import { describe, expect, test } from 'bun:test';
import {
  type CertInfo,
  type ProbeTransport,
  type Vantage,
  VantageAssertionError,
  VantageProbe,
} from './vantage';

/**
 * A scriptable fake transport: the verbs are pure orchestration over this boundary,
 * so we can drive every assertion path without Docker (Rule 2.3).
 */
function fakeTransport(overrides: Partial<ProbeTransport> = {}): ProbeTransport {
  return {
    resolve: async () => ({ ips: [] }),
    tcpConnect: async () => ({ connected: false }),
    ping: async () => ({ alive: false }),
    httpsRequest: async () => ({ status: 200, body: '', cert: realCert() }),
    inspectResolution: async () => ({ resolvConf: '', hostsLines: [] }),
    ...overrides,
  };
}

function realCert(over: Partial<CertInfo> = {}): CertInfo {
  return {
    cn: 'www.example.com',
    issuer: 'Pebble Intermediate CA',
    subjectAltNames: ['www.example.com'],
    selfSigned: false,
    ...over,
  };
}

const LAN: Vantage = 'internalDevice';

describe('resolveFrom', () => {
  test('defaults method to system, passes through ips', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
    );
    const r = await probe.resolveFrom({ from: LAN, name: 'www.example.com' });
    expect(r.method).toBe('system');
    expect(r.ips).toEqual(['10.226.1.253']);
  });
});

describe('assertResolves / assertNxdomain', () => {
  test('assertResolves throws on empty answer', async () => {
    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: [] }) }));
    await expect(probe.assertResolves({ from: LAN, name: 'gone.example.com' })).rejects.toThrow(
      VantageAssertionError,
    );
  });
  test('assertNxdomain throws when a public vantage CAN see an internal-only name', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.20.5'] }) }),
    );
    await expect(
      probe.assertNxdomain({ from: 'publicInternet', name: 'authentik.internal' }),
    ).rejects.toThrow(/expected NXDOMAIN/);
  });
});

describe('assertResolvesInZone — the killer verb', () => {
  test('ISS-0101: www at caddy DMZ container IP FAILS from internalDevice', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.10.10'] }) }),
    );
    await expect(
      probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' }),
    ).rejects.toThrow(/ISS-0101/);
  });

  test('www at the firewall natIp PASSES from internalDevice (the right answer)', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
    );
    const r = await probe.assertResolvesInZone({
      from: LAN,
      name: 'www.example.com',
      zone: 'internal',
    });
    expect(r.ips).toEqual(['10.226.1.253']);
  });

  test('public vantage expecting a public answer passes; a leaked zone IP fails', async () => {
    const ok = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['203.0.113.100'] }) }),
    );
    await ok.assertResolvesInZone({
      from: 'publicInternet',
      name: 'www.example.com',
      zone: 'public',
    });

    const leaked = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
    );
    await expect(
      leaked.assertResolvesInZone({
        from: 'publicInternet',
        name: 'www.example.com',
        zone: 'public',
      }),
    ).rejects.toThrow(VantageAssertionError);
  });

  test('any one leaked IP among several fails the whole answer', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253', '10.226.30.9'] }) }),
    );
    await expect(
      probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' }),
    ).rejects.toThrow(/10\.226\.30\.9/);
  });
});

describe('assertResolvesTo — exact-IP DNS correctness', () => {
  test('passes when the resolver returns the expected IP (via a specific server)', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.53'] }) }),
    );
    const r = await probe.assertResolvesTo({
      from: 'internalDevice',
      name: 'host.infra.example.com',
      method: 'dns',
      server: '10.226.1.10',
      expected: '10.226.1.53',
    });
    expect(r.ips).toEqual(['10.226.1.53']);
  });

  test('fails (naming the server) when the expected IP is absent', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['10.226.10.99'] }) }),
    );
    await expect(
      probe.assertResolvesTo({
        from: 'internalDevice',
        name: 'host.infra.example.com',
        method: 'dns',
        server: '10.226.1.10',
        expected: '10.226.1.53',
      }),
    ).rejects.toThrow(/via 10\.226\.1\.10.*expected to include \[10\.226\.1\.53\]/);
  });

