import { chromium, test, expect, BrowserContext } from "@playwright/test";
import { fileURLToPath } from "url";
import { dirname, join } from "path";
import os from "os";
import fs from "fs/promises";
import {
  EXTENSION_PATH,
  UNLOCKED,
  createEntryViaForm,
  lockVault,
  makeContext,
  listSearch,
  openList,
  openSettings,
  setupVault,
  waitForSW,
} from "./helpers/vault";

const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);

// Real vault creation runs Argon2id (≈12s with the recovery confirmation).
test.describe.configure({ timeout: 90_000 });

/** The generator drawer lives inside the new-entry form. */
async function openGenerator(popup: import("@playwright/test").Page) {
  await openList(popup);
  await popup.locator(".peach-new-entry-row").click();
  await popup.locator(".peach-generate-toggle-link").click();
  await expect(popup.locator(".peach-pwgen-compact-output")).toBeVisible({ timeout: 5000 });
}

test.describe("XSS Prevention", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECX01 - entry titles are escaped in DOM", async () => {
    const { popup } = await setupVault(ctx);
    await createEntryViaForm(popup, { title: '<script>alert("xss")</script>', url: "https://xss.com", username: "xss@user.com", password: "xss" });
    // The old assertion demanded the title NOT contain "<script>" in its text —
    // but correct escaping renders it as visible text, so that check failed on
    // correct behaviour. The real invariant is that no script element is
    // created from a title.
    const entryName = popup.locator(".peach-entry-name").first();
    expect(await entryName.textContent()).toContain("alert");
    expect(await popup.locator("script:not([src])").count()).toBe(0);
    await ctx.close();
  });

  test("SECX02 - entry URLs are sanitized before display", async () => {
    const { popup } = await setupVault(ctx);
    await createEntryViaForm(popup, { title: "URLTest", url: 'javascript:alert("xss")', username: "user@url.com", password: "pass" });
    // The URL is displayed as text and nothing in the popup navigates to it.
    // What must never appear is an anchor carrying the javascript: scheme.
    await expect(popup.locator(".peach-domain-value").first()).toBeVisible();
    expect(await popup.locator('a[href^="javascript:"]').count()).toBe(0);
    await ctx.close();
  });

  test("SECX03 - no inline event handlers in entry rendering", async () => {
    const { popup } = await setupVault(ctx);
    await createEntryViaForm(popup, { title: '" onmouseover="alert(1)" "', url: "https://test.com", username: "user@test.com", password: "pass" });
    // Same shape as SECX01: the handler text is rendered as text, so assert no
    // element actually carries an onmouseover attribute.
    const injected = await popup.evaluate(() =>
      document.querySelectorAll("[onmouseover]").length,
    );
    expect(injected).toBe(0);
    await ctx.close();
  });

  test("SECX04 - notes field renders without HTML execution", async () => {
    const { popup } = await setupVault(ctx);
    await createEntryViaForm(popup, { title: "NotesXSS", url: "https://notes.com", username: "notes@test.com", password: "pass", notes: '<img src=x onerror="alert(1)">' });
    // Notes render as a text node, so the markup survives as visible text —
    // the invariant is that no <img> is created and no handler is installed.
    await expect(popup.locator(".peach-note-content")).toContainText("onerror");
    expect(await popup.locator(".peach-note-content img").count()).toBe(0);
    expect(await popup.evaluate(() => document.querySelectorAll("[onerror]").length)).toBe(0);
    await ctx.close();
  });

  test("SECX05 - search input sanitizes query before display", async () => {
    const { popup } = await setupVault(ctx);
    await createEntryViaForm(popup, { title: "SearchTest", url: "https://search.com", username: "search@test.com", password: "pass" });
    await openList(popup);
    const searchInput = listSearch(popup);
    await searchInput.fill('<script>alert("xss")</script>');
    await popup.waitForTimeout(300);
    // An input legitimately holds whatever was typed; what must not happen is
    // the query becoming markup somewhere in the list.
    expect(await searchInput.inputValue()).toContain("<script>");
    expect(await popup.locator("script:not([src])").count()).toBe(0);
    await ctx.close();
  });
});

