import { EventEmitter } from 'node:events';
import { spawn } from 'child_process';
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
import {
  AuthRateLimiter,
  AuthSessionManager,
  createSecureAuthEnv,
  createTempEnvOverride,
  safeGetEnv,
  spawnSecureAuth,
  validateApiKey,
  wouldModifyEnv,
} from '@/lib/auth-utils.js';

vi.mock('child_process', () => ({ spawn: vi.fn() }));
vi.mock('@automaker/utils', () => ({
  createLogger: () => ({ debug: vi.fn() }),
}));

const anthropicKey = 'sk-ant-fixture-authentication-key';
const openaiKey = 'sk-fixture-authentication-key';

function mockChild(withStreams = true) {
  const child = Object.assign(new EventEmitter(), {
    stdout: withStreams ? new EventEmitter() : null,
    stderr: withStreams ? new EventEmitter() : null,
    kill: vi.fn().mockReturnValue(true),
  });
  vi.mocked(spawn).mockReturnValue(child as unknown as ReturnType<typeof spawn>);
  return child;
}

beforeEach(() => {
  AuthSessionManager.cleanup();
});

afterEach(() => {
  AuthSessionManager.cleanup();
  vi.useRealTimers();
  vi.unstubAllEnvs();
});

describe('API key validation and isolated environments', () => {
  it.each([
    ['anthropic', anthropicKey],
    ['openai', openaiKey],
    ['cursor', 'cursor-fixture-key'],
  ] as const)(
    'normalizes a valid %s key without changing the global environment',
    (provider, key) => {
      vi.stubEnv('ANTHROPIC_API_KEY', 'global-anthropic-fixture');
      vi.stubEnv('OPENAI_API_KEY', 'global-openai-fixture');

      expect(validateApiKey(`  ${key}\n`, provider)).toEqual({
        isValid: true,
        normalizedKey: key,
      });
      expect(process.env.ANTHROPIC_API_KEY).toBe('global-anthropic-fixture');
      expect(process.env.OPENAI_API_KEY).toBe('global-openai-fixture');
    }
  );

  it.each(['', '  ', undefined, 42])('rejects missing or non-string keys (%s)', (key) => {
    expect(validateApiKey(key as string, 'anthropic')).toEqual({
      isValid: false,
      error: 'API key is required',
    });
  });

  it.each([
    ['anthropic', 'wrong-provider-fixture-key', 'format'],
    ['anthropic', 'sk-ant-short', 'too short'],
    ['openai', 'wrong-provider-fixture-key', 'format'],
    ['openai', 'sk-short', 'too short'],
    ['cursor', 'short', 'too short'],
  ] as const)(
    'rejects invalid %s credentials before launching authentication',
    (provider, key, error) => {
      expect(validateApiKey(key, provider)).toMatchObject({ isValid: false });
      expect(() => createSecureAuthEnv('api_key', key, provider)).toThrow(error);
      expect(spawn).not.toHaveBeenCalled();
    }
  );

  it('gives concurrent CLI and API authentication separate provider environments', () => {
    vi.stubEnv('ANTHROPIC_API_KEY', 'global-anthropic-fixture');
    vi.stubEnv('OPENAI_API_KEY', 'global-openai-fixture');
    vi.stubEnv('AUTH_UTILS_INHERITED_FIXTURE', 'inherited');

    const cliAnthropic = createSecureAuthEnv('cli');
    const cliOpenai = createSecureAuthEnv('cli', undefined, 'openai');
    const apiAnthropic = createSecureAuthEnv('api_key', ` ${anthropicKey} `);
    const apiOpenai = createSecureAuthEnv('api_key', ` ${openaiKey} `, 'openai');

    expect(cliAnthropic.ANTHROPIC_API_KEY).toBeUndefined();
    expect(cliAnthropic.OPENAI_API_KEY).toBe('global-openai-fixture');
    expect(cliOpenai.OPENAI_API_KEY).toBeUndefined();
    expect(cliOpenai.ANTHROPIC_API_KEY).toBe('global-anthropic-fixture');
    expect(apiAnthropic.ANTHROPIC_API_KEY).toBe(anthropicKey);
    expect(apiOpenai.OPENAI_API_KEY).toBe(openaiKey);
    expect(apiOpenai.AUTH_UTILS_INHERITED_FIXTURE).toBe('inherited');
    apiAnthropic.AUTH_UTILS_INHERITED_FIXTURE = 'changed-in-one-environment';
    expect(apiOpenai.AUTH_UTILS_INHERITED_FIXTURE).toBe('inherited');
    expect(process.env.AUTH_UTILS_INHERITED_FIXTURE).toBe('inherited');
    expect(process.env.ANTHROPIC_API_KEY).toBe('global-anthropic-fixture');
    expect(process.env.OPENAI_API_KEY).toBe('global-openai-fixture');
  });

