import assert from "node:assert/strict";
import crypto from "node:crypto";
import { readFileSync } from "node:fs";
import test from "node:test";
import { decryptEpayKey, encryptEpayKey, EpayEncryptionError } from "../src/lib/epay/encryption-core";
import { resolveEpayConfig } from "../src/lib/epay/config-core";
import { assertPublicEpayGateway, isPublicEpayAddress } from "../src/lib/epay/gateway-policy";

const root = new URL("../", import.meta.url);
const route = readFileSync(new URL("src/app/api/admin/epay-settings/route.ts", root), "utf8");
const management = readFileSync(new URL("src/components/admin/payment-management.tsx", root), "utf8");
const createRoute = readFileSync(new URL("src/app/api/payment/epay/create/route.ts", root), "utf8");
const notifyRoute = readFileSync(new URL("src/app/api/payment/epay/notify/route.ts", root), "utf8");
const configRoute = readFileSync(new URL("src/lib/epay/config.ts", root), "utf8");
const availability = readFileSync(new URL("src/lib/epay/availability.ts", root), "utf8");
const packagesRoute = readFileSync(new URL("src/app/api/payment/packages/route.ts", root), "utf8");
const testRoute = readFileSync(new URL("src/app/api/admin/epay-settings/test/route.ts", root), "utf8");
const page = readFileSync(new URL("src/app/page.tsx", root), "utf8");
const migration = readFileSync(new URL("supabase/migrations/20260729010000_epay_settings.sql", root), "utf8");

const key = crypto.randomBytes(32).toString("base64");

test("易支付密钥 AES-256-GCM 往返、篡改与错误主密钥", () => {
  const encrypted = encryptEpayKey("merchant-secret", key);
  assert.match(encrypted, /^v1\.[^.]+\.[^.]+\.[^.]+$/);
  assert.equal(decryptEpayKey(encrypted, key), "merchant-secret");
  const tampered = `${encrypted.slice(0, -1)}${encrypted.endsWith("A") ? "B" : "A"}`;
  assert.throws(() => decryptEpayKey(tampered, key), EpayEncryptionError);
  assert.throws(() => decryptEpayKey(encrypted, crypto.randomBytes(32).toString("base64")), EpayEncryptionError);
  assert.throws(() => encryptEpayKey("merchant-secret", "not-base64"), EpayEncryptionError);
});

test("配置解析数据库优先且无行时回退环境变量", async () => {
  const encrypted = encryptEpayKey("database-secret", key);
  const database = await resolveEpayConfig(async () => ({
    gateway_url: "https://database-pay.example.com/",
    pid: "database-pid",
    encrypted_key: encrypted,
    notify_url: "https://staging.example.com/api/payment/epay/notify",
    return_url: "https://staging.example.com/",
    site_name: "Staging",
    chat_enabled: false,
  }), {
    NODE_ENV: "test",
    EPAY_CONFIG_ENCRYPTION_KEY: key,
    EPAY_GATEWAY_URL: "https://environment-pay.example.com",
    EPAY_PID: "environment-pid",
    EPAY_KEY: "environment-secret",
  });
  assert.equal(database.gatewayUrl.toString(), "https://database-pay.example.com/");
  assert.equal(database.pid, "database-pid");
  assert.equal(database.key, "database-secret");
  assert.equal(database.chatEnabled, false);

  const environment = await resolveEpayConfig(async () => null, {
    NODE_ENV: "test",
    SITE_ADDRESS: "https://staging.example.com",
    EPAY_GATEWAY_URL: "https://environment-pay.example.com",
    EPAY_PID: "environment-pid",
    EPAY_KEY: "environment-secret",
    EPAY_CHAT_ENABLED: "1",
  });
  assert.equal(environment.chatEnabled, true);
  assert.equal(environment.notifyUrl, "https://staging.example.com/api/payment/epay/notify");
  assert.equal(environment.returnUrl, "https://staging.example.com/");
});

test("管理员 API 不回显任何密钥并强制首次显式录入", () => {
  assert.match(route, /requireAdminSession\("read"\)/);
  assert.match(route, /requireAdminSession\("write"\)/);
  assert.match(route, /\.strict\(\)/);
  assert.match(route, /crypto\.randomUUID\(\)/);
  assert.match(route, /首次保存数据库配置时必须输入新的商户密钥/);
  assert.match(route, /chatEnabled: z\.boolean\(\)/);
  assert.match(route, /p_chat_enabled: parsed\.data\.chatEnabled/);
  assert.match(route, /keyConfigured/);
  assert.doesNotMatch(route, /NextResponse\.json\([^\n]*(?:encrypted_key|newKey|encryptedKey|maskedKey|keyMask)/);
  assert.doesNotMatch(route, /BETTER_AUTH_SECRET/);
});

test("迁移前仅在配置表不存在时继续使用环境变量", () => {
  assert.match(configRoute, /error\?\.code === "42P01"/);
  assert.match(route, /error\?\.code === "42P01"/);
  assert.match(configRoute, /if \(error\) throw new Error\(\)/);
});

