import { describe, expect, mock, test } from "bun:test";
import { generateKeyPairSync } from "node:crypto";
import { hmacSha256Hex } from "../crypto";
import { signPayload, verifyLinearSignature, verifySha256Signature, verifySlackSignature } from "./signatures";
import { escapeSlack, googleChatDigest, googleChatMessage, slackDigest, slackMessage } from "./format";
import { branchMatches, passesFilters, summarizeEvent } from "./summarize";
import type { EventSummary } from "./summarize";
import { extractIssueKeys } from "./linear-keys";
import { DEFAULT_FILTERS } from "~/lib/integrations";

const fakeEnv = { PUBLIC_URL: "https://gitfor.example.com", INTEGRATIONS_ALLOW_LOOPBACK: "false", SECRETS_KEY: "test" };
mock.module("cloudflare:workers", () => ({
  env: fakeEnv,
  waitUntil: () => undefined,
  WorkflowEntrypoint: class {},
  DurableObject: class {},
  WorkerEntrypoint: class {},
}));

const repo = { fullName: "acme/web", url: "https://gitfor.example.com/acme/web", defaultBranch: "main" };

describe("signatures", () => {
  test("outbound HMAC round-trips and rejects tampering", async () => {
    const header = await signPayload("s3cret", '{"a":1}');
    expect(header).toBe(`sha256=${await hmacSha256Hex("s3cret", '{"a":1}')}`);
    expect(await verifySha256Signature("s3cret", '{"a":1}', header)).toBe(true);
    expect(await verifySha256Signature("s3cret", '{"a":2}', header)).toBe(false);
    expect(await verifySha256Signature("other", '{"a":1}', header)).toBe(false);
    expect(await verifySha256Signature("s3cret", '{"a":1}', null)).toBe(false);
    expect(await verifySha256Signature("", '{"a":1}', header)).toBe(false);
  });

  test("Slack v0 signatures are verified with a replay window", async () => {
    const nowMs = 1_700_000_000_000;
    const timestamp = String(nowMs / 1000);
    const body = "token=x&team_id=T1&text=status+acme%2Fweb";
    const signature = `v0=${await hmacSha256Hex("signing", `v0:${timestamp}:${body}`)}`;
    const base = { signingSecret: "signing", body, timestamp, signature, nowMs };
    expect(await verifySlackSignature(base)).toBe(true);
    expect(await verifySlackSignature({ ...base, body: `${body}&x=1` })).toBe(false);
    expect(await verifySlackSignature({ ...base, signingSecret: "wrong" })).toBe(false);
    expect(await verifySlackSignature({ ...base, nowMs: nowMs + 6 * 60_000 })).toBe(false);
    expect(await verifySlackSignature({ ...base, timestamp: "abc" })).toBe(false);
    expect(await verifySlackSignature({ ...base, signature: null })).toBe(false);
  });

  test("Linear signatures require a fresh webhookTimestamp", async () => {
    const nowMs = 1_700_000_000_000;
    const body = JSON.stringify({ type: "Issue", action: "update", webhookTimestamp: nowMs - 5_000 });
    const signature = await hmacSha256Hex("lin", body);
    expect(await verifyLinearSignature({ secret: "lin", body, signature, nowMs })).toBe(true);
    expect(await verifyLinearSignature({ secret: "lin", body, signature: signature.toUpperCase(), nowMs })).toBe(true);
    expect(await verifyLinearSignature({ secret: "nope", body, signature, nowMs })).toBe(false);
    expect(await verifyLinearSignature({ secret: "lin", body, signature, nowMs: nowMs + 120_000 })).toBe(false);
    const stale = JSON.stringify({ type: "Issue" });
    expect(
      await verifyLinearSignature({ secret: "lin", body: stale, signature: await hmacSha256Hex("lin", stale), nowMs }),
    ).toBe(false);
  });
});

function pullMerged(): EventSummary {
  const summary = summarizeEvent(
    "pull_request",
    {
      action: "closed",
      number: 7,
      pull_request: {
        number: 7,
        merged: true,
        title: "Fix <script> & stuff",
        html_url: "https://gitfor.example.com/acme/web/pull/7",
        head: { ref: "eng-12-fix" },
        base: { ref: "main" },
      },
      sender: { login: "ada" },
    },
    repo,
  );
  if (!summary) throw new Error("expected a summary");
  return summary;
}

describe("payload formatting", () => {
  test("summaries cover pushes, PRs, reviews, CI and releases", () => {
    const merged = pullMerged();
    expect(merged.title).toBe("Pull request #7 merged: Fix <script> & stuff");
    expect(merged.tone).toBe("good");
    expect(merged.fields).toEqual([{ label: "Branch", value: "eng-12-fix → main" }]);

