import test from 'node:test'
import assert from 'node:assert/strict'
import fs from 'node:fs'
import { PDA_ROLE, PDA_AUTHORITY, session, signInWithTokens, signOut, getSessionRevision } from '../src/stores/session.js'
import { receiving } from '../src/stores/receiving.js'
import { refresh, getPendingRefresh } from '../src/api/auth.js'
import { overseasRequest } from '../src/api/overseas.js'

const helperUrl = new URL('../src/api/logout-session.js', import.meta.url)
const logoutHelper = fs.existsSync(helperUrl) ? await import(helperUrl) : {}
const jwt = claims => [Buffer.from('{"alg":"none"}').toString('base64url'), Buffer.from(JSON.stringify(claims)).toString('base64url'), 'signature'].join('.')
function tokens(version='old', identity={}) { return {accessToken:jwt({user_id:42,membership_id:84,tenant_id:0,app_code:'PLATFORM',overseas_warehouse_id:900,exp:Math.floor(Date.now()/1000)+3600,version,...identity}),refreshToken:`refresh-${version}`,roles:[PDA_ROLE],authorities:[PDA_AUTHORITY]} }
const ok = data => ({statusCode:200,data:{code:'200',data},header:{}})
function prepare(){const values=new Map(),calls=[],launches=[],toasts=[];globalThis.uni={setStorageSync:(k,v)=>values.set(k,JSON.parse(JSON.stringify(v))),getStorageSync:k=>values.get(k),removeStorageSync:k=>values.delete(k),reLaunch:o=>launches.push(o.url),showToast:o=>toasts.push(o.title)};signOut();const original=tokens();signInWithTokens(original);receiving.current={containerNo:'ORIGINAL'};return {values,calls,launches,toasts,original}}
function page(){const source=fs.readFileSync(new URL('../src/pages/profile/profile.vue',import.meta.url),'utf8').match(/<script>([\s\S]*?)<\/script>/)[1].replace(/^\s*import[^\n]*$/gm,'').replace('export default','return');return new Function('PortalHeader','PopupHeader','signOut','logoutCurrentSession','getSessionRevision','session',source)({}, {},signOut,logoutHelper.logoutCurrentSession,getSessionRevision,session)}
test('actual profile confirmation clears drafts and revokes captured session before reporting success',async()=>{
  const state=prepare();uni.request=o=>{state.calls.push(o);assert.equal(session.token,'');assert.equal(receiving.current,null);o.success(ok(null))}
  const context={user:session.currentUser,closeLogout(){this.closed=true}}
  await page().methods.logout.call(context)
  assert.equal(state.calls.length,1)
  assert.match(state.calls[0].url,/\/auth\/logout$/)
  assert.deepEqual(state.calls[0].data,{refreshToken:state.original.refreshToken})
  assert.equal(state.calls[0].header.Authorization,`Bearer ${state.original.accessToken}`)
  assert.equal(state.values.has('overseas-pda-auth-session'),false)
})
const denied = (statusCode=401,code='A0401') => ({statusCode,data:{code,message:'denied',requestId:'logout-request',traceId:'logout-trace'},header:{}})
test('explicit expired-access 401 refreshes captured credentials once and revokes without restoring local tokens',async()=>{
  const state=prepare(),replacement=tokens('rotated')
  session.token=tokens('expired',{exp:1}).accessToken
  uni.request=o=>{state.calls.push(o);assert.equal(session.token,'');if(state.calls.length===1)o.success(denied());else if(o.url.endsWith('/auth/refresh')){assert.deepEqual(o.data,{refreshToken:state.original.refreshToken});assert.equal(o.header.Authorization,undefined);o.success(ok(replacement))}else{o.success(ok(null));assert.equal(o.header.Authorization,`Bearer ${replacement.accessToken}`);assert.deepEqual(o.data,{refreshToken:replacement.refreshToken})}}
  const result=await logoutHelper.logoutCurrentSession()
  assert.equal(result.revoked,true);assert.equal(state.calls.length,3);assert.equal(session.currentUser,null);assert.equal(state.values.size,0)
})
test('unknown network and 5xx results never trigger refresh or blind logout replay',async()=>{
  for(const failure of ['network','server','business']){
    const state=prepare();uni.request=o=>{state.calls.push(o);if(failure==='network')o.fail({errMsg:'connection lost'});else o.success(denied(failure==='server'?503:200,failure==='server'?'200':'A0401'))}
    await assert.rejects(logoutHelper.logoutCurrentSession(),error=>failure==='network'?error.network===true:error.statusCode===(failure==='server'?503:200))
    assert.equal(state.calls.length,1);assert.equal(session.token,'');assert.equal(receiving.current,null)
  }
})
test('refresh failure preserves diagnostic evidence and does not send a second revoke',async()=>{
  const state=prepare();uni.request=o=>{state.calls.push(o);o.success(state.calls.length===1?denied():denied(503,'S0503'))}
  await assert.rejects(logoutHelper.logoutCurrentSession(),error=>error.code==='S0503'&&error.requestId==='logout-request'&&error.traceId==='logout-trace')
  assert.equal(state.calls.length,2);assert.equal(getPendingRefresh(state.original.refreshToken),null);assert.equal(session.token,'')
})
test('different user membership or warehouse from logout refresh cannot revoke another session',async()=>{
  for(const identity of [{user_id:43},{membership_id:85},{overseas_warehouse_id:901}]){
    const state=prepare();uni.request=o=>{state.calls.push(o);o.success(state.calls.length===1?denied():ok(tokens('wrong',identity)))}
    await assert.rejects(logoutHelper.logoutCurrentSession(),/不同作业主体/);assert.equal(state.calls.length,2);assert.equal(state.values.size,0)
