import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import {
  classifyToken,
  isValidEmail,
  looksLikeToken,
  parseAccountText,
  unwrapPastedSecret,
} from '../src/dashboard/account-text-parser.js';

// WHY THIS FILE EXISTS. account-text-parser.js was one of four src/ files never named in
// test/, and the only one where that was a real gap: 440 lines of pure string parsing, no
// network and no side effects, reached directly from the dashboard's account-import path
// (src/dashboard/api.js). It is also the code that decides what counts as a credential —
// `devin-session-token$…`, `auth1_…`, and bare Firebase refresh JWTs each take a different
// path downstream, and it holds two silent `catch {}` blocks, so a misparse shows up as
// "the import did nothing" rather than as an error.
//
// Assertions are on behaviour with realistic-shaped fixtures. Every credential-looking value
// here is a `ws-fixture-*` literal or an obviously fake padded string: nothing that resembles
// a live token, and deliberately not the `sk-*` shape, which secret-scan flags.

const LONG = (prefix, n = 140) => prefix + 'x'.repeat(Math.max(0, n - prefix.length));

describe('classifyToken', () => {
  it('recognises the session-token prefix this repo actually issues', () => {
    // The `$` in `devin-session-token$<JWT>` is the character that once slipped past
    // secret-scan's own character class, so it is worth pinning that it classifies here.
    assert.equal(classifyToken('devin-session-token$ws-fixture-abc.def.ghi'), 'session');
    assert.equal(classifyToken('  devin-session-token$ws-fixture-abc  '), 'session', 'trims');
  });

  it('requires auth1_ tokens to reach the length floor', () => {
    assert.equal(classifyToken(`auth1_${'y'.repeat(30)}`), 'auth1');
    // 19 chars total: prefix present but under the >= 20 floor, so NOT auth1. It is also
    // under the refresh floor, so it lands on unknown rather than silently becoming refresh.
    assert.equal(classifyToken('auth1_yyyyyyyyyyyyy'), 'unknown');
  });

  it('treats a long opaque blob as a refresh token', () => {
    assert.equal(classifyToken(LONG('ws-fixture-refresh-')), 'refresh');
  });

  it('holds the refresh length floor at >100, so short opaque strings stay unknown', () => {
    // Without this the floor is unpinned: every other fixture here is far past 100 chars, so
    // relaxing `length > 100` to `> 5` survived a mutation run. A low floor would promote
    // ordinary short identifiers to credentials.
    assert.equal(classifyToken('x'.repeat(101)), 'refresh', '101 chars is over the floor');
    assert.equal(classifyToken('x'.repeat(100)), 'unknown', 'exactly 100 must not qualify');
    assert.equal(classifyToken('ws-fixture-short'), 'unknown');
  });

  it('classifies a long three-part JWT as refresh', () => {
    const jwt = `${'a'.repeat(40)}.${'b'.repeat(40)}.${'c'.repeat(40)}`;
    assert.equal(classifyToken(jwt), 'refresh');
  });

  it('rejects the shapes that must NOT be mistaken for credentials', () => {
    assert.equal(classifyToken(''), 'unknown');
    assert.equal(classifyToken('   '), 'unknown');
    assert.equal(classifyToken(undefined), 'unknown');
    // An email is long enough to trip a naive length check; the @ exclusion is what stops it.
    assert.equal(classifyToken(`${'ws-fixture-'.repeat(12)}@example.test`), 'unknown');
    // Contains a space, so it is prose, not a token.
    assert.equal(classifyToken(LONG('this is a sentence ')), 'unknown');
    // `devin-` prefixed but not the session form: explicitly excluded from refresh.
    assert.equal(classifyToken(LONG('devin-something-else-')), 'unknown');
  });
});

describe('unwrapPastedSecret', () => {
  it('passes a bare session token through', () => {
    assert.equal(unwrapPastedSecret('  devin-session-token$ws-fixture-abc  '), 'devin-session-token$ws-fixture-abc');
  });

