/**
 * SSH agent integration tests.
 *
 * These tests confirm that SSH agent authentication continues to work
 * correctly across the following scenarios that are NOT covered by the
 * existing session-ssh.spec.js suite:
 *
 *  1. Agent when sshKeysPath contains NON-matching key files.
 *     The createAuthHandler isMethodAllowed fix (commit f05ef847) makes the
 *     agent method eligible whenever the server advertises "publickey".  A
 *     regression to that fix would cause all agent logins to fail silently
 *     whenever the user has any key files on disk.
 *
 *  2. Agent discovered via process.env.SSH_AUTH_SOCK (no explicit sshAgent
 *     option).  The existing tests always pass sshAgent explicitly; this
 *     covers the implicit path used by most desktop setups.
 *
 *  3. exports.test() (connection probe) with SSH agent.
 *     Before commit a357c4a3 the ws object was not forwarded to the probe,
 *     so the host-key verification prompt (added in 409f3291) would wait
 *     forever when connecting to a new host.
 *
 * All tests mock the electron environment and run exclusively with Node.js
 * built-ins + the packages already bundled with electerm.
 */

process.env.NODE_ENV = 'development'

const { describe, test, beforeEach, afterEach } = require('node:test')
const assert = require('node:assert/strict')
const fs = require('node:fs')
const os = require('node:os')
const path = require('node:path')
const { once } = require('node:events')
const { spawnSync } = require('node:child_process')
const { Server, utils } = require('@electerm/ssh2')
const { session, test: sshTest } = require('../../src/app/server/session-ssh')

// ─── constants ────────────────────────────────────────────────────────────────

const USERNAME = 'agent-tester'

// A fresh server host key for every test run.
const HOST_KEY = utils.generateKeyPairSync('ed25519', {
  comment: 'electerm-agent-test-host'
})

// ─── helpers ──────────────────────────────────────────────────────────────────

function parseKey (key) {
  let parsed = utils.parseKey(key)
  if (Array.isArray(parsed)) parsed = parsed[0]
  if (parsed instanceof Error) throw parsed
  return parsed
}

function publicKeyMatchesCtx (ctx, publicKeyPem) {
  return Buffer.compare(
    parseKey(publicKeyPem).getPublicSSH(),
    ctx.key.data
  ) === 0
}

function runCommand (command, args, options = {}) {
  const result = spawnSync(command, args, { encoding: 'utf8', ...options })
  if (result.error) throw result.error
  if (result.status !== 0) {
    throw new Error(
      `${command} ${args.join(' ')} exited ${result.status}: ${result.stderr || result.stdout}`
    )
  }
  return result.stdout
}

function generateKey ({ dir, name, type = 'ed25519', passphrase = '', bits }) {
  const keyPath = path.join(dir, name)
  const args = ['-q', '-t', type]
  if (bits) args.push('-b', String(bits))
  args.push('-N', passphrase, '-f', keyPath, '-C', `electerm-${name}`)
  runCommand('ssh-keygen', args)
  return {
    keyPath,
    privateKey: fs.readFileSync(keyPath, 'utf8'),
    publicKey: fs.readFileSync(`${keyPath}.pub`, 'utf8')
  }
}

/**
 * Start ssh-agent on a unique socket and load the given key into it.
 * Returns { env, kill }.
 */
function startAgent (keyPath) {
  // Use a socket path that is predictable enough for debugging but unique.
  const socketPath = path.join(
    os.tmpdir(),
    `ea-agent-${process.pid}-${Date.now()}.sock`
  )
  const output = runCommand('ssh-agent', ['-a', socketPath, '-s'])
  const sockMatch = output.match(/SSH_AUTH_SOCK=([^;]+)/)
  const pidMatch = output.match(/SSH_AGENT_PID=([^;]+)/)
  if (!sockMatch || !pidMatch) {
    throw new Error(`Cannot parse ssh-agent output:\n${output}`)
  }
  const env = {
    ...process.env,
    SSH_AUTH_SOCK: sockMatch[1],
    SSH_AGENT_PID: pidMatch[1]
  }
  if (keyPath) {
    runCommand('ssh-add', [keyPath], { env })
  }
  return {
    env,
    kill () {
      try { runCommand('ssh-agent', ['-k'], { env }) } catch (_) { /* ignore */ }
    }
  }
}