  }
})
test('missing refreshed credentials fail closed without local restoration',async()=>{
  for(const field of ['refreshToken','accessToken']){
    const state=prepare(),replacement=tokens('invalid');delete replacement[field]
    uni.request=o=>{state.calls.push(o);o.success(state.calls.length===1?denied():ok(replacement))}
    await assert.rejects(logoutHelper.logoutCurrentSession());assert.equal(state.calls.length,2);assert.equal(session.token,'');assert.equal(state.values.size,0)
  }
})
test('revocation-only refresh does not load permissions or recreate a login when permission snapshots are absent',async()=>{
  const state=prepare(),replacement=tokens('revocation-only');delete replacement.roles;delete replacement.authorities
  uni.request=o=>{state.calls.push(o);o.success(state.calls.length===1?denied():o.url.endsWith('/auth/refresh')?ok(replacement):ok(null))}
  assert.equal((await logoutHelper.logoutCurrentSession()).revoked,true)
  assert.equal(state.calls.length,3);assert.equal(session.token,'');assert.deepEqual(session.authorization,{roles:[],authorities:[]});assert.equal(state.values.size,0)
})
test('second revoke 401 is terminal and cannot start another refresh loop',async()=>{
  const state=prepare();uni.request=o=>{state.calls.push(o);o.success(o.url.endsWith('/auth/refresh')?ok(tokens('rotated')):denied())}
  await assert.rejects(logoutHelper.logoutCurrentSession(),error=>error.statusCode===401)
  assert.equal(state.calls.length,3);assert.equal(state.calls.filter(o=>o.url.endsWith('/auth/refresh')).length,1)
})
test('profile duplicate confirmation shares its pending operation',async()=>{
  const state=prepare();uni.request=o=>state.calls.push(o)
  const context={user:session.currentUser,closeLogout(){this.closed=true}},methods=page().methods
  const first=methods.logout.call(context),second=methods.logout.call(context)
  assert.equal(first,second);assert.equal(state.calls.length,1);assert.equal(state.launches.length,1)
  state.calls[0].success(ok(null));await first
})
test('old logout result cannot clear redirect or warn over a subsequent new login',async()=>{
  for(const failed of [false,true]){
    const state=prepare();uni.request=o=>state.calls.push(o)
    const context={user:session.currentUser,closeLogout(){}},pending=page().methods.logout.call(context)
    const replacement=tokens('new-login',{user_id:43,membership_id:85,overseas_warehouse_id:901})
    signInWithTokens(replacement);receiving.current={containerNo:'NEW-USER'}
    if(failed)state.calls[0].fail({errMsg:'old connection lost'});else state.calls[0].success(ok(null))
    await pending
    assert.equal(session.token,replacement.accessToken);assert.equal(receiving.current.containerNo,'NEW-USER');assert.equal(state.launches.length,1);assert.equal(state.toasts.length,0)
  }
})
test('logout joins actual in-flight business refresh and revokes its rotation while preserving a new login',async()=>{
  const state=prepare();let refreshRequest
  uni.request=o=>{state.calls.push(o);if(o.url.endsWith('/auth/refresh'))refreshRequest=o;else if(o.url.endsWith('/auth/logout'))o.success(ok(null));else o.success(denied())}
  const business=overseasRequest('GET','/pda/v1/last-leg/receiving-containers/current').catch(error=>error)
  await new Promise(resolve=>setImmediate(resolve));assert.ok(refreshRequest)
  const logout=logoutHelper.logoutCurrentSession()
  const newer=tokens('new-login',{user_id:43,membership_id:85,overseas_warehouse_id:901});signInWithTokens(newer)
  const rotated=tokens('rotated-old');refreshRequest.success(ok(rotated))
  assert.equal((await logout).revoked,true);assert.match((await business).message,/会话已变更/)
  assert.equal(state.calls.filter(o=>o.url.endsWith('/auth/refresh')).length,1)
  const revoked=state.calls.find(o=>o.url.endsWith('/auth/logout'));assert.deepEqual(revoked.data,{refreshToken:rotated.refreshToken});assert.equal(revoked.header.Authorization,`Bearer ${rotated.accessToken}`)
  assert.equal(session.token,newer.accessToken);assert.deepEqual(state.launches,[])
})
test('unknown in-flight refresh never rotates captured credentials again or reports remote success',async()=>{
  const state=prepare();uni.request=o=>state.calls.push(o)
  const inFlight=refresh(state.original.refreshToken).catch(error=>error)
  const logout=logoutHelper.logoutCurrentSession();const rejected=assert.rejects(logout,error=>error.network===true)
  state.calls[0].fail({errMsg:'refresh result unknown'});await rejected;await inFlight
  assert.equal(state.calls.length,1);assert.equal(session.token,'');assert.equal(getPendingRefresh(state.original.refreshToken),null)
})
test('ordinary local signOut and cancelled profile dialog never contact Auth',()=>{
  const state=prepare();uni.request=o=>state.calls.push(o)
  page().methods.closeLogout.call({logoutOpen:true,$refs:{logoutPopup:{close(){}}}})
  assert.equal(session.token,state.original.accessToken);signOut();assert.equal(state.calls.length,0);assert.equal(session.token,'')
})
test('no captured credentials require no remote request',async()=>{
  const state=prepare();signOut();uni.request=o=>state.calls.push(o)
  assert.equal((await logoutHelper.logoutCurrentSession()).revoked,false);assert.equal(state.calls.length,0)
})