import { test } from 'node:test';
import assert from 'node:assert/strict';
import http from 'node:http';
import { runSmoke } from '../test-hf-runtime.mjs';

const sha = '1234567890abcdef1234567890abcdef12345678';
async function fixture(handler, exercise) {
  const server = http.createServer(handler);
  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
  try {
    await exercise(`http://127.0.0.1:${server.address().port}`);
  } finally {
    server.closeAllConnections();
    await new Promise((resolve) => server.close(resolve));
  }
}
function runtime(req, res) {
  res.setHeader('content-type', 'application/json');
  if (req.url === '/api/health')
    return res.end(JSON.stringify({ status: 'ok', build: { gitSha: sha } }));
  if (req.headers['x-api-key'] !== 'fixture-key') {
    res.statusCode = 401;
    return res.end('{}');
  }
  const url = new URL(req.url, 'http://localhost');
  if (url.pathname === '/api/settings/diagnostics/opencode/inference' && req.method === 'POST') {
    assert.equal(req.headers['content-type'], 'application/json');
    return res.end(
      JSON.stringify({
        success: true,
        result: 'LOCAL_PROBE_OK',
        model: 'automaker-compatible/model',
      })
    );
  }
  assert.equal(url.searchParams.get('projectId'), 'registered');
  if (url.pathname === '/api/argus/modes')
    return res.end(
      JSON.stringify({ modes: ['default', 'rea', 'paper2code', 'eval'].map((id) => ({ id })) })
    );
  if (url.pathname === '/api/argus/mode')
    return res.end(JSON.stringify({ activeMode: 'rea', revision: 1, runs: [] }));
  if (url.pathname === '/api/argus/mode/gate')
    return res.end(JSON.stringify({ verdict: 'BLOCKED' }));
  res.statusCode = 404;
  res.end('{}');
}
test('uses authoritative identity and real authenticated project APIs, with bounded inference', async () => {
  await fixture(runtime, async (baseUrl) => {
    const report = await runSmoke({
      baseUrl,
      apiKey: 'fixture-key',
      projectId: 'registered',
      expectedSha: sha,
      inference: true,
    });
    assert.equal(report.conclusion, 'PASS');
    assert.equal(report.results.length, 6);
    assert.ok(report.results.every((item) => item.status === 'PASS'));
    const serialized = JSON.stringify(report);
    assert.ok(
      !serialized.includes('fixture-key') &&
        !serialized.includes('registered') &&
        !serialized.includes('automaker-compatible/model')
    );
  });
});
test('SPA fallback and route discovery cannot pass qualification', async () => {
  await fixture(
    (_req, res) => {
      res.setHeader('content-type', 'text/html');
      res.end('<html>SPA</html>');
    },
    async (baseUrl) => {
      const report = await runSmoke({ baseUrl, apiKey: 'fixture-key', projectId: 'registered' });
      assert.equal(report.conclusion, 'NO_GO');
      assert.ok(!report.results.some((item) => item.status === 'PASS'));
    }
  );
});
test('401 and 403 are blocked authenticated operations, never successful inference', async () => {
  for (const code of [401, 403])
    await fixture(
      (req, res) => {
        if (req.url === '/api/health') return runtime(req, res);
        res.setHeader('content-type', 'application/json');
        res.statusCode = code;
        res.end('{"secret":"must not leak"}');
      },
      async (baseUrl) => {
        const report = await runSmoke({
          baseUrl,
          apiKey: 'wrong',
          projectId: 'registered',
          inference: true,
        });
        assert.equal(report.conclusion, 'NO_GO');
        assert.ok(
          report.results
            .filter(
              (item) => item.name.startsWith('Authenticated') || item.name === 'Bounded inference'
            )
            .every((item) => item.status === 'BLOCKED')
        );
        assert.ok(!JSON.stringify(report).includes('must not leak'));
      }
    );
});
test('missing credentials, unknown/mismatched identity and inference failures do not pass', async () => {
  await fixture(runtime, async (baseUrl) => {
    assert.equal((await runSmoke({ baseUrl })).conclusion, 'NO_GO');
    assert.equal(
      (
        await runSmoke({
          baseUrl,
          apiKey: 'fixture-key',
          projectId: 'registered',
          expectedSha: '0'.repeat(40),
        })
      ).conclusion,
      'NO_GO'
    );
  });
  await fixture(
    (req, res) => {
      if (req.url.includes('inference')) {
        res.setHeader('content-type', 'application/json');
        return res.end('{"success":true,"result":"fabricated"}');
      }
      runtime(req, res);
    },
    async (baseUrl) =>
      assert.equal(
        (
          await runSmoke({
            baseUrl,
            apiKey: 'fixture-key',
            projectId: 'registered',
            inference: true,
          })
        ).conclusion,
        'NO_GO'
      )
  );
});
test('redirects and timed out responses fail closed', async () => {
  await fixture(
    (_req, res) => {
      res.statusCode = 302;
      res.setHeader('location', 'http://untrusted.invalid');
      res.end();
    },
    async (baseUrl) => {
      assert.equal((await runSmoke({ baseUrl })).conclusion, 'NO_GO');
    }
  );
  await fixture(
    () => {},
    async (baseUrl) => {
      assert.equal((await runSmoke({ baseUrl, timeoutMs: 100 })).conclusion, 'NO_GO');
    }
  );
});