import test from 'node:test';
import assert from 'node:assert/strict';
import http from 'node:http';
import { createHash } from 'node:crypto';
import { ManagementClient } from '../src/client.mjs';
const id = s => createHash('sha256').update(s).digest('hex').slice(0, 12);
const raw = { api_key: 'msk-made-up-client-canary', source: 'made-up-upstream-canary', failed: true,
  fail: { status_code: 503, body: 'private-body' }, tokens: { input_tokens: 7, output_tokens: 2, cache_creation_tokens: 3, cache_read_tokens: 4 },
  user_agent: 'private-agent', request_id: 'private-request' };
async function fixture(t, reply = () => [raw]) {
  const calls = [], receipts = [];
  const server = http.createServer((req, res) => {
    calls.push([req.method, req.url, req.headers.authorization]);
    const answer = reply(); res.writeHead(answer.status ?? 200, answer.headers ?? {});
    res.end(JSON.stringify(answer.body ?? answer));
  });
  await new Promise(r => server.listen(0, '127.0.0.1', r));
  t.after(() => new Promise(r => server.close(r)));
  return { calls, receipts, client: new ManagementClient({ baseUrl: `http://127.0.0.1:${server.address().port}`, key: 'fake-management', receipt: e => receipts.push(e) }) };
}
test('P5 queue read uses actual bounded fixed management GET and immediately drops client and upstream values', async t => {
  const f = await fixture(t);
  const events = await f.client.readUsageQueue();
  assert.deepEqual(events, [{ keyId: id(raw.api_key), accountId: id(raw.source), managed: true, failed: true, statusCode: 503,
    input: 7, output: 2, cacheWrite: 3, cacheRead: 4 }]);
  assert.deepEqual(f.calls, [['GET', '/v8/management/observability/usage/queue?count=100', 'Bearer fake-management']]);
  assert.deepEqual(f.receipts, [{ call: 'GET /v8/management/observability/usage/queue', status: 200, keyIds: [] }]);
  for (const secret of [raw.api_key, raw.source, 'private-body', 'private-agent', 'private-request', 'fake-management'])
    assert.equal(JSON.stringify([events, f.receipts]).includes(secret), false);
});
for (const [name, reply, code] of [
  ['bad envelope', () => ({ events: [raw] }), 'proxy-client-response'],
  ['over count', () => Array(101).fill(raw), 'proxy-client-response'],
  ['missing key', () => [{ ...raw, api_key: null }], 'proxy-client-response'],
  ['bad counts', () => [{ ...raw, tokens: { input_tokens: -1 } }], 'proxy-client-response'],
  ['redirect', () => ({ status: 302, headers: { location: 'http://127.0.0.1:8317/' }, body: raw }), 'proxy-client-redirect'],
  ['refusal', () => ({ status: 401, body: raw }), 'proxy-client-refused'],
]) test(`P5 ${name} refuses safely with no retry`, async t => {
  const f = await fixture(t, reply);
  await assert.rejects(f.client.readUsageQueue(), e => e.code === code && !e.message.includes(raw.source));
  assert.equal(f.calls.length, 1);
  assert.equal(JSON.stringify(f.receipts).includes(raw.api_key), false);
  assert.equal(JSON.stringify(f.receipts).includes(raw.source), false);
});

test('P5 malformed event after a valid event rejects the entire queue before any credential can escape',async t=>{
 const f=await fixture(t,()=>[raw,{...raw,source:'another-upstream-canary',tokens:{input_tokens:'bad-count'}}]);
 await assert.rejects(f.client.readUsageQueue(),{code:'proxy-client-response'});
 for(const secret of [raw.api_key,raw.source,'another-upstream-canary'])assert.equal(JSON.stringify(f.receipts).includes(secret),false);
});