  test('accepts an array of expected IPs (all must be present)', async () => {
    const probe = new VantageProbe(
      fakeTransport({ resolve: async () => ({ ips: ['1.2.3.4', '5.6.7.8'] }) }),
    );
    await probe.assertResolvesTo({
      from: 'publicInternet',
      name: 'x',
      expected: ['1.2.3.4', '5.6.7.8'],
    });
    await expect(
      probe.assertResolvesTo({
        from: 'publicInternet',
        name: 'x',
        expected: ['1.2.3.4', '9.9.9.9'],
      }),
    ).rejects.toThrow(/9\.9\.9\.9/);
  });
});

describe('reachability + isolation (§D6)', () => {
  test('assertReachable throws when the connection fails (ISS-0111 git-ssh:2222)', async () => {
    const probe = new VantageProbe(
      fakeTransport({ tcpConnect: async () => ({ connected: false, detail: 'timeout' }) }),
    );
    await expect(
      probe.assertReachable({ from: LAN, host: 'git-ssh.example.com', port: 2222 }),
    ).rejects.toThrow(/timeout/);
  });
  test('assertUnreachable throws when isolation is violated', async () => {
    const probe = new VantageProbe(
      fakeTransport({ tcpConnect: async () => ({ connected: true }) }),
    );
    await expect(
      probe.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 }),
    ).rejects.toThrow(/zone isolation/);
  });
  test('the reachable/unreachable happy paths do not throw', async () => {
    const reachable = new VantageProbe(
      fakeTransport({ tcpConnect: async () => ({ connected: true }) }),
    );
    await reachable.assertReachable({ from: LAN, host: '10.226.1.253', port: 443 });
    const blocked = new VantageProbe(
      fakeTransport({ tcpConnect: async () => ({ connected: false }) }),
    );
    await blocked.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 });
  });
});

describe('assertHttps — cert provenance', () => {
  test('self-signed cert is rejected (catches --insecure / skip-cert cheats)', async () => {
    const probe = new VantageProbe(
      fakeTransport({
        httpsRequest: async () => ({
          status: 200,
          body: 'ok',
          cert: realCert({ selfSigned: true }),
        }),
      }),
    );
    await expect(probe.assertHttps({ from: LAN, url: 'https://www.example.com' })).rejects.toThrow(
      /self-signed/,
    );
  });
  test('wrong CA issuer is rejected', async () => {
    const probe = new VantageProbe(fakeTransport());
    await expect(
      probe.assertHttps({ from: LAN, url: 'https://www.example.com', expectCA: "Let's Encrypt" }),
    ).rejects.toThrow(/issuer/);
  });
  test('matching CN + CA + status passes', async () => {
    const probe = new VantageProbe(fakeTransport());
    const r = await probe.assertHttps({
      from: LAN,
      url: 'https://www.example.com',
      expectStatus: 200,
      expectCN: 'www.example.com',
      expectCA: 'Pebble',
    });
    expect(r.status).toBe(200);
    expect(r.cert.cn).toBe('www.example.com');
  });
  test('unexpected status is rejected', async () => {
    const probe = new VantageProbe(
      fakeTransport({ httpsRequest: async () => ({ status: 502, body: '', cert: realCert() }) }),
    );
    await expect(
      probe.assertHttps({ from: LAN, url: 'https://www.example.com', expectStatus: 200 }),
    ).rejects.toThrow(/status 502/);
  });
});

describe('inspectResolution', () => {
  test('returns the vantage resolv.conf + matching hosts lines (host-pin check, ISS-0095)', async () => {
    const probe = new VantageProbe(
      fakeTransport({
        inspectResolution: async () => ({
          resolvConf: 'nameserver 10.226.1.253',
          hostsLines: ['10.226.10.10 auth.example.com'],
        }),
      }),
    );
    const r = await probe.inspectResolution({ from: 'dmzSystem', name: 'auth.example.com' });
    expect(r.hostsLines).toContain('10.226.10.10 auth.example.com');
    expect(r.resolvConf).toContain('10.226.1.253');
  });
});