import { ownerAccounts } from './helpers/owner-accounts.mjs';
// Row 252 (#1753, design sections 4 and 5): the Console decision routes on the human listener, signed
// in through the fake OP in helpers/fake-oidc.mjs on loopback. The bus transport is a recording stub,
// so this covers the listener's gates and the session it passes; decision-http.test.mjs covers the
// endpoint's own table and console-decide.test.mjs the bus. The public name is console.example.test,
// sent only as a Host header to the test's own listener. sso.test.mjs pins its own log lines, so the
// decide lines are checked here.
import { test } from 'node:test';
import assert from 'node:assert/strict';
import { request } from 'node:http';
import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { Broker } from '../../bus/src/broker.mjs';
import { Store } from '../../bus/src/store.mjs';
import { views } from '../../bus/src/views.mjs';
import { browser } from './browser.mjs';
import { startServer } from '../src/serve.mjs';
import { createSso, SESSION_COOKIE } from '../src/sso.mjs';
import { DECISION_REFUSALS } from '../src/decision-http.mjs';
import { consoleCall } from '../src/bus.mjs';
import { consoleAccess } from '../src/access.mjs';
import { userOptionsFor } from '../src/console-bus.mjs';
import { close } from './fixture.mjs';
import { fakeOidc } from './helpers/fake-oidc.mjs';

const HOST = 'console.example.test', ORIGIN = `https://${HOST}`;
const DIGEST = 'b'.repeat(64);
const PREVIEW = { id: 'd1', business: 'demo', question: 'Enroll web1?', digest: DIGEST, approve: { key: 'yes', text: 'Yes' }, deny: { key: 'no', text: 'No' }, grant: { method: 'host-enroll', host: 'web1' } };

// node:http, not fetch: fetch can't set Host, Origin or Sec-Fetch-Site.
function call(port, { method = 'GET', path = '/', headers = {}, body, host = HOST } = {}) {
  return new Promise((resolve, reject) => {
    const length = body === undefined ? {} : { 'content-length': Buffer.byteLength(body) };
    const req = request({ host: '127.0.0.1', port, method, path, headers: { host, ...length, ...headers } }, res => {
      let text = '';
      res.on('data', c => (text += c));
      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: text && (res.headers['content-type'] ?? '').startsWith('application/json') ? JSON.parse(text) : text }));
    });
    req.on('error', reject);
    req.end(body);
  });
}
const writeHeaders = cookie => ({ ...(cookie ? { cookie } : {}), origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' });

// The fake OP, createSso over it, and the human listener. `server` overrides startServer options.
// The decision transport records each call and answers a preview or a resolve. `access`, when given,
// is the access document: createSso gets the users hook and the listener a user transport, as
// granted-user.test.mjs sets them up.
async function setup(t, server = {}, access = null) {
  const op = await fakeOidc();
  t.after(() => op.close());
  const iss = op.issuer('a');
  const config = { publicOrigin: ORIGIN, providers: [{ id: 'a', issuer: iss.issuer, clientId: iss.clientId, clientSecret: { slot: 'a' }, algs: ['RS256'], subjects: [{ sub: 'user-a', name: 'person-a' }] }] };
  const lines = [];
  const users = access && { users: consoleAccess({ load: () => access, business: () => 'demo' }) };
  const sso = await createSso(config, { accounts: ownerAccounts(config), secrets: new Map([['a', iss.clientSecret]]), fetch: op.fetch, log: l => lines.push(l), ...users });
  t.after(() => sso.close());
  const calls = [];
  const decisionWrite = async (verb, args, ctx) => {
    calls.push({ verb, args, ctx });
    return verb === 'decision.preview.console' ? { ...PREVIEW } : { id: args.id, op: 'resolved', choice: args.choice };
  };
  const bus = Object.fromEntries(['inbox', 'tasks', 'agents', 'trail', 'decisions'].map(v => [v, async () => []]));
  const userOptions = access && { userOptions: userOptionsFor({ owner: async () => ({}), send: true, transport: () => async () => [] }) };
  const web = await startServer({ port: 0, board: 'http://127.0.0.1:9', bus, sso, send: async () => ({ id: 'msg-0001' }), decisionWrite, log: l => lines.push(l), ...userOptions, ...server });
  t.after(() => close(web));
  const port = web.address().port;
  const signIn = async (sub = undefined) => {
    const start = await call(port, { path: '/auth/login' });
    assert.equal(start.status, 303);
    const cookie = [start.headers['set-cookie']].flat()[0].split(';')[0];
    const g = op.grant(iss, start.headers.location, { sub });
    const q = new URLSearchParams({ code: g.code, state: new URL(start.headers.location).searchParams.get('state') });
    const r = await call(port, { path: `/auth/callback?${q}`, headers: { cookie } });
    return [r.headers['set-cookie'] ?? []].flat().find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0')).split(';')[0];
  };
  const post = (cookie, path, body, headers = {}) => call(port, { method: 'POST', path, headers: { ...writeHeaders(cookie), ...headers }, body: JSON.stringify(body) });
  return { port, iss, calls, lines, signIn, post };
}
const refused = (r, code) => {
  assert.equal(r.status, DECISION_REFUSALS[code][0], `${code}: ${r.status} ${JSON.stringify(r.body)}`);
  assert.deepEqual(r.body, { error: code, message: DECISION_REFUSALS[code][1] });
};