  it('pulls token= out of a show-auth-token URL', () => {
    const url = 'https://windsurf.com/show-auth-token?token=devin-session-token$ws-fixture-from-url';
    assert.equal(unwrapPastedSecret(url), 'devin-session-token$ws-fixture-from-url');
  });

  it('pulls access_token out of a hash fragment', () => {
    const url = 'https://windsurf.com/windsurf/signin#access_token=devin-session-token$ws-fixture-hash';
    assert.equal(unwrapPastedSecret(url), 'devin-session-token$ws-fixture-hash');
  });

  it('throws ERR_NO_TOKEN_IN_INPUT when the URL has no token param', () => {
    assert.throws(
      () => unwrapPastedSecret('https://windsurf.com/show-auth-token?state=abc'),
      /ERR_NO_TOKEN_IN_INPUT/,
    );
  });
});

describe('isValidEmail', () => {
  it('accepts ordinary addresses', () => {
    for (const e of [
      'ws-fixture@example.test',
      'ws.fixture+tag@sub.example.test',
      'ws-fixture_1@example.co.uk',
    ]) {
      assert.equal(isValidEmail(e), true, e);
    }
  });

  it('rejects non-strings and out-of-range lengths', () => {
    assert.equal(isValidEmail(null), false);
    assert.equal(isValidEmail(undefined), false);
    assert.equal(isValidEmail(12345), false);
    assert.equal(isValidEmail('a@b'), false, 'under the 5-char floor');
    assert.equal(isValidEmail(`${'a'.repeat(250)}@example.test`), false, 'over 254');
  });

  it('rejects separators, which is what keeps pasted lists from parsing as one address', () => {
    // The dashboard accepts pasted blobs, so a value carrying a delimiter means the caller
    // split on the wrong thing — accepting it would attach one account to another's token.
    for (const bad of [
      'a@example.test b@example.test',
      'a@example.test,b@example.test',
      'a@example.test;b@example.test',
      'a@example.test，b@example.test',
      'a@example.test；b@example.test',
      'a@example.test\tb@example.test',
    ]) {
      assert.equal(isValidEmail(bad), false, bad);
    }
  });

  it('rejects malformed addresses', () => {
    for (const bad of ['noatsign.example.test', '@example.test', 'a@', 'a@example', 'a@.test']) {
      assert.equal(isValidEmail(bad), false, bad);
    }
  });
});

describe('looksLikeToken', () => {
  it('is a coarse gate, so only assert what the parser relies on', () => {
    assert.equal(looksLikeToken('devin-session-token$ws-fixture-abc'), true);
    assert.equal(looksLikeToken(''), false);
    assert.equal(looksLikeToken(null), false);
  });
});

describe('parseAccountText', () => {
  it('pairs an email with the token that follows it', () => {
    const out = parseAccountText(
      `ws-fixture-1@example.test\ndevin-session-token$${'a'.repeat(30)}\n`,
    );
    assert.equal(out.tokenPairs.length, 1);
    assert.equal(out.tokenPairs[0].email, 'ws-fixture-1@example.test');
    assert.match(out.tokenPairs[0].token, /^devin-session-token\$/);
  });

  it('pairs an email with a LABELLED password', () => {
    // A bare line after an email is NOT treated as a password — passwords are only
    // recognised behind a label (RE_LABEL_PASS) or across a ---- delimiter. That is the
    // safe direction: guessing would turn any stray line into a credential.
    const out = parseAccountText(
      'email: ws-fixture-2@example.test\npassword: ws-fixture-pass-9\n',
    );
    assert.equal(out.accounts.length, 1);
    assert.equal(out.accounts[0].email, 'ws-fixture-2@example.test');
    assert.equal(out.accounts[0].password, 'ws-fixture-pass-9');
  });

