import assert from "node:assert/strict";
import { spawn } from "node:child_process";
import { once } from "node:events";
import { createServer } from "node:http";
import type { AddressInfo } from "node:net";
import { test } from "node:test";

test("optimized workspace reads preserve authorization, scores and fresh permission checks", { timeout: 30_000 }, async () => {
  const owner = "11111111-1111-4111-8111-111111111111";
  const other = "22222222-2222-4222-8222-222222222222";
  const playerId = "33333333-3333-4333-8333-333333333333";
  const otherPlayerId = "44444444-4444-4444-8444-444444444444";
  const calls: { method: string; url: URL }[] = [];
  let role = "user";
  let revoked = false;
  let authUnavailable = false;
  let failActions = false;
  const user = { id: owner, email: "test@example.com", email_confirmed_at: new Date().toISOString(), user_metadata: {} };
  const plan = { subscription_id: "plan", plan: "Pro", price: 10, player_limit: 5, session_limit: 10 };
  const player = { player_id: playerId, user_id: owner, fname: "Own", lname: "Player", bdate: "2000-01-01", gender: "male", image_path: null };
  const sessions = [
    { session_id: "s1", player_id: playerId, user_id: owner, created_at: "2026-01-02T00:00:00Z", status: "completed", name: "Own session", player },
    { session_id: "s2", player_id: otherPlayerId, user_id: other, created_at: "2026-01-01T00:00:00Z", status: "completed", name: "Other session", player: { fname: "Other" } },
  ];
  const actions = [
    { action_id: "a1", session_id: "s1", type: "Pass", annotation: { score: 7 } },
    { action_id: "a2", session_id: "s1", type: "Pass", annotation: null },
    { action_id: "a3", session_id: "s2", type: "Pass", annotation: { score: 10 } },
  ];
  const upstream = createServer((req, res) => {
    const url = new URL(req.url!, "http://stub");
    calls.push({ method: req.method!, url });
    res.setHeader("Content-Type", "application/json");
    if (url.pathname === "/auth/v1/user") {
      if (authUnavailable) { res.statusCode = 503; return res.end(JSON.stringify({ message: "Temporarily unavailable" })); }
      res.statusCode = revoked ? 401 : 200;
      return res.end(JSON.stringify(revoked ? { message: "Revoked" } : user));
    }
    if (url.pathname === "/auth/v1/token") {
      return res.end(JSON.stringify({ user, access_token: "access", refresh_token: "refresh", expires_in: 3600, token_type: "bearer" }));
    }
    const table = url.pathname.split("/").at(-1);
    if (table === "actions" && failActions) {
      res.statusCode = 400;
      return res.end(JSON.stringify({ message: "Unavailable" }));
    }
    let rows: Record<string, unknown>[] = table === "users" ? [{ user_id: owner, email: user.email, account_role: role }]
      : table === "users_subscriptions" ? [{ user_id: owner, subscription_id: "plan", startdate: "2000-01-01", enddate: "2099-01-01", num_players: 1, num_sessions: 1, plan }]
      : table === "players" ? [player, { player_id: otherPlayerId, user_id: other, fname: "Other" }]
      : table === "sessions" ? sessions : table === "actions" ? actions : [];
    for (const [key, filter] of url.searchParams) {
      if (filter.startsWith("eq.")) rows = rows.filter((row) => String(row[key]) === filter.slice(3));
      if (filter.startsWith("in.(")) {
        const values = filter.slice(4, -1).split(",");
        rows = rows.filter((row) => values.includes(String(row[key])));
      }
    }
    const from = Number(url.searchParams.get("offset") ?? 0);
    const limit = Number(url.searchParams.get("limit") ?? rows.length);
    res.end(JSON.stringify(rows.slice(from, from + limit)));
  });
  upstream.listen(0, "127.0.0.1");
  await once(upstream, "listening");
  const portProbe = createServer();
  portProbe.listen(0, "127.0.0.1");
  await once(portProbe, "listening");
  const port = (portProbe.address() as AddressInfo).port;
  await new Promise<void>((resolve) => portProbe.close(() => resolve()));
  const origin = `http://127.0.0.1:${port}`;
  const child = spawn(process.execPath, ["--import", "tsx", "src/server.ts"], {
    env: { ...process.env, NODE_ENV: "test", PORT: String(port), FRONTEND_URL: origin, BACKEND_URL: origin,
