import assert from "node:assert/strict";
import test from "node:test";
import type { SelfHostedIdentityConfig } from "../src/modules/identity/config.ts";
import { createHostIsolatedAuthHandlers, resolveIdentitySurface } from "../src/modules/identity/host.ts";

const config: SelfHostedIdentityConfig = {
  provider: "self-hosted",
  databaseUrl: "postgresql://identity_runtime:test@postgres:5432/jyotisha",
  userOrigin: "https://staging.jyotisha.chat",
  adminOrigin: "https://admin.staging.jyotisha.chat",
  userSecret: "user-secret-that-is-at-least-32-bytes-long",
  resendApiKey: "re_test",
  resendFrom: "Jyotisha <login@staging.jyotisha.chat>",
  testOtp: null,
};

test("identity host accepts only the two configured origins", () => {
  assert.equal(resolveIdentitySurface("staging.jyotisha.chat", config), "user");
  assert.equal(resolveIdentitySurface("STAGING.JYOTISHA.CHAT:443", config), "user");
  assert.equal(resolveIdentitySurface("admin.staging.jyotisha.chat", config), "admin");
  assert.equal(resolveIdentitySurface("ADMIN.STAGING.JYOTISHA.CHAT:443", config), "admin");
  for (const host of [
    null,
    "",
    "evil.staging.jyotisha.chat",
    "staging.jyotisha.chat.evil.example",
    "staging.jyotisha.chat,evil.example",
    "admin.staging.jyotisha.chat:444",
    "admin.staging.jyotisha.chat.",
  ]) {
    assert.equal(resolveIdentitySurface(host, config), null);
  }
});

test("auth route dispatches only to the user service", async () => {
  let calls = 0;
  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: async () => { calls += 1; return new Response("user"); }, POST: async () => { calls += 1; return new Response("user"); } } });
  const response = await handlers.GET(new Request("https://internal/api/auth/get-session", { headers: { host: "staging.jyotisha.chat" } }));
  assert.equal(await response.text(), "user");
  assert.equal(calls, 1);
});

test("unknown hosts remain fail-closed with 421", async () => {
  let calls = 0;
  const handler = async () => { calls += 1; return new Response("unexpected"); };
  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: handler, POST: handler } });
  const response = await handlers.GET(new Request("https://internal/api/auth/get-session", { headers: { host: "unknown.example" } }));
  assert.equal(response.status, 421);
  assert.equal(calls, 0);
});

test("main auth surface keeps Better Auth admin endpoints closed", async () => {
  let calls = 0;
  const handler = async () => { calls += 1; return new Response("unexpected"); };
  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: handler, POST: handler } });
  const response = await handlers.POST(new Request("https://internal/api/auth/admin/set-role", {
    method: "POST",
    headers: {
      host: "staging.jyotisha.chat",
      "x-forwarded-host": "admin.staging.jyotisha.chat",
    },
  }));
  assert.equal(response.status, 404);
  assert.equal(calls, 0);
});

test("admin auth surface reaches the same Better Auth service", async () => {
  let calls = 0;
  const handler = async () => { calls += 1; return new Response("admin-host"); };
  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: handler, POST: handler } });
  const response = await handlers.POST(new Request("https://internal/api/auth/admin/set-role", { method: "POST", headers: { host: "admin.staging.jyotisha.chat" } }));
  assert.equal(response.status, 200);
  assert.equal(await response.text(), "admin-host");
  assert.equal(calls, 1);
});