test('a signed-in owner confirms and answers, with the session\'s provider, issuer and sub as the subject', async t => {
  const env = await setup(t);
  const session = await env.signIn();
  const config = await call(env.port, { path: '/api/config', headers: { cookie: session } });
  assert.equal(config.body.decide, true);
  assert.equal(config.body.sso, true);
  const c = await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' });
  assert.equal(c.status, 200, JSON.stringify(c.body));
  const r = await env.post(session, '/api/decisions/d1/resolve', { choice: 'yes', confirmation: c.body.confirmation });
  assert.equal(r.status, 200, JSON.stringify(r.body));
  assert.deepEqual(r.body, { id: 'd1', op: 'resolved', choice: 'yes' });
  const subject = { provider: 'a', iss: env.iss.issuer, sub: 'user-a' };
  assert.deepEqual(env.calls, [
    { verb: 'decision.preview.console', args: { id: 'd1' }, ctx: { subject } },
    { verb: 'decision.resolve.console', args: { id: 'd1', choice: 'yes', digest: DIGEST }, ctx: { subject, business: 'demo' } },
  ]);
  assert.match(env.lines.at(-1), / decide user="person-a" decision="d1" step=resolve choice="yes"$/);
  assert.equal(env.lines.some(l => l.includes(c.body.confirmation) || l.includes(session.split('=')[1])), false);
});