/**
 * Start a minimal SSH server that only accepts publickey auth for USERNAME
 * using the provided public-key string.
 *
 * Returns { port, close }.
 */
async function startServer (allowedPublicKey, { debug = false } = {}) {
  const clients = new Set()
  const server = new Server({ hostKeys: [HOST_KEY.private] }, (client) => {
    clients.add(client)
    client.on('close', () => clients.delete(client))
    client.on('end', () => clients.delete(client))

    client.on('authentication', (ctx) => {
      if (debug) {
        console.log('[server] auth method:', ctx.method, 'user:', ctx.username)
      }
      if (ctx.method === 'none') {
        return ctx.reject(['publickey'])
      }
      if (
        ctx.method === 'publickey' &&
        ctx.username === USERNAME &&
        publicKeyMatchesCtx(ctx, allowedPublicKey)
      ) {
        if (debug) console.log('[server] accepted publickey auth')
        return ctx.accept()
      }
      // reject but keep publickey in the advertised list so the client can
      // try the ssh agent after failing with a file key
      return ctx.reject(['publickey'])
    })

    client.on('ready', () => {
      client.on('session', (accept) => {
        const sess = accept()
        sess.on('env', (accept) => accept())
        sess.on('pty', (accept) => accept())
        sess.on('shell', (accept) => {
          const stream = accept()
          stream.write('electerm-agent-test ready\n')
        })
      })
    })
  })

  server.listen(0, '127.0.0.1')
  await once(server, 'listening')
  const { port } = server.address()
  if (debug) console.log('[server] listening on port', port)

  return {
    port,
    async close () {
      for (const c of clients) c.end()
      await new Promise((resolve, reject) => {
        server.close((err) => (err ? reject(err) : resolve()))
      })
    }
  }
}

/**
 * Minimal ws mock that automatically trusts unknown host keys.
 * Any non-confirm interactive prompt rejects with an error so tests fail
 * loudly if an unexpected prompt appears.
 */
function makeWs ({ allowNonConfirmPrompts = false, debug = false } = {}) {
  let pendingHandler = null
  let pendingOptions = null
  return {
    s (payload) {
      if (payload?.action !== 'session-interactive') return
      pendingOptions = payload.options
      if (debug) {
        console.log('[ws] session-interactive', JSON.stringify({
          mode: payload.options?.mode,
          name: payload.options?.name,
          prompts: (payload.options?.prompts || []).map(p => p.prompt)
        }))
      }
    },
    once (handler) {
      const opts = pendingOptions
      queueMicrotask(() => {
        if (opts?.mode === 'confirm') {
          // Auto-trust the host key
          if (debug) console.log('[ws] auto-trusting host key')
          handler({ results: ['trust'] })
        } else if (allowNonConfirmPrompts) {
          handler({ results: pendingHandler ? pendingHandler(opts) : [] })
        } else {
          // Fail loudly – agent login should not need interactive prompts
          handler({ results: [] }) // empty results → reject('User cancel')
        }
      })
      pendingHandler = null
    },
    close () {}
  }
}

function setEnv (name, value) {
  if (value === undefined) delete process.env[name]
  else process.env[name] = value
}

// ─── fixture management ────────────────────────────────────────────────────────

describe('SSH agent auth', () => {
  let tmpDir
  let savedEnv

  beforeEach(() => {
    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'electerm-agent-test-'))

    savedEnv = {
      HOME: process.env.HOME,
      USERPROFILE: process.env.USERPROFILE,
      SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK,
      SSH_AGENT_PID: process.env.SSH_AGENT_PID,
      sshKeysPath: process.env.sshKeysPath
    }

    const homeDir = path.join(tmpDir, 'home')
    const sshKeysDir = path.join(tmpDir, 'ssh-keys')
    fs.mkdirSync(homeDir, { recursive: true })
    fs.mkdirSync(sshKeysDir, { recursive: true })

    setEnv('HOME', homeDir)
    setEnv('USERPROFILE', homeDir)
    setEnv('SSH_AUTH_SOCK', undefined)
    setEnv('SSH_AGENT_PID', undefined)
    setEnv('sshKeysPath', sshKeysDir)
  })

  afterEach(() => {
    setEnv('HOME', savedEnv.HOME)
    setEnv('USERPROFILE', savedEnv.USERPROFILE)
    setEnv('SSH_AUTH_SOCK', savedEnv.SSH_AUTH_SOCK)
    setEnv('SSH_AGENT_PID', savedEnv.SSH_AGENT_PID)
    setEnv('sshKeysPath', savedEnv.sshKeysPath)
    fs.rmSync(tmpDir, { recursive: true, force: true })
  })

