import { expect, test } from "@playwright/test";

test("runs from a nested path and keeps authentication material local", async ({
  page,
}) => {
  const requests: string[] = [];
  page.on("request", (request) => requests.push(request.url()));
  await page.goto("/deep/nested/auth/");
  await expect(page.getByText("Sensitive session · memory only")).toBeVisible();
  await expect(
    page.getByRole("heading", { name: "Credential parameters" }),
  ).toBeVisible();
  await page.getByLabel("Issuer").fill("Example");
  await page.getByLabel("Account").fill("alice@example.test");
  await expect(page.getByText("TOTP code")).toBeVisible();
  await expect(page.locator(".qr svg")).toBeVisible();
  expect(
    requests.every((url) => new URL(url).origin === "http://127.0.0.1:4173"),
  ).toBe(true);
});

test("computes an RFC OCRA vector and decodes client data", async ({
  page,
}) => {
  await page.goto("/deep/nested/auth/");
  await page.getByRole("button", { name: "OCRA challenge" }).click();
  await page
    .getByLabel("Base32 shared secret")
    .fill("GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ");
  await page.getByRole("button", { name: "Compute OCRA response" }).click();
  await expect(page.getByText("237653")).toBeVisible();

  await page.getByRole("button", { name: /WebAuthn \/ Passkeys/ }).click();
  const client = btoa(
    JSON.stringify({
      type: "webauthn.get",
      challenge: "YQ",
      origin: "https://example.test",
    }),
  )
    .replaceAll("+", "-")
    .replaceAll("/", "_")
    .replace(/=+$/u, "");
  await page.getByLabel("Encoded input").fill(client);
  await page.getByRole("button", { name: "Decode locally" }).click();
  await expect(page.locator(".diagnostic-output")).toContainText(
    "webauthn.get",
  );
});

test("shared origin exposes inspection but not live credential creation", async ({
  page,
}) => {
  await page.goto("/deep/nested/auth/");
  await page.getByRole("button", { name: /WebAuthn \/ Passkeys/ }).click();
  await page.getByRole("button", { name: "Live ceremony" }).click();
  await expect(page.getByText("Inspect only")).toBeVisible();
  await expect(
    page.getByRole("button", { name: "Create test credential" }),
  ).toBeDisabled();
});