test.describe("Session Security", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECS01 - session key cleared on lock", async () => {
    const { popup } = await setupVault(ctx);
    await lockVault(popup);
    // IS_UNLOCKED answers { ok: true, data: boolean } — assert the flag, not
    // the envelope (the envelope is always truthy).
    const response = await popup.evaluate(async () => {
      return new Promise<{ ok: boolean; data: boolean }>(resolve => {
        chrome.runtime.sendMessage({ type: "IS_UNLOCKED" }, r => resolve(r));
      });
    });
    expect(response.data).toBe(false);
    await ctx.close();
  });

  test("SECS02 - session does not persist across browser restarts", async () => {
    const userDataDir = join(os.tmpdir(), `peach-sec-restart-${Date.now()}`);
    await fs.mkdir(userDataDir, { recursive: true });
    const launch = () => chromium.launchPersistentContext(userDataDir, {
      executablePath: process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH,
      headless: false,
      args: [`--load-extension=${EXTENSION_PATH}`, `--disable-extensions-except=${EXTENSION_PATH}`],
    });

    const first = await launch();
    const { popup } = await setupVault(first);
    await createEntryViaForm(popup, { title: "PersistSession", url: "https://persist.com", username: "persist@user.com", password: "pass" });
    await first.close();

    const second = await launch();
    const extId = await waitForSW(second);
    const reopened = await second.newPage();
    await reopened.goto(`chrome-extension://${extId}/src/popup/index.html`);
    await expect(reopened.locator("#unlock-password")).toBeVisible({ timeout: 20000 });
    await expect(reopened.locator(UNLOCKED)).toHaveCount(0);
    await second.close();
  });

  test("SECS03 - idle timeout clears session", async () => {
    const { popup } = await setupVault(ctx);
    await openSettings(popup);
    await popup.locator('[data-settings-card-id="protection"]').click();
    await expect(
      popup.locator(".peach-settings-row", { hasText: "Auto-lock after" }),
    ).toHaveCount(1);
    await ctx.close();
  });

  test("SECS04 - master password not stored in memory after unlock", async () => {
    const { popup } = await setupVault(ctx);
    const hasStoredPW = await popup.evaluate(() => {
      return (window as any).__PEACH_MASTER_PASSWORD !== undefined ||
             (window as any).masterPassword !== undefined;
    });
    expect(hasStoredPW).toBeFalsy();
    await ctx.close();
  });

  test("SECS05 - vault data not accessible without unlock", async () => {
    const { popup } = await setupVault(ctx);
    await createEntryViaForm(popup, { title: "LockedRead", url: "https://locked.test", username: "u", password: "p" });
    await lockVault(popup);
    const response = await popup.evaluate(async () => {
      return new Promise<{ ok: boolean; error?: string; data?: unknown }>(resolve => {
        chrome.runtime.sendMessage({ type: "GET_ENTRIES" }, r => resolve(r));
      });
    });
    expect(response.ok).toBe(false);
    expect(response.error).toBe("vault_locked");
    expect(response.data).toBeUndefined();
    await ctx.close();
  });

  test("SECS06 - service worker message validates sender origin", async () => {
    const ctx2 = await makeContext();
    const { popup } = await setupVault(ctx);
    const response = await popup.evaluate(async () => {
      return new Promise(resolve => {
        chrome.runtime.sendMessage({ type: "IS_UNLOCKED" }, r => resolve(r));
      });
    });
    expect(response).toBeDefined();
    await ctx.close();
    await ctx2.close();
  });

