import { test, expect, BrowserContext } from "@playwright/test";
import { fileURLToPath } from "url";
import { dirname, join } from "path";
import os from "os";
import fs from "fs/promises";

const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const EXTENSION_PATH = join(__dirname, "..", "dist");

async function makeContext() {
  const { chromium } = await import("playwright");
  const userDataDir = join(os.tmpdir(), `peach-sec-${Date.now()}`);
  await fs.mkdir(userDataDir, { recursive: true });
  return chromium.launchPersistentContext(userDataDir, {
    headless: false,
    args: [`--load-extension=${EXTENSION_PATH}`, `--disable-extensions-except=${EXTENSION_PATH}`],
  });
}

async function waitForSW(ctx: BrowserContext, maxWait = 15000): Promise<string> {
  const start = Date.now();
  let sw = ctx.serviceWorkers()[0];
  while (!sw && Date.now() - start < maxWait) {
    await new Promise(r => setTimeout(r, 500));
    sw = ctx.serviceWorkers()[0];
  }
  if (!sw) throw new Error(`No SW after ${maxWait}ms`);
  return new URL(sw.url()).host;
}

async function setupVault(ctx: BrowserContext): Promise<{ popup: any, extId: string }> {
  const extId = await waitForSW(ctx);
  const popup = await ctx.newPage();
  await popup.goto(`chrome-extension://${extId}/src/popup/index.html`);
  await popup.waitForTimeout(3000);
  const pw = popup.locator("#master-password");
  if (await pw.isVisible()) {
    await pw.fill("password123");
    await popup.locator("#confirm-password").fill("password123");
    await popup.getByRole("button", { name: /create vault/i }).click();
    await popup.waitForTimeout(2000);
  }
  return { popup, extId };
}

test.describe("XSS Prevention", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECX01 - entry titles are escaped in DOM", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill('<script>alert("xss")</script>');
    await popup.locator('input[placeholder="domain.com"]').fill("https://xss.com");
    await popup.locator('input[placeholder="username or email"]').fill("xss@user.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("xss");
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    const entryName = popup.locator(".peach-entry-name").first();
    const text = await entryName.textContent();
    expect(text).not.toContain("<script>");
    await ctx.close();
  });

  test("SECX02 - entry URLs are sanitized before display", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill("URLTest");
    await popup.locator('input[placeholder="domain.com"]').fill('javascript:alert("xss")');
    await popup.locator('input[placeholder="username or email"]').fill("user@url.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("pass");
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    const domain = popup.locator(".peach-domain-value").first();
    const text = await domain.textContent().catch(() => "");
    expect(text).not.toContain("javascript:");
    await ctx.close();
  });

  test("SECX03 - no inline event handlers in entry rendering", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill('" onmouseover="alert(1)" "');
    await popup.locator('input[placeholder="domain.com"]').fill("https://test.com");
    await popup.locator('input[placeholder="username or email"]').fill("user@test.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("pass");
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    const entry = popup.locator(".peach-entry-name").first();
    const html = await entry.innerHTML();
    expect(html).not.toContain("onmouseover");
    await ctx.close();
  });

  test("SECX04 - notes field renders without HTML execution", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill("NotesXSS");
    await popup.locator('input[placeholder="domain.com"]').fill("https://notes.com");
    await popup.locator('input[placeholder="username or email"]').fill("notes@test.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("pass");
    const notes = popup.locator("textarea");
    await notes.fill('<img src=x onerror="alert(1)">');
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    await popup.locator(".peach-entry-name-button").first().click();
    await popup.waitForTimeout(500);
    const noteContent = popup.locator(".peach-note-content").first();
    const html = await noteContent.innerHTML().catch(() => "");
    expect(html).not.toContain("onerror");
    await ctx.close();
  });

  test("SECX05 - search input sanitizes query before display", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill("SearchTest");
    await popup.locator('input[placeholder="domain.com"]').fill("https://search.com");
    await popup.locator('input[placeholder="username or email"]').fill("search@test.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("pass");
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    const searchInput = popup.locator(".peach-search-input, .peach-search-input-list").first();
    await searchInput.click();
    await searchInput.fill('<script>alert("xss")</script>');
    await popup.waitForTimeout(300);
    const value = await searchInput.inputValue();
    expect(value).not.toContain("<script>");
    await ctx.close();
  });
});