  it('preserves an inherited environment when API credentials are omitted', () => {
    vi.stubEnv('ANTHROPIC_API_KEY', 'global-anthropic-fixture');
    expect(createSecureAuthEnv('api_key').ANTHROPIC_API_KEY).toBe('global-anthropic-fixture');
  });

  it('restores overwritten, deleted, and newly introduced variables after a temporary override', () => {
    vi.stubEnv('AUTH_UTILS_EXISTING_FIXTURE', 'original');
    vi.stubEnv('AUTH_UTILS_DELETED_FIXTURE', 'restore-me');
    vi.stubEnv('AUTH_UTILS_NEW_FIXTURE', undefined);
    vi.stubEnv('AUTH_UTILS_LATER_FIXTURE', undefined);
    const cleanup = createTempEnvOverride({
      AUTH_UTILS_EXISTING_FIXTURE: 'temporary',
      AUTH_UTILS_NEW_FIXTURE: 'temporary-new',
    });
    try {
      expect(safeGetEnv('AUTH_UTILS_EXISTING_FIXTURE')).toBe('temporary');
      expect(wouldModifyEnv('AUTH_UTILS_EXISTING_FIXTURE', 'temporary')).toBe(false);
      expect(wouldModifyEnv('AUTH_UTILS_EXISTING_FIXTURE', 'different')).toBe(true);
      delete process.env.AUTH_UTILS_DELETED_FIXTURE;
      process.env.AUTH_UTILS_LATER_FIXTURE = 'created-after-override';
    } finally {
      cleanup();
    }

    expect(safeGetEnv('AUTH_UTILS_EXISTING_FIXTURE')).toBe('original');
    expect(safeGetEnv('AUTH_UTILS_DELETED_FIXTURE')).toBe('restore-me');
    expect(safeGetEnv('AUTH_UTILS_NEW_FIXTURE')).toBeUndefined();
    expect(safeGetEnv('AUTH_UTILS_LATER_FIXTURE')).toBeUndefined();
    expect(wouldModifyEnv('AUTH_UTILS_NEW_FIXTURE', 'new-value')).toBe(true);
  });
});

describe('secure authentication process lifecycle', () => {
  it('uses the supplied environment and cwd without invoking a shell, collecting both streams', async () => {
    vi.useFakeTimers();
    const child = mockChild();
    const env = { AUTH_UTILS_PROCESS_FIXTURE: 'child-only' };
    const result = spawnSecureAuth('fixture-auth', ['login', 'literal;argument'], env, {
      cwd: '/tmp/fixture-auth',
      timeout: 100,
    });

    expect(spawn).toHaveBeenCalledWith('fixture-auth', ['login', 'literal;argument'], {
      cwd: '/tmp/fixture-auth',
      env,
      stdio: 'pipe',
      shell: false,
    });
    child.stdout?.emit('data', Buffer.from('first '));
    child.stdout?.emit('data', 'second');
    child.stderr?.emit('data', Buffer.from('diagnostic'));
    child.emit('close', 7);

    await expect(result).resolves.toEqual({
      stdout: 'first second',
      stderr: 'diagnostic',
      exitCode: 7,
    });
    await vi.advanceTimersByTimeAsync(101);
    expect(child.kill).not.toHaveBeenCalled();
    expect(process.env.AUTH_UTILS_PROCESS_FIXTURE).toBeUndefined();
  });

  it('handles a process closed by a signal with no output streams', async () => {
    const child = mockChild(false);
    const result = spawnSecureAuth('fixture-auth', [], {});
    expect(vi.mocked(spawn).mock.calls[0][2]).toMatchObject({ cwd: process.cwd() });
    child.emit('close', null);
    await expect(result).resolves.toEqual({ stdout: '', stderr: '', exitCode: null });
  });

  it('rejects startup errors and clears the pending timeout', async () => {
    vi.useFakeTimers();
    const child = mockChild();
    const result = spawnSecureAuth('missing-fixture-auth', [], {}, { timeout: 50 });
    const assertion = expect(result).rejects.toThrow('ENOENT fixture executable');
    child.emit('error', new Error('ENOENT fixture executable'));
    child.emit('close', -1);
    await assertion;
    await vi.advanceTimersByTimeAsync(100);
    expect(child.kill).not.toHaveBeenCalled();
    expect(vi.getTimerCount()).toBe(0);
  });