  // ── test 1 ─────────────────────────────────────────────────────────────────
  test(
    'agent auth succeeds even when sshKeysPath contains non-matching key files',
    async (t) => {
      // This is the primary regression test for the isMethodAllowed fix
      // (commit f05ef847).  Without that fix the auth handler would return
      // false as soon as the key-file publickey attempt failed, because
      // "agent" is not literally in the server's ["publickey"] allow-list,
      // and the connection would be rejected with "All configured
      // authentication methods failed" before the agent was ever tried.

      let agent
      try {
        agent = startAgent() // start without a key first – we load it below
      } catch (err) {
        if (err.code === 'ENOENT') {
          t.skip('ssh-agent / ssh-keygen not available')
          return
        }
        throw err
      }

      const sshKeysDir = process.env.sshKeysPath

      // Generate the key the server will accept and load it into the agent.
      const agentKey = generateKey({ dir: tmpDir, name: 'agent-key' })
      runCommand('ssh-add', [agentKey.keyPath], { env: agent.env })

      // Generate a DIFFERENT key that lives in sshKeysPath.
      // The code will try this one first (publickey auth) and it will fail.
      // Agent must then be tried automatically.
      const wrongKey = generateKey({ dir: sshKeysDir, name: 'wrong-key' })
      // Also place the matching .pub file so getSSHKeys() finds it.
      fs.copyFileSync(`${wrongKey.keyPath}.pub`, path.join(sshKeysDir, 'wrong-key.pub'))

      setEnv('SSH_AUTH_SOCK', agent.env.SSH_AUTH_SOCK)
      setEnv('SSH_AGENT_PID', agent.env.SSH_AGENT_PID)

      const server = await startServer(agentKey.publicKey, { debug: true })
      let term
      try {
        term = await session({
          host: '127.0.0.1',
          port: server.port,
          username: USERNAME,
          sshAgent: agent.env.SSH_AUTH_SOCK,
          useSshAgent: true,
          enableSsh: false,
          readyTimeout: 10000,
          debug: true // enables ssh2 protocol debug output
        }, makeWs({ debug: true }))

        // If we reach here the agent key was accepted.
        assert.ok(term, 'session should resolve when agent auth succeeds')
      } finally {
        term?.kill()
        await server.close()
        agent.kill()
      }
    }
  )

  // ── test 2 ─────────────────────────────────────────────────────────────────
  test(
    'agent auth works via implicit process.env.SSH_AUTH_SOCK (no explicit sshAgent option)',
    async (t) => {
      // The getAgent() method falls back to process.env.SSH_AUTH_SOCK when
      // initOptions.sshAgent is not set.  This covers the typical desktop
      // user who relies on a system-managed agent socket.

      let agent
      try {
        agent = startAgent()
      } catch (err) {
        if (err.code === 'ENOENT') {
          t.skip('ssh-agent / ssh-keygen not available')
          return
        }
        throw err
      }

      const agentKey = generateKey({ dir: tmpDir, name: 'implicit-agent-key' })
      runCommand('ssh-add', [agentKey.keyPath], { env: agent.env })

      // Expose the agent socket via the environment variable only – do NOT
      // set initOptions.sshAgent.
      setEnv('SSH_AUTH_SOCK', agent.env.SSH_AUTH_SOCK)
      setEnv('SSH_AGENT_PID', agent.env.SSH_AGENT_PID)

      const server = await startServer(agentKey.publicKey, { debug: true })
      let term
      try {
        term = await session({
          host: '127.0.0.1',
          port: server.port,
          username: USERNAME,
          // No sshAgent option – should discover SSH_AUTH_SOCK automatically
          useSshAgent: true,
          enableSsh: false,
          readyTimeout: 10000,
          debug: true
        }, makeWs({ debug: true }))

        assert.ok(term, 'session should resolve when implicit agent is used')
      } finally {
        term?.kill()
        await server.close()
        agent.kill()
      }
    }
  )