    const push = summarizeEvent(
      "push",
      {
        ref: "refs/heads/main",
        commits: [{ id: "abcdef1234567", message: "First line\n\nbody" }],
        sender: { login: "ada" },
      },
      repo,
    );
    expect(push?.title).toBe("ada pushed 1 commit to main");
    expect(push?.text).toBe("abcdef1 First line");
    expect(summarizeEvent("push", { ref: "refs/tags/v1", commits: [{ id: "a" }] }, repo)).toBeNull();
    expect(summarizeEvent("pull_request", { action: "synchronize", pull_request: { number: 1 } }, repo)).toBeNull();

    const review = summarizeEvent(
      "pull_request_review",
      {
        action: "submitted",
        review: { state: "changes_requested" },
        pull_request: { number: 3 },
        sender: { login: "bo" },
      },
      repo,
    );
    expect(review?.title).toBe("bo changes requested pull request #3");
    expect(review?.tone).toBe("bad");

    const run = summarizeEvent(
      "workflow_run",
      { action: "completed", workflow_run: { name: "CI", run_number: 4, conclusion: "failure", head_branch: "main" } },
      repo,
    );
    expect(run?.category).toBe("ci");
    expect(run?.title).toBe("CI #4 failure on main");

    const release = summarizeEvent(
      "release",
      { action: "published", release: { tag_name: "v1.0.0", name: "One", prerelease: true } },
      repo,
    );
    expect(release?.title).toBe("Released One (pre-release)");
  });

  test("Slack Block Kit escapes user text and links the title", () => {
    const message = slackMessage(pullMerged());
    const section = message.blocks[0] as { text: { text: string } };
    expect(section.text.text).toContain("Fix &lt;script&gt; &amp; stuff");
    expect(section.text.text).toContain("<https://gitfor.example.com/acme/web/pull/7|");
    expect(message.blocks.map((block) => block.type)).toEqual(["section", "section", "context", "actions"]);
    expect(message.unfurl_links).toBe(false);
    expect(escapeSlack("<@U123>")).toBe("&lt;@U123&gt;");
    const digest = slackDigest([pullMerged(), pullMerged()], "acme/web");
    expect(digest.text).toBe("acme/web: 2 updates");
  });

  test("Google Chat cardsV2 carries header, widgets and a button", () => {
    const message = googleChatMessage(pullMerged(), "card-1");
    expect(message.cardsV2[0].cardId).toBe("card-1");
    const card = message.cardsV2[0].card as { header: { title: string }; sections: Array<{ widgets: unknown[] }> };
    expect(card.header.title).toBe("acme/web");
    const json = JSON.stringify(card);
    expect(json).toContain("Fix &lt;script&gt; &amp; stuff");
    expect(json).toContain('"openLink":{"url":"https://gitfor.example.com/acme/web/pull/7"}');
    expect(googleChatDigest([pullMerged()], "acme", "d").cardsV2[0].card).toBeTruthy();
  });

  test("filters are quiet by default", () => {
    const merged = pullMerged();
    expect(passesFilters(merged, ["pull_request"], DEFAULT_FILTERS, "main")).toBe(true);
    expect(passesFilters(merged, ["release"], DEFAULT_FILTERS, "main")).toBe(false);
    expect(passesFilters({ ...merged, draft: true }, ["pull_request"], DEFAULT_FILTERS, "main")).toBe(false);
    expect(passesFilters({ ...merged, actor: "renovate[bot]" }, ["pull_request"], DEFAULT_FILTERS, "main")).toBe(false);
    const ci = { ...merged, category: "ci" as const, branch: "main", conclusion: "success" };
    expect(passesFilters(ci, ["ci"], DEFAULT_FILTERS, "main")).toBe(false);
    expect(passesFilters({ ...ci, conclusion: "failure" }, ["ci"], DEFAULT_FILTERS, "main")).toBe(true);
    expect(passesFilters({ ...ci, conclusion: "failure", branch: "feature" }, ["ci"], DEFAULT_FILTERS, "main")).toBe(
      false,
    );
    expect(branchMatches("release/1.2", ["release/*"], "main")).toBe(true);
    expect(branchMatches("release/1/2", ["release/*"], "main")).toBe(false);
    expect(branchMatches("release/1/2", ["release/**"], "main")).toBe(true);
    expect(branchMatches("a", ["*********a"], "main")).toBe(false);
  });
});

