import { createRequire } from 'node:module';
import { fileURLToPath } from 'node:url';
import { dirname, join } from 'node:path';
import { writeFileSync, mkdtempSync } from 'node:fs';
import { tmpdir } from 'node:os';
import assert from 'node:assert';
import { encode, decode } from '../code.js';
import { AgentClient } from '../agent-client.js';

const require = createRequire(import.meta.url);
const root = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
const RemoteServer = require(join(root, 'lib', 'remote-server.js'));
const support = require(join(root, 'lib', 'support-bundle.js'));
const stats = require(join(root, 'lib', 'stats.js'));
const { createCollectors } = require(join(root, 'lib', 'diagnostics-collectors.js'));
const { createAgent } = require(join(root, 'lib', 'diagnostics-agent.js'));

const SECRET_API = 'SUPERSECRET_apikey_9f8e7d6c5b4a';
const SECRET_PW = 'hunter2_password_zxcv';
const SECRET_TOKEN = 'bearer_tok_qwerty12345';
const WEBHOOK = 'https://discord.com/api/webhooks/123456789012345678/abcDEF_secretWebhookToken-xyz';

const tmp = mkdtempSync(join(tmpdir(), 'mhu-e2e-'));
const debugLog = join(tmp, 'debug.log');
const dood = join(tmp, 'doodstream-debug.log');
writeFileSync(debugLog, [
  `[2026-06-19T10:00:00Z] starting upload with apiKey=${SECRET_API}`,
  `[2026-06-19T10:00:01Z] Authorization: Bearer ${SECRET_TOKEN}`,
  `[2026-06-19T10:00:02Z] posting to ${WEBHOOK}`,
  `[2026-06-19T10:00:03Z] password ${SECRET_PW} used`,
  `[2026-06-19T10:00:04Z] normal benign line`,
].join('\n'));
writeFileSync(dood, `[doodstream] live apiKey=${SECRET_API}\n`);

const fakeConfig = {
  hosters: { doodstream: [{ accountId: 'acc1', apiKey: SECRET_API, password: SECRET_PW }] },
  hosterSettings: {},
  globalSettings: {
    webhookUrl: WEBHOOK,
    diagnostics: { enabled: true, port: 9110, token: 'x'.repeat(64) },
    pendingQueue: { savedAt: '2026-06-19T09:00:00Z', queueJobs: [{ file: 'a.mp4', fileName: 'a.mp4', hoster: 'doodstream', status: 'error', error: `failed with apiKey=${SECRET_API}` }, { file: 'b.mp4', fileName: 'b.mp4', hoster: 'streamtape', status: 'error', error: `upload rejected: token=${SECRET_TOKEN}` }], selectedUploadHosters: ['doodstream'], selectedFiles: ['a.mp4', 'b.mp4'] },
  },
  rotationCursors: { doodstream: 1 },
  history: [{ timestamp: '2026-06-19T08:00:00Z', files: [{ name: 'a.mp4', results: [{ hoster: 'doodstream', status: 'error', error: `boom token=${SECRET_TOKEN}` }] }] }],
};

function getAllLogPaths() {
  return { fileuploader: join(tmp, 'fileuploader.log'), debug: debugLog, accountRotation: join(tmp, 'rot.log'), doodstreamDebug: dood, crashLog: join(tmp, 'crash.log'), logDir: tmp };
}

const collectors = createCollectors({
  loadConfig: () => fakeConfig,
  getAllLogPaths,
  support,
  stats,
  appInfo: () => ({ version: '9.9.9' }),
  systemInfo: () => ({ platform: 'win32', hostname: 'TESTHOST' }),
  agentInfo: () => ({ version: '9.9.9', port: 9110 }),
});
const agent = createAgent(collectors);

const TOKEN = 'z'.repeat(64);
const srv = new RemoteServer();

const SECRETS = [SECRET_API, SECRET_PW, SECRET_TOKEN, 'abcDEF_secretWebhookToken-xyz'];

function assertNoLeak(label, payload) {
  const text = JSON.stringify(payload);
  for (const s of SECRETS) {
    assert.ok(!text.includes(s), `LEAK in ${label}: secret "${s.slice(0, 12)}…" appeared in response`);
  }
}

(async () => {
  await srv.start({
    port: 0,
    host: '127.0.0.1',
    token: TOKEN,
    diagnosticMode: true,
    onDiagnosticRequest: (msg, _client, reply) => {
      let r;
      try { r = agent.handle(msg.op, msg.args); }
      catch (e) { r = { ok: false, error: String(e && e.message || e) }; }
      reply(r);
    },
  });
  const port = srv.getPort();

  const code = encode({ v: 1, port, token: TOKEN, label: 'e2e' });
  const payload = decode(code);
  assert.equal(payload.token, TOKEN);

  const client = new AgentClient({ host: '127.0.0.1', port, token: payload.token });
  await client.connect();

  const health = await client.request('server_health', { errorLimit: 10 });
  assert.equal(health.ok, true, 'server_health must succeed: ' + JSON.stringify(health));
  assertNoLeak('server_health', health);
  assert.ok(health.data.errors, 'server_health has errors section');
  assert.ok(health.data.queue, 'server_health has queue section');

  const log = await client.request('read_log', { name: 'debug', tailKb: 64 });
  assert.equal(log.ok, true, 'read_log debug must succeed');
  assert.ok(log.data.content.includes('normal benign line'), 'benign content preserved');
  assertNoLeak('read_log:debug', log);

  const dl = await client.request('read_log', { name: 'doodstream', tailKb: 64 });
  assert.equal(dl.ok, false, 'doodstream log MUST NOT be readable (live api keys)');

  const trav = await client.request('read_log', { name: '../../../etc/passwd' });
  assert.equal(trav.ok, false, 'path traversal must be rejected');

  const cfg = await client.request('get_config_redacted', { section: 'all' });
  assert.equal(cfg.ok, true, 'get_config_redacted must succeed');
  assertNoLeak('get_config_redacted', cfg);

  const queue = await client.request('get_queue_state', { includeJobs: true });
  assert.equal(queue.ok, true, 'get_queue_state must succeed');
  assert.ok(Array.isArray(queue.data.jobs) && queue.data.jobs.length >= 2, 'jobs present');
  assertNoLeak('get_queue_state:includeJobs', queue);

  const queueDefault = await client.request('get_queue_state', {});
  assert.equal(queueDefault.ok, true, 'get_queue_state (default args) must succeed');
  assertNoLeak('get_queue_state:default', queueDefault);

  const writeAttempt = await client.request('save_config', { x: 1 });
  assert.equal(writeAttempt.ok, false, 'unknown/write op must be rejected by whitelist');

  client.close();
  srv.stop();
  console.log('E2E PASS: connect → server_health/read_log/get_config_redacted succeeded; NO secrets leaked; doodstream + traversal + write rejected.');
  process.exit(0);
})().catch((e) => { console.error('E2E FAIL:', e && e.stack || e); try { srv.stop(); } catch {} process.exit(1); });