test('a signed-in browser selects the third ordinary option through HTTP and records exactly one audited resolution and raiser notification, with zero grants', { timeout: 120000 }, async t => {
  const root = mkdtempSync(join(tmpdir(), 'console-797-sso-'));
  const store = new Store(root);
  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
  const business = { id: 'demo', human: 'jason', arbiters: { delivery: 'pm', technical: 'pm' }, roles: { chief: { authority: { withinRole: ['message.send'], crossRole: [] } }, pm: { authority: { withinRole: ['message.send'], crossRole: [] } } } };
  let grants = 0;
  const broker = new Broker({ store, businesses: { demo: business }, hostGrant: { enroll: async () => { grants++; } } });
  const chief = broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi', address: 'chief' });
  broker.request(chief, { verb: 'role.claim' });
  const d = broker.request(chief, { verb: 'decision.raise', args: { action: 'prd.approve', question: 'Choose a product project', blocking: false,
    options: [{ key: 'new/autonomous', text: 'New project — autonomous' }, { key: 'new/guided', text: 'New project — guided' }, { key: 'existing:project', text: 'Add to existing project' }], recommendation: 'new/autonomous', approvalChoice: 'new/autonomous' } });
  const reader = broker.bindReader({ business: 'demo' });
  const bus = views({ call: async (verb, args = {}) => broker.request(reader, { verb, args }) });
  const calls = [];
  const env = await setup(t, { bus, decisionWrite: async (verb, args, ctx) => {
    calls.push({ verb, args, ctx });
    const cap = broker.bindConsole({ business: ctx.business ?? 'demo', human: 'jason', subject: ctx.subject });
    try { return broker.request(cap, { verb, args }); } finally { broker.disconnect(cap); }
  } });
  const session = await env.signIn();
  const b = await browser();
  t.after(() => b.close());
  // Existing CDP harness pattern: fulfill a synthetic HTTPS origin from this scratch listener,
  // carrying the real fake-OP session just established above; no live Console or proxy is used.
  b.on('Fetch.requestPaused', ({ requestId, request: incoming }) => {
    const url = new URL(incoming.url);
    const req = request({ host: '127.0.0.1', port: env.port, path: url.pathname + url.search, method: incoming.method,
      headers: { ...incoming.headers, host: HOST, cookie: session, origin: ORIGIN, 'sec-fetch-site': 'same-origin' } }, res => {
      const parts = [];
      res.on('data', part => parts.push(part));
      res.on('end', () => {
        const responseHeaders = Object.entries(res.headers).filter(([name]) => !['connection', 'keep-alive', 'transfer-encoding'].includes(name))
          .flatMap(([name, value]) => (Array.isArray(value) ? value : [value]).map(value => ({ name, value: String(value) })));
        b.call('Fetch.fulfillRequest', { requestId, responseCode: res.statusCode, responseHeaders, body: Buffer.concat(parts).toString('base64') }).catch(() => {});
      });
    });
    req.on('error', () => b.call('Fetch.failRequest', { requestId, errorReason: 'Failed' }).catch(() => {}));
    req.end(incoming.postData);
  });
  await b.call('Fetch.enable', { patterns: [{ urlPattern: ORIGIN + '/*', requestStage: 'Request' }] });
  await b.navigate(`${ORIGIN}/#/inbox/${d.id}`);
  const wait = expression => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expression})return;await new Promise(r=>setTimeout(r,50))}throw new Error('timed out')})()`);
  await wait('document.querySelector("#bus-view h1")?.textContent.startsWith("Decision") && document.querySelector("#bus-view .s1-opts")');
  assert.equal(await b.evaluate('document.querySelectorAll("#decide-section [data-decide]").length'), 3);
  await b.evaluate('document.querySelector("[data-decide=option-2]").click()');
  await wait('document.querySelector("[data-decide=confirm]")');
  assert.equal(store.get("SELECT count(*) AS n FROM decision_events WHERE decision=? AND op='resolved'", d.id).n, 0);
  await b.evaluate('document.querySelector("[data-decide=confirm]").click(); document.querySelector("[data-decide=confirm]")?.click()');
  await wait('document.querySelector("#decide-status")?.textContent.startsWith("Recorded")');
  assert.match(await b.evaluate('document.querySelector("#decide-status").textContent'), /existing:project.*Add to existing project/);
  assert.doesNotMatch(await b.evaluate('document.querySelector("#decide-status").textContent'), /grant|denial|Approved|Denied/);
  const closes = store.all('SELECT * FROM decision_events WHERE decision=?', d.id);
  assert.equal(closes.length, 1);
  assert.deepEqual([closes[0].op, closes[0].by, closes[0].choice, closes[0].via], ['resolved', 'jason', 'existing:project', 'console']);
  const inputs = store.all("SELECT * FROM events WHERE kind='human.input' AND subject=?", d.id);
  assert.equal(inputs.length, 1);
  const input = JSON.parse(inputs[0].body);
  assert.deepEqual(input.subject, { provider: 'a', iss: env.iss.issuer, sub: 'user-a' });
  assert.equal(input.via, 'console');
  assert.equal(input.decisionSeq, closes[0].seq);
  const notices = store.all("SELECT * FROM messages WHERE decision=? AND class='DECISION' AND from_role='human'", d.id);
  assert.equal(notices.length, 1);
  assert.equal(notices[0].to_role, 'chief');
  assert.equal(notices[0].from_run, 'human-console');
  assert.equal(calls.filter(c => c.verb === 'decision.resolve.console').length, 1);
  assert.equal(grants, 0);
  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE actor_run='grant'").n, 0);
});

test('the listener gates: no session, a cross-origin page, a loopback Host, a GET, and a sign-out between the steps', async t => {
  const env = await setup(t);
  refused(await env.post(null, '/api/decisions/d1/confirmation', { choice: 'yes' }), 'sign-in-required');
  const session = await env.signIn();
  refused(await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' }, { origin: 'https://evil.test' }), 'cross-origin');
  refused(await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' }, { 'sec-fetch-site': 'cross-site' }), 'cross-origin');
  const loop = await call(env.port, { method: 'POST', path: '/api/decisions/d1/confirmation', host: `127.0.0.1:${env.port}`, headers: { cookie: session, 'content-type': 'application/json' }, body: '{"choice":"yes"}' });
  assert.equal(loop.status, 403);
  refused(await call(env.port, { path: '/api/decisions/d1/confirmation', headers: { cookie: session } }), 'method-not-allowed');
  assert.equal(env.calls.length, 0);
  const c = await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' });
  assert.equal(c.status, 200);
  const out = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, origin: ORIGIN, 'sec-fetch-site': 'same-origin' } });
  assert.equal(out.status, 303);
  refused(await env.post(session, '/api/decisions/d1/resolve', { choice: 'yes', confirmation: c.body.confirmation }), 'sign-in-required');
  assert.equal(env.calls.length, 1);
  // A new session can't use the old session's confirmation.
  const again = await env.signIn();
  refused(await env.post(again, '/api/decisions/d1/resolve', { choice: 'yes', confirmation: c.body.confirmation }), 'confirmation-required');
  assert.equal(env.calls.length, 1);
});