describe("Linear keys", () => {
  test("finds keys in titles, branches and commits", () => {
    expect(extractIssueKeys(["ENG-123: fix login", "Refs OPS-9"])).toEqual(["ENG-123", "OPS-9"]);
    expect(extractIssueKeys(["eng-123-fix-login"], ["ENG"])).toEqual(["ENG-123"]);
    expect(extractIssueKeys(["utf-8 and sha-256"], ["ENG"])).toEqual([]);
    expect(extractIssueKeys(["eng-1"])).toEqual([]);
    expect(extractIssueKeys(["XENG-12a", "ENG-012"])).toEqual(["ENG-12"]);
  });
});

describe("SSRF protection", async () => {
  const { assertOutboundUrl } = await import("./outbound");
  test("rejects non-public or non-https targets", () => {
    const rejected = [
      "http://hooks.slack.com/services/x",
      "https://localhost/x",
      "https://127.0.0.1/x",
      "https://[::1]/x",
      "https://10.0.0.1/x",
      "https://metadata.internal/x",
      "https://foo.workers.dev/x",
      "https://gitfor.example.com/api",
      "https://pages.gitfor.example.com/api",
      "https://user:pass@hooks.slack.com/x",
      "https://intranet/x",
      "file:///etc/passwd",
      "not a url",
    ];
    for (const url of rejected) expect(() => assertOutboundUrl(url, false)).toThrow();
    expect(assertOutboundUrl("https://hooks.slack.com/services/T/B/x", false).hostname).toBe("hooks.slack.com");
  });

  test("only transient failures are retried", async () => {
    const { isPermanentFailure } = await import("./outbound");
    const result = { body: "", error: "x", durationMs: 0 };
    expect(isPermanentFailure({ ...result, status: 404 })).toBe(true);
    expect(isPermanentFailure({ ...result, status: 429 })).toBe(false);
    expect(isPermanentFailure({ ...result, status: 503 })).toBe(false);
    expect(isPermanentFailure({ ...result, status: null })).toBe(false);
    expect(isPermanentFailure({ ...result, status: null, permanent: true })).toBe(true);
  });

  test("loopback sinks are only allowed when explicitly enabled", () => {
    expect(() => assertOutboundUrl("http://localhost:4545/hook", false)).toThrow();
    expect(assertOutboundUrl("http://localhost:4545/hook", true).port).toBe("4545");
    expect(() => assertOutboundUrl("http://10.0.0.1/hook", true)).toThrow();
  });
});

describe("GitHub helpers", async () => {
  const { planMirror, isGithubRepoName } = await import("./github-sync");
  const { pkcs1ToPkcs8 } = await import("./github-app");
  const { pickTargetState } = await import("./linear");

  test("mirror plans only changed refs and never deletes", () => {
    const plan = planMirror(
      [
        { name: "refs/heads/main", sha: "b".repeat(40) },
        { name: "refs/heads/new", sha: "c".repeat(40) },
        { name: "refs/tags/v1", sha: "d".repeat(40) },
      ],
      [
        { name: "refs/heads/main", sha: "a".repeat(40) },
        { name: "refs/tags/v1", sha: "d".repeat(40) },
        { name: "refs/heads/gone", sha: "e".repeat(40) },
      ],
    );
    expect(plan.commands).toEqual([
      { name: "refs/heads/main", sha: "b".repeat(40), oldSha: "a".repeat(40) },
      { name: "refs/heads/new", sha: "c".repeat(40), oldSha: "0".repeat(40) },
    ]);
    expect(isGithubRepoName("acme/web")).toBe(true);
    expect(isGithubRepoName("acme/../x")).toBe(false);
    expect(isGithubRepoName("acme")).toBe(false);
  });

  test("PKCS#1 GitHub keys are wrapped into importable PKCS#8", () => {
    const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
    const pkcs1 = new Uint8Array(privateKey.export({ format: "der", type: "pkcs1" }));
    const pkcs8 = new Uint8Array(privateKey.export({ format: "der", type: "pkcs8" }));
    expect(Buffer.from(pkcs1ToPkcs8(pkcs1)).equals(Buffer.from(pkcs8))).toBe(true);
  });

  test("Linear never moves an issue backwards", () => {
    const states = [
      { id: "1", name: "Todo", type: "unstarted" },
      { id: "2", name: "In Progress", type: "started" },
      { id: "3", name: "Done", type: "completed" },
    ];
    const issue = (state: number) => ({
      id: "i",
      identifier: "ENG-1",
      state: states[state],
      team: { states: { nodes: states } },
    });
    expect(pickTargetState(issue(0), "in progress")?.id).toBe("2");
    expect(pickTargetState(issue(2), "In Progress")).toBeNull();
    expect(pickTargetState(issue(1), "Done")?.id).toBe("3");
    expect(pickTargetState(issue(1), "")).toBeNull();
    expect(pickTargetState(issue(1), "Missing")).toBeNull();
  });
});