import { expect, test, type Page } from "@playwright/test";
import { MODERN_PFX_BASE64, MODERN_PFX_PASSWORD } from "../fixtures/pkcs12";

const ORIGIN = "http://127.0.0.1:4173";
function nodeBase64Buffer(value: string): never {
  return (
    globalThis as unknown as {
      Buffer: { from(source: string, encoding: "base64"): never };
    }
  ).Buffer.from(value, "base64");
}

async function localOnly(page: Page) {
  const external: string[] = [];
  await page.route("**/*", async (route) => {
    const url = new URL(route.request().url());
    if (url.origin !== ORIGIN) {
      external.push(url.href);
      await route.abort();
    } else await route.continue();
  });
  return external;
}

test("runs from a nested path without external requests", async ({ page }) => {
  const errors: string[] = [];
  page.on("pageerror", (error) => errors.push(error.message));
  page.on("console", (message) => {
    if (message.type() === "error") errors.push(message.text());
  });
  const external = await localOnly(page);
  await page.goto("/deep/nested/crypto/");
  await expect(
    page.getByRole("heading", { name: "Crypto Tools" }),
  ).toBeVisible();
  expect(external).toEqual([]);
  expect(errors).toEqual([]);
});

test("inspects a JWK and computes its local thumbprint", async ({ page }) => {
  const external = await localOnly(page);
  await page.goto("/deep/nested/crypto/");
  await page.getByRole("button", { name: "Inspect locally" }).click();
  await expect(page.getByRole("heading", { name: "1 object" })).toBeVisible();
  await expect(page.getByText("RFC 7638 SHA-256 thumbprint")).toBeVisible();
  await expect(page.getByText(/^[A-Za-z0-9_-]{43}$/u)).toBeVisible();
  await expect(page.getByText(/does not use or imply trust/u)).toBeVisible();
  expect(external).toEqual([]);
});

test("round-trips authenticated text with an explicit generated AES key", async ({
  page,
}) => {
  const external = await localOnly(page);
  await page.goto("/deep/nested/crypto/");
  await page.getByRole("button", { name: "Generate 256-bit AES key" }).click();
  await expect(page.getByLabel("Operation key")).toHaveValue(
    /^[A-Za-z0-9_-]{43}$/u,
  );
  await page.getByRole("button", { name: "Encrypt locally" }).click();
  await expect(page.locator(".operation-result > pre")).toContainText(
    '"algorithm": "AES-256-GCM"',
  );
  await page.getByRole("button", { name: "Decrypt" }).click();
  await page.getByRole("button", { name: "Decrypt locally" }).click();
  await expect(page.locator(".operation-result > pre")).toHaveText(
    "Local-only example",
  );
  expect(external).toEqual([]);
});

test("inspects a modern PFX only after explicit password consent", async ({
  page,
}) => {
  const external = await localOnly(page);
  await page.goto("/deep/nested/crypto/");
  await page.getByLabel("Open file").setInputFiles({
    name: "modern-test.p12",
    mimeType: "application/x-pkcs12",
    buffer: nodeBase64Buffer(MODERN_PFX_BASE64),
  });
  await expect(
    page.getByText("Present; explicit password required to verify"),
  ).toBeVisible();
  await expect(
    page.getByRole("heading", { name: "Local test identity" }),
  ).toBeVisible();

  await page
    .getByLabel(/Use this password in memory for this inspection/u)
    .check();
  await page
    .getByLabel(/PBES2 \/ PKCS #12 password/u)
    .fill(MODERN_PFX_PASSWORD);
  await page.getByRole("button", { name: "Inspect locally" }).click();
  await expect(
    page.getByText("Verified with the explicitly supplied password"),
  ).toBeVisible();
  await expect(
    page.getByText("Local PFX Test", { exact: false }).first(),
  ).toBeVisible();
  await expect(
    page.locator("dt", { hasText: "Private-key algorithm" }),
  ).toBeVisible();
  expect(external).toEqual([]);
});

test("serves the release identity and hardened headers", async ({
  request,
}) => {
  const index = await request.get("/deep/nested/crypto/");
  expect(index.ok()).toBe(true);
  expect(index.headers()["content-security-policy"]).toContain(
    "default-src 'self'",
  );
  expect(await index.text()).not.toMatch(/\b(?:src|href)=["']\//u);
  const manifest = await request.get("/deep/nested/crypto/toolbox-app.json");
  await expect(manifest.json()).resolves.toMatchObject({
    id: "de.add-ideas.crypto-tools",
    version: "0.2.0",
    entry: "./",
  });
});