test("支付调用点等待异步数据库配置", () => {
  assert.match(createRoute, /await readEpayConfig\(\)/);
  assert.match(notifyRoute, /await readEpayConfig\(\)/);
  assert.match(notifyRoute, /export async function POST/);
  assert.match(notifyRoute, /export async function GET/);
});

test("统一支付页面含系统配置 Card 与永不预填的 Password", () => {
  assert.match(management, /title="易支付系统配置"/);
  assert.match(management, /\/api\/admin\/epay-settings/);
  assert.match(management, /<Input\.Password/);
  assert.match(management, /placeholder="留空保持原密钥"/);
  assert.match(management, /setFieldValue\("newKey", ""\)/);
  assert.doesNotMatch(management, /value=\{.*(?:key|secret)/i);
});

test("支付开关贯通迁移、公共套餐 API、创建订单和对话页", () => {
  assert.match(migration, /chat_enabled boolean not null default false/);
  assert.match(migration, /p_chat_enabled boolean/);
  assert.match(migration, /'chatEnabled'/);
  assert.match(availability, /EPAY_CHAT_ENABLED/);
  assert.doesNotMatch(availability, /EPAY_CONFIG_ENCRYPTION_KEY|decryptEpayKey/);
  assert.match(packagesRoute, /enabled: false, packages: \[\]/);
  assert.match(packagesRoute, /enabled: true/);
  assert.match(createRoute, /在线支付暂未开放/);
  assert.match(createRoute, /EPAY_DISABLED/);
  assert.match(createRoute, /await readEpayAvailability\(\)/);
  assert.ok(createRoute.indexOf("availability.enabled") < createRoute.indexOf("await readEpayConfig()"));
  assert.ok(createRoute.indexOf("availability.enabled") < createRoute.indexOf("payment_packages"));
  assert.match(management, /在对话页开放支付/);
  assert.match(page, /paymentEnabled && <div className="payment-packages">/);
  assert.match(page, /setPaymentEnabled\(false\)[\s\S]*setPaymentPackages\(\[\]\)[\s\S]*setPaymentOrder\(null\)[\s\S]*setPaymentError\(""\)/);
});

test("网关探测只使用 HEAD/GET、受限响应且共享 SSRF 门禁", () => {
  assert.match(testRoute, /requireAdminSession\("write"\)/);
  assert.match(testRoute, /method: "HEAD"/);
  assert.match(testRoute, /response\.status === 405 \|\| response\.status === 501/);
  assert.match(testRoute, /method: "GET"/);
  assert.doesNotMatch(testRoute, /method: "POST"|payment_orders|\.text\(\)|\.json\(\)/);
  assert.match(testRoute, /AbortSignal\.timeout\(8_000\)/);
  assert.match(testRoute, /redirect: "manual"/);
  assert.match(testRoute, /available,[\s\S]*message:[\s\S]*latencyMs:[\s\S]*status:/);
  assert.doesNotMatch(testRoute, /pid:|key:|gatewayUrl:|headers:|body:|payment_orders/);
  assert.match(testRoute, /assertPublicGatewayUrl\(submitUrl\)/);
  assert.match(createRoute, /assertPublicGatewayUrl\(submitUrl\)/);
});

test("纯地址判断拒绝私网、回环、链路本地并接受公网", () => {
  for (const address of ["127.0.0.1", "10.0.0.1", "172.16.0.1", "192.168.1.1", "169.254.1.1", "::1", "fc00::1", "fe80::1", "2001:db8::1"]) {
    assert.equal(isPublicEpayAddress(address), false, address);
  }
  for (const address of ["8.8.8.8", "1.1.1.1", "2606:4700:4700::1111"]) {
    assert.equal(isPublicEpayAddress(address), true, address);
  }
  assert.throws(() => assertPublicEpayGateway("http://localhost/pay"));
  assert.throws(() => assertPublicEpayGateway("http://127.0.0.1/pay"));
  assert.doesNotThrow(() => assertPublicEpayGateway("https://pay.example.com"));
});

test("迁移锁定单行、RLS、最小权限与脱敏原子审计", () => {
  assert.match(migration, /create table public\.epay_settings/);
  assert.match(migration, /id boolean primary key default true check \(id\)/);
  assert.match(migration, /alter table public\.epay_settings enable row level security/);
  assert.match(migration, /revoke all on table public\.epay_settings from public, anon, authenticated, service_role/);
  assert.match(migration, /grant select on table public\.epay_settings to service_role/);
  assert.match(migration, /security definer/);
  assert.match(migration, /insert into audit\.admin_audit_logs/);
  assert.match(migration, /'keyConfigured'/);
  assert.match(migration, /'keyChanged'/);
  const auditBlock = migration.slice(migration.indexOf("insert into audit.admin_audit_logs"));
  assert.doesNotMatch(auditBlock, /'encryptedKey'|'encrypted_key'|'secret'|jsonb_build_object\([\s\S]*?'key'/);
});