  test("SECS07 - no sensitive data in extension localStorage", async () => {
    const { popup } = await setupVault(ctx);
    await popup.waitForTimeout(1000);
    const storage = await popup.evaluate(() => {
      return new Promise(resolve => {
        chrome.storage.local.get(null, r => resolve(r));
      });
    }) as any;
    if (storage && typeof storage === 'object') {
      const hasSensitive = Object.keys(storage).some(k =>
        k.toLowerCase().includes('password') ||
        k.toLowerCase().includes('secret') ||
        k.toLowerCase().includes('key')
      );
      expect(hasSensitive).toBeFalsy();
    }
    await ctx.close();
  });
});

test.describe("CSP Compliance", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SEQC01 - no inline scripts in popup HTML", async () => {
    const extId = await waitForSW(ctx);
    const page = await ctx.newPage();
    await page.goto(`chrome-extension://${extId}/src/popup/index.html`);
    await page.waitForTimeout(2000);
    const scripts = await page.evaluate(() => {
      const html = document.documentElement.innerHTML;
      const scriptMatches = html.match(/<script[^>]*>/gi) || [];
      return scriptMatches.filter(s => !s.includes('src='));
    });
    expect(scripts.length).toBe(0);
    await ctx.close();
  });

  test("SEQC02 - no eval() in content script", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist-chrome", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundEval = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist-chrome", "assets", file), "utf-8");
      if (content.includes("eval(") && !content.includes("new Function")) {
        foundEval = true;
        break;
      }
    }
    expect(foundEval).toBeFalsy();
    await ctx.close();
  });

  test("SEQC03 - CSP meta tag present in HTML", async () => {
    const manifest = JSON.parse(
      await fs.readFile(join(__dirname, "..", "dist-chrome", "manifest.json"), "utf-8"),
    ) as { content_security_policy?: { extension_pages?: string } };
    expect(manifest.content_security_policy?.extension_pages).toContain("script-src 'self'");
    await ctx.close();
  });

});

test.describe("Encryption Verification", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });


  test("SECE02 - extension page supports AES-GCM WebCrypto", async () => {
    const extId = await waitForSW(ctx);
    const page = await ctx.newPage();
    await page.goto(`chrome-extension://${extId}/src/popup/index.html`);
    const plaintext = "Peach WebCrypto";
    const decrypted = await page.evaluate(async (value) => {
      const key = await crypto.subtle.generateKey(
        { name: "AES-GCM", length: 256 },
        true,
        ["encrypt", "decrypt"],
      );
      const iv = crypto.getRandomValues(new Uint8Array(12));
      const ciphertext = await crypto.subtle.encrypt(
        { name: "AES-GCM", iv },
        key,
        new TextEncoder().encode(value),
      );
      const recovered = await crypto.subtle.decrypt(
        { name: "AES-GCM", iv },
        key,
        ciphertext,
      );
      return new TextDecoder().decode(recovered);
    }, plaintext);
    expect(decrypted).toBe(plaintext);
    await ctx.close();
  });



  test("SECE05 - salt generated for each encryption operation", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist-chrome", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let hasSaltGen = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist-chrome", "assets", file), "utf-8");
      if (content.includes("generateSalt") || content.includes("getRandomValues")) {
        hasSaltGen = true;
        break;
      }
    }
    expect(hasSaltGen).toBeTruthy();
    await ctx.close();
  });

  test("SECE06 - key stored in secure memory not plain", async () => {
    const { popup } = await setupVault(ctx);
    await popup.waitForTimeout(1000);
    const keyInDOM = await popup.evaluate(() => {
      const inputs = document.querySelectorAll("input");
      for (const input of inputs) {
        if (input.value && input.value.length > 20 && !input.type) {
          return true;
        }
      }
      return false;
    });
    expect(keyInDOM).toBeFalsy();
    await ctx.close();
  });

  test("SECE07 - export uses PBKDF2 with high iterations", async () => {
    const exportFile = await fs.readdir(join(__dirname, "..", "dist-chrome", "assets")).then(f =>
      f.find(f => f.includes("export") || f.includes("Export"))
    );
    expect(exportFile).toBeDefined();
    const content = await fs.readFile(join(__dirname, "..", "dist-chrome", "assets", exportFile!), "utf-8");
    if (content.includes("PBKDF2")) {
      expect(content).toMatch(/iterations.*[0-9]{4,}|250000/);
    }
    await ctx.close();
  });
});

