import * as jose from 'jose'

import * as Access from './Access.js'

const teamDomain = 'https://tempo.cloudflareaccess.com'
const certsUrl = `${teamDomain}/cdn-cgi/access/certs`
const kid = 'test-key-1'

/** Generates an ES256 keypair and the JWKS the team domain would serve. */
async function makeKeys() {
  const { privateKey, publicKey } = await jose.generateKeyPair('ES256', { extractable: true })
  const jwk = { ...(await jose.exportJWK(publicKey)), kid }
  return { jwks: { keys: [jwk] }, privateKey }
}

/** Signs an Access-style JWT with the given claims/overrides. */
async function sign(
  privateKey: jose.CryptoKey,
  options: {
    audience?: string | undefined
    email?: string | undefined
    expirationTime?: string | number | undefined
    issuer?: string | undefined
  } = {},
) {
  const payload = options.email === undefined ? {} : { email: options.email }
  return new jose.SignJWT(payload)
    .setProtectedHeader({ alg: 'ES256', kid })
    .setIssuer(options.issuer ?? teamDomain)
    .setAudience(options.audience ?? 'test-access-aud-tag')
    .setIssuedAt()
    .setExpirationTime(options.expirationTime ?? '1h')
    .sign(privateKey)
}

describe('cloudflareAccess', () => {
  let privateKey: jose.CryptoKey
  let jwks: { keys: readonly unknown[] }

  beforeEach(async () => {
    ;({ jwks, privateKey } = await makeKeys())
    // Serve the public JWKS from the team-domain certs URL.
    vi.stubGlobal(
      'fetch',
      vi.fn(async (input: string | URL | Request) => {
        const url =
          typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
        if (url === certsUrl) return new Response(JSON.stringify(jwks))
        throw new Error(`unexpected fetch: ${url}`)
      }),
    )
  })

  afterEach(() => {
    vi.unstubAllGlobals()
  })

  test('valid JWT in header → identity', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const token = await sign(privateKey, { email: 'admin@tempo.xyz' })
    const request = new Request('https://admin.tempo.xyz/api-keys', {
      headers: { 'cf-access-jwt-assertion': token },
    })
    expect(await identify(request)).toEqual({ email: 'admin@tempo.xyz' })
  })

  test('valid JWT in CF_Authorization cookie → identity', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const token = await sign(privateKey, { email: 'admin@tempo.xyz' })
    const request = new Request('https://admin.tempo.xyz/api-keys', {
      headers: { cookie: `foo=bar; CF_Authorization=${token}` },
    })
    expect(await identify(request)).toEqual({ email: 'admin@tempo.xyz' })
  })

  test('missing assertion → null', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const request = new Request('https://admin.tempo.xyz/api-keys')
    expect(await identify(request)).toBeNull()
  })

  test('any audience accepted (issuer still enforced)', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const token = await sign(privateKey, { audience: 'some-other-aud', email: 'admin@tempo.xyz' })
    const request = new Request('https://admin.tempo.xyz/api-keys', {
      headers: { 'cf-access-jwt-assertion': token },
    })
    expect(await identify(request)).toEqual({ email: 'admin@tempo.xyz' })
  })

  test('wrong issuer → null', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const token = await sign(privateKey, {
      email: 'admin@tempo.xyz',
      issuer: 'https://evil.cloudflareaccess.com',
    })
    const request = new Request('https://admin.tempo.xyz/api-keys', {
      headers: { 'cf-access-jwt-assertion': token },
    })
    expect(await identify(request)).toBeNull()
  })

  test('expired JWT → null', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const token = await sign(privateKey, { email: 'admin@tempo.xyz', expirationTime: '-1h' })
    const request = new Request('https://admin.tempo.xyz/api-keys', {
      headers: { 'cf-access-jwt-assertion': token },
    })
    expect(await identify(request)).toBeNull()
  })

  test('valid signature but no email claim → null', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const token = await sign(privateKey)
    const request = new Request('https://admin.tempo.xyz/api-keys', {
      headers: { 'cf-access-jwt-assertion': token },
    })
    expect(await identify(request)).toBeNull()
  })

  test('signature from an unknown key → null', async () => {
    const identify = Access.cloudflareAccess({ teamDomain })
    const other = await makeKeys()
    const token = await sign(other.privateKey, { email: 'admin@tempo.xyz' })
    const request = new Request('https://admin.tempo.xyz/api-keys', {
      headers: { 'cf-access-jwt-assertion': token },
    })
    expect(await identify(request)).toBeNull()
  })
})