  // ── test 3 ─────────────────────────────────────────────────────────────────
  test(
    'exports.test (connection probe) returns true with SSH agent on a new host',
    async (t) => {
      // Before commit a357c4a3, exports.test() did not forward ws to the
      // TerminalSsh instance.  The host-key verifier added in 409f3291 calls
      // onKeyboardEvent() which sends a session-interactive event to ws and
      // then awaits a reply.  With ws === undefined the await never resolved,
      // causing the probe to hang.  This test would time out under that bug.

      let agent
      try {
        agent = startAgent()
      } catch (err) {
        if (err.code === 'ENOENT') {
          t.skip('ssh-agent / ssh-keygen not available')
          return
        }
        throw err
      }

      const agentKey = generateKey({ dir: tmpDir, name: 'probe-agent-key' })
      runCommand('ssh-add', [agentKey.keyPath], { env: agent.env })

      setEnv('SSH_AUTH_SOCK', agent.env.SSH_AUTH_SOCK)
      setEnv('SSH_AGENT_PID', agent.env.SSH_AGENT_PID)

      const server = await startServer(agentKey.publicKey, { debug: true })
      try {
        const ok = await sshTest({
          host: '127.0.0.1',
          port: server.port,
          username: USERNAME,
          sshAgent: agent.env.SSH_AUTH_SOCK,
          useSshAgent: true,
          readyTimeout: 10000,
          debug: true
        }, makeWs({ debug: true })) // ws must be forwarded (fixed in a357c4a3)

        assert.equal(ok, true, 'sshTest should return true when agent auth succeeds')
      } finally {
        await server.close()
        agent.kill()
      }
    }
  )

  // ── test 4 ─────────────────────────────────────────────────────────────────
  test(
    'agent auth with a new host requires host-key confirmation and then succeeds',
    async (t) => {
      // Confirm that the host-key verification dialog (409f3291) does not
      // interfere with subsequent agent-based authentication.  A fresh HOME
      // dir is used so known_hosts starts empty.

      let agent
      try {
        agent = startAgent()
      } catch (err) {
        if (err.code === 'ENOENT') {
          t.skip('ssh-agent / ssh-keygen not available')
          return
        }
        throw err
      }

      const agentKey = generateKey({ dir: tmpDir, name: 'new-host-agent-key' })
      runCommand('ssh-add', [agentKey.keyPath], { env: agent.env })

      setEnv('SSH_AUTH_SOCK', agent.env.SSH_AUTH_SOCK)
      setEnv('SSH_AGENT_PID', agent.env.SSH_AGENT_PID)

      const server = await startServer(agentKey.publicKey, { debug: true })

      let confirmCount = 0
      const ws = {
        s (payload) {
          if (payload?.action !== 'session-interactive') return
          if (payload.options?.mode === 'confirm') {
            confirmCount++
            console.log('[ws] host-key confirm dialog received (#' + confirmCount + ')')
          } else {
            // Any non-confirm prompt during agent login is unexpected
            console.error('[ws] unexpected non-confirm prompt:', payload.options)
          }
        },
        once (handler) {
          queueMicrotask(() => handler({ results: ['trust'] }))
        },
        close () {}
      }

      let term
      try {
        term = await session({
          host: '127.0.0.1',
          port: server.port,
          username: USERNAME,
          sshAgent: agent.env.SSH_AUTH_SOCK,
          useSshAgent: true,
          enableSsh: false,
          readyTimeout: 10000,
          debug: true
        }, ws)

        assert.ok(term, 'session should resolve after trusting the host key')
        assert.equal(
          confirmCount,
          1,
          'exactly one host-key confirmation prompt should appear for a new host'
        )

        // Verify the host was saved to known_hosts
        const knownHostsPath = path.join(process.env.HOME, '.ssh', 'known_hosts')
        const knownHostsContent = fs.readFileSync(knownHostsPath, 'utf8')
        assert.match(
          knownHostsContent,
          /127\.0\.0\.1/,
          'server should be recorded in known_hosts after trusting'
        )
      } finally {
        term?.kill()
        await server.close()
        agent.kill()
      }
    }
  )
})