var test = require('node:test');
var assert = require('node:assert/strict');
var fs = require('node:fs');
var path = require('node:path');
var EventEmitter = require('node:events');
var fixture = require('./helpers/account-auth-fixture');
var passwords = require('../lib/account-passwords');
var guardSocket = require('../lib/account-auth-socket').guardSocket;
var DAY = 86400000;
var phrase = 'a synthetic long security password';
test('server PIN login is disabled for accounts and retained for legacy single-user access', function (t) {
  var h = fixture.isolated(t);
  fixture.seed(h, h.users.hashPin('012345'));
  var server = h.server();
  var hash = require('../lib/server-auth').generateAuthToken('654321');
  server.setAuthToken(hash);
  var rejected = fixture.request(server, 'POST', '/auth', { pin: '654321' });
  assert.equal(rejected.code, 403);
  assert.equal(rejected.headers['Set-Cookie'], undefined);
  assert.equal(server.isRequestAuthed({ headers: { cookie: 'relay_auth=' + hash }, socket: {} }), false);
  var state = h.users.loadUsers(); state.multiUser = false; h.users.saveUsers(state);
  var accepted = fixture.request(server, 'POST', '/auth', { pin: '654321' });
  assert.equal(accepted.code, 200);
  assert.match(accepted.headers['Set-Cookie'], /^relay_auth=/);
});
function req(cookie, extra) {
  var result = new EventEmitter(); result.method = 'GET';
  result.headers = Object.assign({ host: 'clay.example.test', origin: 'https://clay.example.test', 'content-type': 'application/json', cookie: cookie || '', 'user-agent': 'Mozilla/5.0 Chrome/130.0 Linux' }, extra && extra.headers);
  result.socket = Object.assign({ remoteAddress: '192.0.2.1', encrypted: true }, extra && extra.socket); return result;
}
function request(server, method, url, data, cookie, extra) {
  return new Promise(function (resolve) {
    var incoming = req(cookie, extra); incoming.method = method; incoming.url = url;
    var result = {};
    var res = { writeHead: function (code, headers) { result.code = code; result.headers = headers || {}; }, end: function (body) { result.body = JSON.parse(body); resolve(result); } };
    assert.equal(server.handleRequest(incoming, res, url), true);
    incoming.emit('data', JSON.stringify(data || {})); incoming.emit('end');
  });
}
function cookie(response) { var value = response.headers['Set-Cookie']; return (Array.isArray(value) ? value : [value]).map(function (entry) { return entry.split(';')[0]; }).join('; '); }
async function setup(t) {
  var h = fixture.isolated(t); var hash = await passwords.hash(phrase);
  fixture.seed(h, null, { passwordHash: hash }); var state = h.users.loadUsers(); state.accountAuthMethod = 'password'; h.users.saveUsers(state);
  var server = h.server(); var session = server.createMultiUserSession('owner', hash, null, true, req());
  return { h: h, server: server, cookie: session.cookie, hash: hash, token: session.token };
}

test('server enforces idle and absolute expiry, including after restart and despite copied cookies', async function (t) {
  var f = await setup(t); var now = Date.now();
  t.mock.timers.enable({ apis: ['Date'], now: now });
  t.mock.timers.tick(7 * DAY + 1);
  assert.equal(f.server.isRequestAuthed(req(f.cookie)), false);
  assert.equal(f.h.server().isRequestAuthed(req(f.cookie)), false);
  var session = f.server.createMultiUserSession('owner', f.hash, null, true, req()).cookie;
  for (var day = 0; day < 29; day++) { t.mock.timers.tick(DAY); assert.equal(f.server.isRequestAuthed(req(session)), true); }
  t.mock.timers.tick(DAY + 1); assert.equal(f.server.isRequestAuthed(req(session)), false);
  assert.equal(f.h.server().isRequestAuthed(req(session)), false);
});