// SECC03 (clipboard auto-clear) lived here as a 35s wall-clock wait against
// the real OS clipboard. src/background/clipboard.test.ts covers the same
// timer deterministically, so the e2e copy is gone rather than flaky.
test.describe("CSRF Protection", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECC01 - service worker rejects cross-origin messages", async () => {
    const { popup } = await setupVault(ctx);
    const response = await popup.evaluate(async () => {
      return new Promise(resolve => {
        chrome.runtime.sendMessage({ type: "IS_UNLOCKED" }, r => resolve(r));
      });
    });
    expect(response).toBeDefined();
    await ctx.close();
  });

  test("SECC02 - no token exposure in URL parameters", async () => {
    const { popup } = await setupVault(ctx);
    await createEntryViaForm(popup, { title: "URLToken", url: "https://token.com", username: "token@user.com", password: "pass" });
    const url = popup.url();
    expect(url).not.toMatch(/token|key|secret|session/i);
    await ctx.close();
  });

});

test.describe("Breach Detection Security", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECB01 - HIBP API call uses k-anonymity model", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist-chrome", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundHIBP = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist-chrome", "assets", file), "utf-8");
      if (content.includes("hibp") || content.includes("pwned")) {
        foundHIBP = true;
        expect(content).toMatch(/range|hash|k-anon|sha1/i);
        break;
      }
    }
    expect(foundHIBP).toBeTruthy();
    await ctx.close();
  });

  test("SECB02 - breach check does not expose full password", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist-chrome", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundHash = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist-chrome", "assets", file), "utf-8");
      if (content.includes("breach") || content.includes("hibp")) {
        if (content.includes("sha1") || content.includes("SHA-1")) {
          foundHash = true;
          break;
        }
      }
    }
    expect(foundHash).toBeTruthy();
    await ctx.close();
  });

  test("SECB03 - breach status stored securely", async () => {
    const { popup } = await setupVault(ctx);
    await popup.waitForTimeout(500);
    const storage = await popup.evaluate(() => {
      return new Promise(resolve => {
        chrome.storage.local.get(null, r => resolve(r));
      });
    }) as any;
    if (storage) {
      const hasBreachClearText = JSON.stringify(storage).includes("breached");
      expect(hasBreachClearText).toBeFalsy();
    }
    await ctx.close();
  });
});

test.describe("Password Generation Security", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECP01 - generator uses crypto.getRandomValues", async () => {
    const { popup } = await setupVault(ctx);
    await openGenerator(popup);
    const pwd1 = await popup.locator(".peach-pwgen-compact-output").inputValue();
    expect(pwd1.length).toBeGreaterThan(0);
    await ctx.close();
  });

  test("SECP02 - generated passwords not logged", async () => {
    const { popup } = await setupVault(ctx);
    await openGenerator(popup);
    const pwd = await popup.locator(".peach-pwgen-compact-output").inputValue();
    expect(pwd).not.toContain("console.log");
    await ctx.close();
  });

  test("SECP03 - password entropy meets minimum threshold", async () => {
    const { popup } = await setupVault(ctx);
    await openGenerator(popup);
    const slider = popup.locator(".peach-pwgen-slider");
    await slider.fill("32");
    await expect(popup.locator(".peach-pwgen-len-num")).toHaveText("32");
    const pwd = await popup.locator(".peach-pwgen-compact-output").inputValue();
    expect(pwd.length).toBe(32);
    const uniqueChars = new Set(pwd.split("")).size;
    expect(uniqueChars).toBeGreaterThan(10);
    await ctx.close();
  });
});