test('J16: without a decision transport the routes are read-only and /api/config says no; startServer refuses decide without sso or send', async t => {
  // A decision transport without --send never starts (serve.mjs refuses it). The configs that start
  // without send have no transport either, so they are checked with the missing transport.
  await assert.rejects(setup(t, { send: null }), /need --sso and --send/);
  for (const server of [{ decisionWrite: null }, { decisionWrite: null, send: null }]) {
    const env = await setup(t, server);
    const session = await env.signIn();
    const config = await call(env.port, { path: '/api/config', headers: { cookie: session } });
    assert.equal(config.body.decide, false);
    assert.equal(config.body.sso, true);
    refused(await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' }), 'read-only');
    assert.equal(env.calls.length, 0);
  }
  const write = async () => ({});
  await assert.rejects(startServer({ port: 0, decisionWrite: write, send: async () => ({}) }), /need --sso and --send/);
  await assert.rejects(startServer({ port: 0, tester: true, testerSocket: {}, decisionWrite: write }), /need --sso and --send/);
  const plain = await startServer({ port: 0, board: 'http://127.0.0.1:9' });
  t.after(() => close(plain));
  const port = plain.address().port, host = `127.0.0.1:${port}`;
  const r = await call(port, { method: 'POST', path: '/api/decisions/d1/confirmation', host, headers: { origin: `http://${host}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' }, body: '{"choice":"yes"}' });
  refused(r, 'read-only');
  const config = await call(port, { path: '/api/config', host });
  assert.equal(config.body.decide, false);
  assert.equal('sso' in config.body, false);
});

test('J19: a granted user\'s session gets decide false and the user page config, and a decision POST stops at owner-only', async t => {
  const access = {
    accessVersion: 1, revision: 1,
    users: [{ id: 'alice', home: 'local', subjects: [{ provider: 'a', sub: 'alice-sub' }] }],
    grants: [{ id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator' }],
  };
  const env = await setup(t, {}, access);
  // The listener has a decision transport and --send, and the owner's session decides.
  const owner = await env.signIn();
  assert.equal((await call(env.port, { path: '/api/config', headers: { cookie: owner } })).body.decide, true);
  // The granted user's config says send (its own transport) but never decide.
  const alice = await env.signIn('alice-sub');
  const config = await call(env.port, { path: '/api/config', headers: { cookie: alice } });
  assert.equal(config.status, 200);
  assert.equal(config.body.user, true);
  assert.equal(config.body.send, true);
  assert.equal(config.body.decide, false);
  // userRoute refuses the decision routes before decisionHTTP, so no session reaches the transport.
  for (const step of ['confirmation', 'resolve']) {
    const r = await env.post(alice, `/api/decisions/d1/${step}`, { choice: 'yes', confirmation: 'c'.repeat(64) });
    assert.equal(r.status, 403);
    assert.equal(r.body.error, 'owner-only');
  }
  assert.equal(env.calls.length, 0);
});

test('N4: decision.resolve has no Console route, the --send caller names no decision verb, and consoleCall takes only the two console verbs', async t => {
  const env = await setup(t);
  const session = await env.signIn();
  for (const verb of ['decision.resolve', 'decision.resolve.console', 'decision.preview.console']) {
    for (const method of ['GET', 'POST']) {
      const r = await call(env.port, { method, path: `/api/bus/${verb}`, headers: writeHeaders(session), ...(method === 'POST' ? { body: '{}' } : {}) });
      // A GET finds no such bus read. A POST stops earlier, at the preview's read-only refusal for
      // every write that has no route of its own (row 74).
      if (method === 'GET') assert.equal(r.status, 404, `${method} ${verb}`);
      else assert.deepEqual([r.status, r.body.error], [403, 'read-only'], `${method} ${verb}`);
    }
  }
  assert.equal(env.calls.length, 0);
  const cli = readFileSync(new URL('../src/cli.mjs', import.meta.url), 'utf8');
  assert.doesNotMatch(cli, /['"]decision\./);
  const c = consoleCall({ dataRoot: '/nonexistent', socket: '/nonexistent', business: 'demo', cli: '/nonexistent/console-cli.mjs', timeoutMs: 1000 });
  for (const verb of ['decision.resolve', 'decision.seen', 'message.send', 'inbox']) {
    await assert.rejects(c(verb, { id: 'd1', choice: 'yes' }, { subject: { provider: 'a', iss: 'i', sub: 's' } }), /the Console does not call/);
  }
});