test('old account sessions gain one persisted grace period; disk stores token digests, not bearer tokens', async function (t) {
  var f = await setup(t); var old = 'owner:earlier-session-token'; var raw = {};
  raw[old] = { userId: 'owner', credential: f.hash };
  fs.writeFileSync(path.join(f.h.root, 'auth-tokens.json'), JSON.stringify(raw));
  var server = f.h.server(); var oldCookie = 'relay_auth_user=' + old;
  assert.equal(server.isRequestAuthed(req(oldCookie)), true);
  var data = fs.readFileSync(path.join(f.h.root, 'auth-tokens.json'), 'utf8');
  assert.equal(data.includes(old), false); assert.equal(data.includes(f.hash), false);
  var record = Object.values(JSON.parse(data).sessions)[0]; assert.equal(record.migrated, true);
  t.mock.timers.enable({ apis: ['Date'], now: Date.now() }); t.mock.timers.tick(7 * DAY + 1);
  assert.equal(f.h.server().isRequestAuthed(req(oldCookie)), false);
  assert.equal(Object.values(JSON.parse(fs.readFileSync(path.join(f.h.root, 'auth-tokens.json'), 'utf8')).sessions)[0].expiresAt, record.expiresAt);
});

test('device list is owner-scoped and individual/other-session revocations survive restart', async function (t) {
  var f = await setup(t); var other = f.server.createMultiUserSession('owner', f.hash, null, true, req()).cookie;
  var state = f.h.users.loadUsers(); state.users.push({ id: 'second', username: 'Second', role: 'user', passwordHash: f.hash }); f.h.users.saveUsers(state);
  var foreign = f.server.createMultiUserSession('second', f.hash, null, true, req()).cookie;
  var listed = await request(f.server, 'GET', '/api/account-sessions', null, f.cookie);
  assert.equal(listed.body.sessions.length, 2); assert.equal(listed.body.sessions.filter(function (entry) { return entry.current; }).length, 1);
  assert.equal(JSON.stringify(listed.body).includes(f.token), false); assert.equal(JSON.stringify(listed.body).includes(f.hash), false);
  var target = listed.body.sessions.find(function (entry) { return !entry.current; });
  assert.equal((await request(f.server, 'POST', '/api/account-sessions', { id: target.id }, foreign)).code, 400);
  assert.equal((await request(f.server, 'POST', '/api/account-sessions', { id: target.id }, f.cookie)).code, 200);
  assert.equal(f.server.isRequestAuthed(req(other)), false); assert.equal(f.h.server().isRequestAuthed(req(other)), false);
  other = f.server.createMultiUserSession('owner', f.hash, null, true, req()).cookie;
  assert.equal((await request(f.server, 'POST', '/api/account-sessions', { id: 'others' }, f.cookie)).code, 200);
  assert.equal(f.server.isRequestAuthed(req(other)), false); assert.equal(f.server.isRequestAuthed(req(f.cookie)), true);
  assert.equal(f.server.isRequestAuthed(req(foreign)), true);
});

test('migration timestamps are not presented as activity and observed devices are enriched durably', async function (t) {
  var f = await setup(t); var raw = {};
  ['active', 'unseen'].forEach(function (token) { raw[token] = { userId: 'owner', credential: f.hash }; });
  fs.writeFileSync(path.join(f.h.root, 'auth-tokens.json'), JSON.stringify(raw));
  var server = f.h.server(); var active = 'relay_auth_user=active';
  var list = (await request(server, 'GET', '/api/account-sessions', null, active)).body.sessions;
  assert.equal(list[0].current, true);
  assert.match(list[0].userAgent, /Chrome/); assert.equal(list[0].address, '192.0.2.1');
  assert.ok(list[0].lastSeenAt); assert.equal(list[0].createdAt, null);
  assert.equal(list[1].lastSeenAt, null); assert.equal(list[1].unknownDevice, true);
  var expiry = list[0].expiresAt;
  var restarted = f.h.server();
  var again = (await request(restarted, 'GET', '/api/account-sessions', null, active)).body.sessions;
  assert.equal(again[0].expiresAt, expiry); assert.match(again[0].userAgent, /Chrome/);
  assert.equal(again[1].lastSeenAt, null);
});

