import { describe, expect, test } from 'bun:test'
import type { Record as WispSettings } from '@wispplace/lexicons/types/place/wisp/settings'
import {
	applyCustomHeaders,
	DEFAULT_INDEX_FILES,
	decodeRequestPathname,
	getIndexFiles,
	MAX_GLOB_MATCH_OPERATIONS,
	matchGlob,
	matchGlobWithStats,
} from './request-utils'

const baseSettings = {
	$type: 'place.wisp.settings',
	directoryListing: false,
	cleanUrls: false,
} satisfies WispSettings

function withSettings(overrides: Partial<WispSettings>): WispSettings {
	return { ...baseSettings, ...overrides }
}

const settings = withSettings({
	headers: [
		{ name: 'Service-Worker-Allowed', value: '/' },
		{ name: 'X-Site-Header', value: 'ok' },
	],
})

describe('matchGlob', () => {
	test('supports documented star and question-mark wildcards', () => {
		expect(matchGlob('assets/app.js', '/assets/*.js')).toBe(true)
		expect(matchGlob('/assets/a.js', '/assets/?.js')).toBe(true)
		expect(matchGlob('/assets/app.js', '/assets/?.js')).toBe(false)
	})

	test('treats regex-looking glob characters as literals', () => {
		const literalPath = '/assets/[a-z]+.(js)$'
		expect(matchGlob(literalPath, literalPath)).toBe(true)
		expect(matchGlob('/assets/app.js', literalPath)).toBe(false)
	})

	test('rejects oversized paths and patterns before matching', () => {
		expect(matchGlob('a'.repeat(100_000), '*')).toBe(false)
		expect(matchGlob('/asset.js', '*'.repeat(501))).toBe(false)
	})

	test('keeps normal long suffix globs usable within the budget', () => {
		expect(matchGlob(`${'a'.repeat(4_091)}.html`, '*.html')).toBe(true)
	})

	test('bounds repeated star suffix retries by an explicit operation budget', () => {
		const result = matchGlobWithStats('a'.repeat(4_096), `*${'a'.repeat(498)}b`)

		expect(result.matches).toBe(false)
		expect(result.budgetExhausted).toBe(true)
		expect(result.operations).toBe(MAX_GLOB_MATCH_OPERATIONS)
	})
})

describe('applyCustomHeaders', () => {
	test('blocks origin-wide headers on the shared origin while keeping safe headers', () => {
		const headers: Record<string, string> = {}
		const blockedHeaderNames = [
			'Set-Cookie',
			'Set-Cookie2',
			'Clear-Site-Data',
			'Service-Worker-Allowed',
			'Access-Control-Allow-Origin',
			'Connection',
			'Transfer-Encoding',
			'Content-Length',
			'Content-Encoding',
			'Trailer',
			'Upgrade',
			'Strict-Transport-Security',
			'Alt-Svc',
			'Accept-CH',
			'NEL',
			'Report-To',
			'Origin-Agent-Cluster',
		]
		const blockedHeaders = blockedHeaderNames.map((name) => ({ name, value: 'blocked' }))

		applyCustomHeaders(
			headers,
			'assets/app.js',
			withSettings({
				headers: [
					...blockedHeaders,
					{ name: 'Cache-Control', value: 'public, max-age=60', path: '/assets/*' },
					{ name: 'Content-Security-Policy', value: "default-src 'self'" },
					{ name: 'X-Content-Type-Options', value: 'nosniff' },
				],
			}),
			{ sharedOrigin: true },
		)

		for (const name of blockedHeaderNames) {
			expect(headers[name]).toBeUndefined()
		}
		expect(headers['Cache-Control']).toBe('public, max-age=60')
		expect(headers['Content-Security-Policy']).toBe("default-src 'self'")
		expect(headers['X-Content-Type-Options']).toBe('nosniff')
	})

	test('allows shared-origin-safe path globs and blocks case-insensitive CORS headers', () => {
		const headers: Record<string, string> = {}

		applyCustomHeaders(
			headers,
			'/docs/guide.html',
			withSettings({
				headers: [
					{ name: 'X-Guide', value: 'yes', path: '/docs/*.html' },
					{ name: 'aCcEsS-cOnTrOl-Expose-Headers', value: 'X-Guide' },
				],
			}),
			{ sharedOrigin: true },
		)

		expect(headers['X-Guide']).toBe('yes')
		expect(headers['aCcEsS-cOnTrOl-Expose-Headers']).toBeUndefined()
	})

	test('keeps valid custom-domain headers but rejects unsafe framing headers', () => {
		const headers: Record<string, string> = {}

		applyCustomHeaders(
			headers,
			'sw.js',
			withSettings({
				headers: [
					{ name: 'Set-Cookie', value: 'session=abc; Path=/; Secure' },
					{ name: 'Clear-Site-Data', value: '"cache"' },
					{ name: 'Service-Worker-Allowed', value: '/' },
					{ name: 'Access-Control-Allow-Origin', value: 'https://example.com' },
					{ name: 'Accept-Ranges', value: 'bytes' },
					{ name: 'Content-Length', value: '1' },
					{ name: 'Content-Encoding', value: 'gzip' },
					{ name: 'Content-Range', value: 'bytes 0-0/1' },
					{ name: 'Transfer-Encoding', value: 'chunked' },
				],
			}),
		)