  it('terminates a timed out child once and ignores late close/error events', async () => {
    vi.useFakeTimers();
    const child = mockChild();
    const result = spawnSecureAuth('fixture-auth', [], {}, { timeout: 50 });
    const assertion = expect(result).rejects.toThrow('Authentication process timed out');
    await vi.advanceTimersByTimeAsync(50);
    await assertion;
    expect(child.kill).toHaveBeenCalledExactlyOnceWith('SIGTERM');

    child.emit('close', 0);
    child.emit('error', new Error('late fixture error'));
    await vi.advanceTimersByTimeAsync(100);
    expect(child.kill).toHaveBeenCalledTimes(1);
    expect(vi.getTimerCount()).toBe(0);
  });

  it('keeps an already resolved exit result when a late process error arrives', async () => {
    vi.useFakeTimers();
    const child = mockChild();
    const result = spawnSecureAuth('fixture-auth', [], {}, { timeout: 50 });
    child.emit('close', 0);
    child.emit('error', new Error('late fixture error'));
    await expect(result).resolves.toEqual({ stdout: '', stderr: '', exitCode: 0 });
    await vi.advanceTimersByTimeAsync(100);
    expect(child.kill).not.toHaveBeenCalled();
  });
});

describe('authentication sessions', () => {
  it('keeps session credentials separate and removes only the destroyed session', () => {
    vi.stubEnv('ANTHROPIC_API_KEY', 'global-anthropic-fixture');
    const first = AuthSessionManager.createSession('first', 'api_key', anthropicKey);
    const second = AuthSessionManager.createSession('second', 'cli');

    expect(AuthSessionManager.getSession('first')?.ANTHROPIC_API_KEY).toBe(anthropicKey);
    expect(AuthSessionManager.getSession('second')?.ANTHROPIC_API_KEY).toBeUndefined();
    first.AUTH_UTILS_SESSION_FIXTURE = 'first-only';
    expect(second.AUTH_UTILS_SESSION_FIXTURE).toBeUndefined();
    AuthSessionManager.destroySession('first');
    expect(AuthSessionManager.getSession('first')).toBeUndefined();
    expect(AuthSessionManager.getSession('second')).toBe(second);
    expect(process.env.ANTHROPIC_API_KEY).toBe('global-anthropic-fixture');
    AuthSessionManager.cleanup();
    expect(AuthSessionManager.getSession('second')).toBeUndefined();
  });

  it('does not replace a session when new credentials fail validation', () => {
    const existing = AuthSessionManager.createSession('session', 'api_key', anthropicKey);
    expect(() => AuthSessionManager.createSession('session', 'api_key', 'invalid')).toThrow();
    expect(AuthSessionManager.getSession('session')).toBe(existing);
  });
});

describe('authentication attempt rate limits', () => {
  it('limits each identity separately and does not extend a window for rejected attempts', () => {
    vi.useFakeTimers();
    vi.setSystemTime(new Date('2026-10-15T10:00:00Z'));
    const limiter = new AuthRateLimiter(2, 1000);
    const startedAt = Date.now();

    expect(limiter.getRemainingAttempts('alice')).toBe(2);
    expect(limiter.getResetTime('alice')).toBeNull();
    expect(limiter.canAttempt('alice')).toBe(true);
    expect(limiter.getRemainingAttempts('alice')).toBe(1);
    vi.advanceTimersByTime(100);
    expect(limiter.canAttempt('alice')).toBe(true);
    expect(limiter.getRemainingAttempts('alice')).toBe(0);
    const reset = new Date(startedAt + 1100);
    expect(limiter.getResetTime('alice')).toEqual(reset);

    vi.advanceTimersByTime(900);
    expect(limiter.canAttempt('alice')).toBe(false);
    expect(limiter.getResetTime('alice')).toEqual(reset);
    expect(limiter.canAttempt('bob')).toBe(true);
    expect(limiter.getRemainingAttempts('bob')).toBe(1);
    vi.advanceTimersByTime(100);
    expect(limiter.canAttempt('alice')).toBe(false);
    vi.advanceTimersByTime(1);
    expect(limiter.canAttempt('alice')).toBe(true);
    expect(limiter.getRemainingAttempts('alice')).toBe(1);
    expect(limiter.getRemainingAttempts('bob')).toBe(1);
  });

  it('applies the default attempt budget', () => {
    const limiter = new AuthRateLimiter();
    expect(limiter.getRemainingAttempts('default')).toBe(5);
    for (let attempt = 0; attempt < 5; attempt++) {
      expect(limiter.canAttempt('default')).toBe(true);
    }
    expect(limiter.canAttempt('default')).toBe(false);
    expect(limiter.getRemainingAttempts('default')).toBe(0);
  });
});