test('issuing a replacement session retires only its presented same-account cookie atomically', async function (t) {
  var f = await setup(t);
  var other = f.server.createMultiUserSession('owner', f.hash, null, true, req()).cookie;
  f.h.state.failTokens = true;
  assert.throws(function () { f.server.createMultiUserSession('owner', f.hash, null, true, req(f.cookie)); });
  assert.equal(f.server.isRequestAuthed(req(f.cookie)), true);
  f.h.state.failTokens = false;
  var next = f.server.createMultiUserSession('owner', f.hash, null, true, req(f.cookie)).cookie;
  assert.equal(f.server.isRequestAuthed(req(f.cookie)), false);
  assert.equal(f.server.isRequestAuthed(req(next)), true);
  assert.equal(f.server.isRequestAuthed(req(other)), true);
  assert.equal((await request(f.server, 'GET', '/api/account-sessions', null, next)).body.sessions.length, 2);
});

test('failed sign-out persistence is reported and cannot claim durable revocation', async function (t) {
  var f = await setup(t); var listed = await request(f.server, 'GET', '/api/account-sessions', null, f.cookie);
  f.h.state.failTokens = true;
  assert.equal((await request(f.server, 'POST', '/api/account-sessions', { id: listed.body.sessions[0].id }, f.cookie)).code, 400);
  assert.equal(f.server.isRequestAuthed(req(f.cookie)), true);
  assert.equal((await request(f.server, 'POST', '/auth/logout', {}, f.cookie)).code, 503);
  f.h.state.failTokens = false;
  assert.equal((await request(f.server, 'POST', '/auth/logout', {}, f.cookie)).code, 200);
  assert.equal(f.h.server().isRequestAuthed(req(f.cookie)), false);
});

test('passive WebSocket traffic does not renew idle expiry; expiry and revocation close live sockets', async function (t) {
  var f = await setup(t); var ws = new EventEmitter(); var messages = [];
  ws.readyState = 1; ws.send = function (value) { messages.push(value); }; ws.close = function () { ws.readyState = 3; ws.emit('close'); };
  guardSocket(ws, req(f.cookie), f.server.isRequestAuthed, f.server.touchSession);
  t.mock.timers.enable({ apis: ['Date'], now: Date.now() });
  for (var day = 0; day < 6; day++) { t.mock.timers.tick(DAY); ws.send('background output'); ws.emit('message', JSON.stringify({ type: 'ping' })); }
  t.mock.timers.tick(DAY + 1); ws.send('private output');
  assert.equal(ws.readyState, 3); assert.equal(messages[messages.length - 1], JSON.stringify({ type: 'account_auth_required' }));
});

test('account attempts survive restart and IP rotation; failure to save or corrupt storage fails closed', async function (t) {
  var f = await setup(t);
  for (var i = 0; i < 10; i++) {
    await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: 'wrong' }, '', { socket: { remoteAddress: '192.0.2.' + (i + 1) } });
  }
  var restarted = f.h.server();
  var blocked = await request(restarted, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', { socket: { remoteAddress: '192.0.2.99' } });
  assert.equal(blocked.code, 429);
  t.mock.timers.enable({ apis: ['Date'], now: Date.now() }); t.mock.timers.tick(15 * 60000 + 1);
  assert.equal((await request(restarted, 'POST', '/auth/login', { username: 'Owner', password: phrase })).code, 200);
  f.h.state.failAttempts = true;
  assert.equal((await request(restarted, 'POST', '/auth/login', { username: 'Owner', password: phrase })).code, 400);
  f.h.state.failAttempts = false;
  fs.writeFileSync(path.join(f.h.root, 'auth-attempts.json'), 'broken');
  assert.equal((await request(restarted, 'POST', '/auth/login', { username: 'Owner', password: phrase })).code, 400);
});