		expect(headers['Set-Cookie']).toBe('session=abc; Path=/; Secure')
		expect(headers['Clear-Site-Data']).toBe('"cache"')
		expect(headers['Service-Worker-Allowed']).toBe('/')
		expect(headers['Access-Control-Allow-Origin']).toBe('https://example.com')
		expect(headers['Accept-Ranges']).toBeUndefined()
		expect(headers['Content-Length']).toBeUndefined()
		expect(headers['Content-Encoding']).toBeUndefined()
		expect(headers['Content-Range']).toBeUndefined()
		expect(headers['Transfer-Encoding']).toBeUndefined()
	})

	test('does not let custom ETags replace representation validators', () => {
		const headers: Record<string, string> = { ETag: '"stored-checksum-identity"' }

		applyCustomHeaders(headers, 'asset.js', withSettings({ headers: [{ name: 'eTaG', value: '"tenant-validator"' }] }))

		expect(headers.ETag).toBe('"stored-checksum-identity"')
		expect(headers.eTaG).toBeUndefined()
		expect(Object.keys(headers).filter((name) => name.toLowerCase() === 'etag')).toHaveLength(1)
	})

	test('rejects invalid names, values, and CRLF injection attempts', () => {
		const headers: Record<string, string> = {}

		applyCustomHeaders(
			headers,
			'index.html',
			withSettings({
				headers: [
					{ name: 'X-Valid', value: 'safe' },
					{ name: 'Bad Header', value: 'ignored' },
					{ name: 'X-Injected\r\nSet-Cookie', value: 'ignored' },
					{ name: 'X-CRLF', value: 'safe\r\nSet-Cookie: session=attacker' },
					{ name: 'X-Nul', value: 'safe\0not-safe' },
					{ name: 'X-Unicode', value: 'safe\u2028not-safe' },
					{ name: 'X-Too-Long', value: 'a'.repeat(1_001) },
				],
			}),
		)

		expect(headers['X-Valid']).toBe('safe')
		expect(headers['Bad Header']).toBeUndefined()
		expect(headers['X-Injected\r\nSet-Cookie']).toBeUndefined()
		expect(headers['X-CRLF']).toBeUndefined()
		expect(headers['X-Nul']).toBeUndefined()
		expect(headers['X-Unicode']).toBeUndefined()
		expect(headers['X-Too-Long']).toBeUndefined()
	})

	test('replaces existing response headers case-insensitively', () => {
		const headers: Record<string, string> = { 'Content-Type': 'text/plain; charset=utf-8' }

		applyCustomHeaders(
			headers,
			'index.html',
			withSettings({ headers: [{ name: 'content-type', value: 'text/html; charset=utf-8' }] }),
		)

		expect(headers['Content-Type']).toBe('text/html; charset=utf-8')
		expect(headers['content-type']).toBeUndefined()
		expect(Object.keys(headers).filter((name) => name.toLowerCase() === 'content-type')).toHaveLength(1)
	})

	test('blocks service worker scope expansion on the shared origin', () => {
		const headers: Record<string, string> = {}

		applyCustomHeaders(headers, 'sw.js', settings, { sharedOrigin: true })

		expect(headers['Service-Worker-Allowed']).toBeUndefined()
		expect(headers['X-Site-Header']).toBe('ok')
	})
})

describe('getIndexFiles', () => {
	test('keeps only normalized relative site paths', () => {
		const indexFiles = getIndexFiles(
			withSettings({
				indexFiles: [
					'nested/index.html',
					'../outside.html',
					'/absolute.html',
					'folder\\index.html',
					'bad\0name.html',
					'https://example.com/index.html',
					'./index.html',
					'folder//index.html',
					'folder/../index.html',
					'a'.repeat(256),
				],
			}),
		)

		expect(indexFiles).toEqual(['nested/index.html'])
	})

	test('uses defaults when no configured index path is safe and bounds the list length', () => {
		expect(getIndexFiles(withSettings({ indexFiles: ['../outside.html'] }))).toEqual(DEFAULT_INDEX_FILES)

		const configuredIndexFiles = Array.from({ length: 11 }, (_, index) => `index-${index}.html`)
		expect(getIndexFiles(withSettings({ indexFiles: configuredIndexFiles }))).toEqual(configuredIndexFiles.slice(0, 10))
	})
})

describe('decodeRequestPathname', () => {
	test('decodes percent-encoded file names before storage lookup', () => {
		expect(decodeRequestPathname('/486x486bb%203.webp')).toBe('/486x486bb 3.webp')
		expect(decodeRequestPathname('/caf%C3%A9/photo.webp')).toBe('/café/photo.webp')
	})

	test('rejects malformed percent encoding', () => {
		expect(decodeRequestPathname('/invalid%2')).toBeNull()
	})

	test('rejects literal and percent-decoded NULs before path sanitization', () => {
		expect(decodeRequestPathname('/unsafe%00path')).toBeNull()
		expect(decodeRequestPathname('/unsafe\0path')).toBeNull()
	})
})