fetch: fakeFetch().fetch });
    assert.equal(client.gate, undefined);
    await checkGate(client, 'POST /x', { domain: 'anything.ro' });
  });
  await t.test('gate options on an anonymous client are a config error', async () => {
    const e = await caught(() => createGatedClient({ deniedDomains: ['x.ro'], fetch: fakeFetch().fetch }));
    assert.ok(isConfigError(e));
    assert.match(e.message, /require an authenticated client/);
  });
  await t.test('the gate throws before any request is sent', async () => {
    const { client, calls } = await gatedClient({ deniedDomains: ['prod.ro'] });
    assert.ok(isDomainDeniedError(await denied(client, 'POST /x', { domain: 'prod.ro' })));
    assert.equal(calls.length, 0);
  });
  await t.test('the client is frozen and the gate lists are copies', async () => {
    const rules = { allowedDomains: ['safe.ro'] };
    const { client } = await gatedClient(rules);
    assert.ok(Object.isFrozen(client));
    rules.allowedDomains.push('sneaky.ro');
    assert.ok(isDomainDeniedError(await denied(client, 'POST /x', { domain: 'sneaky.ro' })));
  });
  await t.test('refreshGate picks up newly registered domains', async () => {
    const { client, use } = await gatedClient({ allowedDomains: ['safe.ro', 'new.ro'] });
    use(registration404);
    assert.ok(isDomainDeniedError(await denied(client, 'POST /y', { registrationId: 'reg-9' })));
    use(() => ok({ registrations: [{ id: 'reg-9', domain: 'new.ro' }], next_cursor: null }));
    await refreshGate(client);
    await checkGate(client, 'POST /y', { registrationId: 'reg-9' });
    assert.equal(await refreshGate(createClient({ apiKey: 'k' })), undefined);
  });
});