test('exact Origin and HTTPS are required; trusted proxy transport and address headers are explicit', async function (t) {
  var f = await setup(t);
  assert.equal((await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', { headers: { origin: 'https://evil.example.test' } })).code, 403);
  assert.equal((await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', { headers: { origin: undefined, referer: undefined } })).code, 403);
  assert.equal((await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', { headers: { 'sec-fetch-site': 'same-site' } })).code, 403);
  var spoofed = { socket: { encrypted: false }, headers: { 'x-forwarded-proto': 'https', 'x-real-ip': '127.0.0.1' } };
  assert.equal((await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', spoofed)).code, 403);
  assert.equal(f.server.isRequestAuthed(req(f.cookie, spoofed)), false);
  var saved = await request(f.server, 'PUT', '/api/account-transport', { origin: 'https://clay.example.test', trustedProxies: ['192.0.2.1'], currentPassword: phrase }, f.cookie);
  assert.equal(saved.code, 200);
  var proxied = { socket: { encrypted: false }, headers: { host: 'backend:3000', 'x-forwarded-proto': 'https', 'x-real-ip': '198.51.100.7' } };
  var login = await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', proxied);
  assert.equal(login.code, 200); assert.match(login.headers['Set-Cookie'][0], /; Secure/);
  assert.equal(f.server.isRequestAuthed(req(cookie(login), proxied)), true);
  var sessions = await request(f.server, 'GET', '/api/account-sessions', null, cookie(login), proxied);
  assert.equal(sessions.body.sessions.find(function (entry) { return entry.current; }).address, '198.51.100.7');
  assert.equal((await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', { socket: { encrypted: false }, headers: { 'x-forwarded-proto': 'http' } })).code, 403);
  assert.equal((await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', { socket: { encrypted: false, remoteAddress: '192.0.2.2' }, headers: proxied.headers })).code, 403);
});

test('local administrative access remains available even when loopback is a configured proxy', async function (t) {
  var f = await setup(t); var transport = f.h.load('account-auth-transport').attachTransport({ users: f.h.users });
  transport.save({ origin: 'https://clay.example.test', trustedProxies: ['127.0.0.1'] });
  var local = { socket: { encrypted: false, remoteAddress: '127.0.0.1' }, headers: { host: 'localhost:3000', origin: 'http://localhost:3000' } };
  assert.equal((await request(f.server, 'POST', '/auth/login', { username: 'Owner', password: phrase }, '', local)).code, 200);
  assert.equal((await request(f.server, 'PUT', '/api/account-transport', { origin: 'http://unsafe.test', trustedProxies: [], currentPassword: phrase }, f.cookie)).code, 400);
});

test('terminal recovery expires, works once and revokes prior sessions and passkeys', async function (t) {
  var f = await setup(t); var state = f.h.users.loadUsers(); state.users[0].passkeys = [{ id: 'old-device' }]; f.h.users.saveUsers(state);
  f.server.setRecovery('test-recovery', 'one-time-terminal-secret');
  var result = await request(f.server, 'POST', '/recover/test-recovery', { step: 'reset', password: 'one-time-terminal-secret', pin: '654321' });
  assert.equal(result.code, 200); assert.equal(f.server.isRequestAuthed(req(f.cookie)), false);
  assert.equal(f.h.users.findUserById('owner').passkeys, undefined);
  assert.equal(f.server.handleRequest(Object.assign(req(), { method: 'GET' }), {}, '/recover/test-recovery'), false);
  f.server.setRecovery('expired-recovery', 'another-terminal-secret');
  t.mock.timers.enable({ apis: ['Date'], now: Date.now() }); t.mock.timers.tick(15 * 60000 + 1);
  assert.equal((await request(f.server, 'POST', '/recover/expired-recovery', { step: 'reset', password: 'another-terminal-secret', pin: '123456' })).code, 410);
});