import assert from 'node:assert/strict';
import fs from 'node:fs';
import http from 'node:http';
import os from 'node:os';
import path from 'node:path';
import test from 'node:test';
import { fileURLToPath } from 'node:url';

import { generateKeyPairSync } from 'node:crypto';

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const root = path.resolve(__dirname, '..');

function listen(server) {
  return new Promise((resolve) => {
    server.listen(0, '127.0.0.1', () => {
      resolve(server.address().port);
    });
  });
}

function request(port, method, pathname, { token, body } = {}) {
  return new Promise((resolve, reject) => {
    const headers = { 'Content-Type': 'application/json' };
    if (token) headers.Authorization = `Bearer ${token}`;
    const req = http.request(
      { hostname: '127.0.0.1', port, method, path: pathname, headers },
      (res) => {
        const chunks = [];
        res.on('data', (c) => chunks.push(c));
        res.on('end', () => {
          const raw = Buffer.concat(chunks).toString('utf8');
          resolve({ status: res.statusCode, body: raw ? JSON.parse(raw) : null });
        });
      },
    );
    req.on('error', reject);
    if (body) req.write(JSON.stringify(body));
    req.end();
  });
}

async function makeServer(dataPath, adminToken = 'test-admin') {
  process.env.SKIP_LICENSE_LISTEN = '1';
  const { createServer } = await import('../src/server.mjs');
  const { privateKey } = generateKeyPairSync('ed25519');
  const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
  process.env.DND_LICENSE_DATA_PATH = dataPath;
  const server = createServer({ privateKeyPem: pem, adminToken });
  return { server, adminToken };
}

void test('GET /v1/admin/licenses returns enriched product keys', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.writeFileSync(
    dataPath,
    JSON.stringify({
      productKeys: [
        {
          key: 'TTRPG-TEST-KEY',
          sub: 'lic_test',
          pid: 'dnd_player',
          maxDevices: 2,
          expiresAtSec: 1893456000,
        },
      ],
      revokedSubs: ['lic_test'],
      activations: { lic_test: ['dev1', 'dev2'] },
    }),
  );

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
    assert.equal(res.status, 200);
    assert.equal(res.body.licenses.length, 1);
    assert.equal(res.body.licenses[0].key, 'TTRPG-TEST-KEY');
    assert.equal(res.body.licenses[0].revoked, true);
    assert.deepEqual(res.body.licenses[0].activatedDevices, ['dev1', 'dev2']);
    assert.equal(res.body.licenses[0].activatedCount, 2);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/product-keys creates a new product key', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'POST', '/v1/admin/product-keys', {
      token: adminToken,
      body: { maxDevices: 5, expiresAtSec: 2000000000, pid: 'dnd_player' },
    });
    assert.equal(res.status, 201);
    assert.match(res.body.key, /^TTRPG-/);
    assert.match(res.body.sub, /^lic_/);
    assert.equal(res.body.maxDevices, 5);
    assert.equal(res.body.expiresAtSec, 2000000000);

    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
    assert.equal(data.productKeys.length, 2);
    assert.ok(data.productKeys.some((x) => x.key === res.body.key));
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/revoke by key revokes only that product key', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.writeFileSync(
    dataPath,
    JSON.stringify({
      productKeys: [
        {
          key: 'DND-SHARED-SUB',
          sub: 'lic_shared',
          pid: 'dnd_player',
          maxDevices: 2,
          expiresAtSec: 1893456000,
        },
        {
          key: 'TTRPG-SHARED-SUB',
          sub: 'lic_shared',
          pid: 'dnd_player',
          maxDevices: 2,
          expiresAtSec: 1893456000,
        },
      ],
      revokedSubs: [],
      revokedKeys: [],
      activations: {},
    }),
  );

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const revoke = await request(port, 'POST', '/v1/admin/revoke', {
      token: adminToken,
      body: { key: 'DND-SHARED-SUB' },
    });
    assert.equal(revoke.status, 200);

    const list = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
    assert.equal(list.status, 200);
    const byKey = Object.fromEntries(list.body.licenses.map((x) => [x.key, x.revoked]));
    assert.equal(byKey['DND-SHARED-SUB'], true);
    assert.equal(byKey['TTRPG-SHARED-SUB'], false);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('admin endpoints reject missing token', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'GET', '/v1/admin/licenses');
    assert.equal(res.status, 401);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});