import fs from "node:fs";
import http from "node:http";
import os from "node:os";
import path from "node:path";
import { once } from "node:events";
import { afterEach, describe, expect, it } from "vitest";

import {
  startDebugServer,
  stopDebugServer,
  restartDebugServer,
  writeDebugServerConfig,
  getDebugServerRuntimeStatus
} from "../src/main/debug-server";
import type { DownloadManager } from "../src/main/download-manager";

const tempDirs: string[] = [];
const TOKEN = "allowlist-secret";

async function getFreePort(): Promise<number> {
  const probe = http.createServer();
  probe.listen(0, "127.0.0.1");
  await once(probe, "listening");
  const address = probe.address();
  if (!address || typeof address === "string") {
    throw new Error("port probe failed");
  }
  probe.close();
  await once(probe, "close");
  return address.port;
}

async function waitForReady(url: string): Promise<void> {
  const deadline = Date.now() + 5000;
  while (Date.now() < deadline) {
    try {
      const res = await fetch(url);
      if (res.ok) {
        return;
      }
    } catch {
    }
    await new Promise((resolve) => setTimeout(resolve, 40));
  }
  throw new Error(`debug server not ready: ${url}`);
}

async function startWithAllowlist(allowlist: string[]): Promise<{ baseUrl: string }> {
  const baseDir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-allow-"));
  tempDirs.push(baseDir);
  const port = await getFreePort();
  fs.writeFileSync(path.join(baseDir, "debug_token.txt"), TOKEN, "utf8");
  fs.writeFileSync(path.join(baseDir, "debug_port.txt"), String(port), "utf8");
  fs.writeFileSync(path.join(baseDir, "debug_host.txt"), "0.0.0.0", "utf8");
  fs.writeFileSync(path.join(baseDir, "debug_allowlist.txt"), allowlist.join("\n"), "utf8");
  const manager = {} as unknown as DownloadManager;
  startDebugServer(manager, baseDir);
  const baseUrl = `http://127.0.0.1:${port}`;
  await waitForReady(`${baseUrl}/health?token=${TOKEN}`);
  return { baseUrl };
}

function getAs(baseUrl: string, clientIp: string | null): Promise<Response> {
  const headers: Record<string, string> = {};
  if (clientIp) {
    headers["X-Forwarded-For"] = clientIp;
  }
  return fetch(`${baseUrl}/health?token=${TOKEN}`, { headers });
}

afterEach(() => {
  stopDebugServer();
  while (tempDirs.length > 0) {
    const dir = tempDirs.pop();
    if (!dir) {
      continue;
    }
    try {
      fs.rmSync(dir, { recursive: true, force: true });
    } catch {
    }
  }
});

describe("debug-server allowlist enforcement", () => {
  it("always allows loopback regardless of allowlist", async () => {
    const { baseUrl } = await startWithAllowlist(["8.8.8.8"]);
    const res = await getAs(baseUrl, null);
    expect(res.status).toBe(200);
  });

  it("allows an exact allowlisted client IP", async () => {
    const { baseUrl } = await startWithAllowlist(["8.8.8.8"]);
    const res = await getAs(baseUrl, "8.8.8.8");
    expect(res.status).toBe(200);
  });

  it("allows a client inside an allowlisted CIDR and blocks outside it", async () => {
    const { baseUrl } = await startWithAllowlist(["10.0.0.0/24"]);
    const inside = await getAs(baseUrl, "10.0.0.42");
    expect(inside.status).toBe(200);
    const outside = await getAs(baseUrl, "10.0.1.42");
    expect(outside.status).toBe(403);
  });

  it("blocks a non-allowlisted remote client with 403 before auth", async () => {
    const { baseUrl } = await startWithAllowlist(["8.8.8.8"]);
    const res = await fetch(`${baseUrl}/health`, { headers: { "X-Forwarded-For": "9.9.9.9" } });
    expect(res.status).toBe(403);
    const body = await res.json() as Record<string, unknown>;
    expect(body.reason).toContain("Allowlist");
  });

  it("fail-closed: empty allowlist on 0.0.0.0 blocks every non-loopback client", async () => {
    const { baseUrl } = await startWithAllowlist([]);
    expect(getDebugServerRuntimeStatus().allowlistCount).toBe(0);
    const loopback = await getAs(baseUrl, null);
    expect(loopback.status).toBe(200);
    const remote = await getAs(baseUrl, "203.0.113.7");
    expect(remote.status).toBe(403);
  });

  it("still enforces auth for allowlisted clients", async () => {
    const { baseUrl } = await startWithAllowlist(["8.8.8.8"]);
    const res = await fetch(`${baseUrl}/health`, { headers: { "X-Forwarded-For": "8.8.8.8" } });
    expect(res.status).toBe(401);
  });

  it("applies a new allowlist live via restartDebugServer", async () => {
    const { baseUrl } = await startWithAllowlist(["8.8.8.8"]);
    expect((await getAs(baseUrl, "9.9.9.9")).status).toBe(403);
    writeDebugServerConfig({ allowlist: ["9.9.9.9"] });
    const status = await restartDebugServer();
    expect(status.running).toBe(true);
    await waitForReady(`${baseUrl}/health?token=${TOKEN}`);
    expect((await getAs(baseUrl, "9.9.9.9")).status).toBe(200);
    expect((await getAs(baseUrl, "8.8.8.8")).status).toBe(403);
  });
});