      SUPABASE_URL: `http://127.0.0.1:${(upstream.address() as AddressInfo).port}`,
      SUPABASE_ANON_KEY: "test-anon", SUPABASE_SERVICE_ROLE_KEY: "test-service", ANALYSIS_PROXY_SECRET: "x".repeat(32) },
    stdio: ["ignore", "pipe", "pipe"],
  });
  try {
    await new Promise<void>((resolve, reject) => {
      child.stdout.on("data", (data) => { if (String(data).includes("API listening")) resolve(); });
      child.once("exit", (code) => reject(new Error(`API exited: ${code}`)));
      child.once("error", reject);
    });
    const request = (path: string, init: RequestInit = {}) => fetch(`${origin}${path}`, {
      ...init, signal: AbortSignal.timeout(10000), headers: { Cookie: "sp_access=access", Origin: origin, ...init.headers },
    }).catch((error) => { throw new Error(`Request failed: ${path}`, { cause: error }); });
    assert.equal((await fetch(`${origin}/api/players-overview`)).status, 401);
    authUnavailable = true;
    const outage = await request("/api/auth/me", { headers: { Cookie: "sp_access=access; sp_refresh=refresh" } });
    assert.equal(outage.status, 500);
    assert.equal(outage.headers.get("set-cookie"), null, "an outage must preserve session cookies");
    assert.equal(calls.some((call) => call.url.pathname === "/auth/v1/token"), false, "an outage must not rotate refresh tokens");
    authUnavailable = false;
    const meStart = calls.length;
    const me = await (await request("/api/auth/me")).json();
    assert.equal(me.access.active, true);
    assert.equal(me.access.subscription.plan, "Pro");
    assert.equal(calls.length - meStart, 3); // auth + role + joined assignment/plan
    const rosterResponse = await request("/api/players-overview");
    assert.equal(rosterResponse.status, 200);
    const roster = (await rosterResponse.json()).players;
    assert.equal(roster.length, 1);
    assert.equal(roster[0].scores.overall, 70);
    assert.equal(roster[0].actionCount, 2);
    assert.equal(roster[0].scores.scoredActions, 1);
    const list = (await (await request("/api/sessions-overview")).json()).sessions;
    assert.equal(list.length, 1);
    assert.equal(list[0].playerName, "Own Player");
    assert.equal(list[0].actionBreakdown.Pass, 2);
    const detail = await (await request(`/api/players-overview/${playerId}`)).json();
    assert.equal(detail.scores.overall, 70);
    assert.equal(detail.playerCount, 1);
    assert.equal((await request(`/api/players-overview/${otherPlayerId}`)).status, 404);
    const billing = await (await request("/api/plan-billing")).json();
    assert.equal(billing.subscription.name, "Pro");
    assert.equal(billing.usage.sessions, 1);
    assert.ok(!calls.some(({ url }) => url.pathname.endsWith("/annotations")));
    const login = await request("/api/auth/login", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ email: user.email, password: "password123" }) });
    assert.equal(login.status, 200);
    assert.ok(!calls.some(({ method }) => method === "PATCH"));
    role = "admin";
    const adminPlayers = await (await request("/api/admin/players")).json();
    assert.equal(adminPlayers.players.find((row: { player_id: string }) => row.player_id === playerId).sessionCount, 1);
    const adminSessions = await (await request("/api/admin/sessions")).json();
    assert.equal(adminSessions.sessions.find((row: { session_id: string }) => row.session_id === "s1").actionCount, 2);
    const adminUsers = await (await request("/api/admin/users")).json();
    assert.equal(adminUsers.users[0].dataCounts.sessions, 1);
    const adminRows = (await (await request("/api/players-overview")).json()).players;
    assert.equal(adminRows.length, 2);
    role = "user";
    assert.equal((await (await request("/api/players-overview")).json()).players.length, 1);
    failActions = true;
    assert.equal((await request("/api/sessions-overview")).status, 500);
    revoked = true;
    assert.equal((await request("/api/sessions-overview")).status, 401);
  } finally {
    if (child.exitCode === null && child.signalCode === null) {
      const exited = once(child, "exit");
      child.kill();
      await exited;
    }
    upstream.closeAllConnections();
    await new Promise<void>((resolve) => upstream.close(() => resolve()));
  }
});