  it('accepts the Chinese labels too, since the dashboard is bilingual', () => {
    const out = parseAccountText('邮箱：ws-fixture-3@example.test\n密码：ws-fixture-pass-7\n');
    assert.equal(out.accounts.length, 1);
    assert.equal(out.accounts[0].email, 'ws-fixture-3@example.test');
    assert.equal(out.accounts[0].password, 'ws-fixture-pass-7');
  });

  it('parses the ----separated form', () => {
    const out = parseAccountText(`ws-fixture-4@example.test----ws-fixture-pass-4\n`);
    assert.equal(out.accounts.length, 1, JSON.stringify(out));
    assert.equal(out.accounts[0].email, 'ws-fixture-4@example.test');
    assert.equal(out.accounts[0].password, 'ws-fixture-pass-4');
  });

  it('does not treat a bare line after an email as a password', () => {
    const out = parseAccountText('ws-fixture-5@example.test\njust some note\n');
    assert.equal(out.accounts.length, 0, 'an unlabelled line must not become a credential');
  });

  it('unwraps a show-auth-token URL line into the tokens bucket', () => {
    const inner = `devin-session-token$${'u'.repeat(30)}`;
    const out = parseAccountText(`https://windsurf.com/show-auth-token?token=${encodeURIComponent(inner)}\n`);
    assert.equal(out.tokens.length, 1);
    assert.equal(out.tokens[0], inner);
  });

  it('unwraps a labeled Token: show-auth-token URL', () => {
    const inner = `devin-session-token$${'L'.repeat(30)}`;
    const out = parseAccountText(`Token: https://windsurf.com/show-auth-token?token=${encodeURIComponent(inner)}\n`);
    assert.equal(out.tokens.length, 1, JSON.stringify(out));
    assert.equal(out.tokens[0], inner);
  });

  it('keeps a token-less show-auth-token URL in the tokens bucket so import can fail visibly', () => {
    const out = parseAccountText('https://windsurf.com/show-auth-token?state=abc\n');
    assert.equal(out.tokens.length, 1, JSON.stringify(out));
    assert.match(out.tokens[0], /^https:\/\/windsurf\.com\/show-auth-token/);
  });

  it('keeps an unpaired token as a bare token rather than dropping it', () => {
    // Silently discarding a credential is the failure mode that reads as "import did
    // nothing", so pin that a token with no preceding email still comes out.
    const out = parseAccountText(`devin-session-token$${'b'.repeat(30)}\n`);
    assert.equal(out.tokenPairs.length, 0);
    assert.equal(out.tokens.length, 1);
    assert.match(out.tokens[0], /^devin-session-token\$/);
  });

  it('does not merge two accounts when a token is missing between them', () => {
    const out = parseAccountText(
      [
        'ws-fixture-a@example.test',
        `devin-session-token$${'c'.repeat(30)}`,
        'ws-fixture-b@example.test',
        `devin-session-token$${'d'.repeat(30)}`,
      ].join('\n'),
    );
    assert.equal(out.tokenPairs.length, 2);
    assert.deepEqual(
      out.tokenPairs.map((p) => p.email),
      ['ws-fixture-a@example.test', 'ws-fixture-b@example.test'],
    );
    assert.notEqual(out.tokenPairs[0].token, out.tokenPairs[1].token, 'no cross-wiring');
  });

  it('returns the four buckets even for input it cannot use', () => {
    for (const input of ['', '   \n\n  ', 'just some prose with no credentials at all']) {
      const out = parseAccountText(input);
      assert.deepEqual(Object.keys(out).sort(), [
        'accounts',
        'githubAccounts',
        'tokenPairs',
        'tokens',
      ]);
      for (const k of Object.keys(out)) assert.ok(Array.isArray(out[k]), `${k} is an array`);
    }
  });

  it('tolerates non-string input instead of throwing into the dashboard', () => {
    for (const bad of [null, undefined, 42, {}]) {
      assert.doesNotThrow(() => parseAccountText(bad), String(bad));
    }
  });
});