test.describe("Session Security", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECS01 - session key cleared on lock", async () => {
    const { popup } = await setupVault(ctx);
    await popup.waitForTimeout(500);
    const lockBtn = popup.locator(".peach-lock-btn[aria-label='Lock vault']");
    await lockBtn.click();
    await popup.waitForTimeout(1500);
    const response = await popup.evaluate(async () => {
      return new Promise(resolve => {
        chrome.runtime.sendMessage({ type: "IS_UNLOCKED" }, r => resolve(r));
      });
    });
    expect(response).toBeFalsy();
    await ctx.close();
  });

  test("SECS02 - session does not persist across browser restarts", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill("PersistSession");
    await popup.locator('input[placeholder="domain.com"]').fill("https://persist.com");
    await popup.locator('input[placeholder="username or email"]').fill("persist@user.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("pass");
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    const newPage = await ctx.newPage();
    const extId = await waitForSW(ctx);
    await newPage.goto(`chrome-extension://${extId}/src/popup/index.html`);
    await newPage.waitForTimeout(2000);
    const pwField = newPage.locator("#master-password");
    const isVisible = await pwField.isVisible({ timeout: 3000 }).catch(() => false);
    expect(isVisible).toBe(true);
    await ctx.close();
  });

  test("SECS03 - idle timeout clears session", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator(".peach-icon-btn[aria-label='Settings']").click();
    await popup.waitForTimeout(300);
    const autoLock = popup.locator("text=auto-lock").first();
    await expect(autoLock).toBeVisible();
    await ctx.close();
  });

  test("SECS04 - master password not stored in memory after unlock", async () => {
    const { popup } = await setupVault(ctx);
    const hasStoredPW = await popup.evaluate(() => {
      return (window as any).__PEACH_MASTER_PASSWORD !== undefined ||
             (window as any).masterPassword !== undefined;
    });
    expect(hasStoredPW).toBeFalsy();
    await ctx.close();
  });

  test("SECS05 - vault data not accessible without unlock", async () => {
    const { popup: _popup } = await setupVault(ctx);
    const newPage = await ctx.newPage();
    const extId = await waitForSW(ctx);
    await newPage.goto(`chrome-extension://${extId}/src/popup/index.html`);
    await newPage.waitForTimeout(2000);
    const response = await newPage.evaluate(async () => {
      return new Promise(resolve => {
        chrome.runtime.sendMessage({ type: "GET_ENTRIES" }, r => resolve(r));
      });
    });
    expect(response).toBeFalsy();
    await ctx.close();
  });

  test("SECS06 - service worker message validates sender origin", async () => {
    const ctx2 = await makeContext();
    const { popup } = await setupVault(ctx);
    const response = await popup.evaluate(async () => {
      return new Promise(resolve => {
        chrome.runtime.sendMessage({ type: "IS_UNLOCKED" }, r => resolve(r));
      });
    });
    expect(response).toBeDefined();
    await ctx.close();
    await ctx2.close();
  });

  test("SECS07 - no sensitive data in extension localStorage", async () => {
    const { popup } = await setupVault(ctx);
    await popup.waitForTimeout(1000);
    const storage = await popup.evaluate(() => {
      return new Promise(resolve => {
        chrome.storage.local.get(null, r => resolve(r));
      });
    }) as any;
    if (storage && typeof storage === 'object') {
      const hasSensitive = Object.keys(storage).some(k =>
        k.toLowerCase().includes('password') ||
        k.toLowerCase().includes('secret') ||
        k.toLowerCase().includes('key')
      );
      expect(hasSensitive).toBeFalsy();
    }
    await ctx.close();
  });
});

test.describe("CSP Compliance", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SEQC01 - no inline scripts in popup HTML", async () => {
    const extId = await waitForSW(ctx);
    const page = await ctx.newPage();
    await page.goto(`chrome-extension://${extId}/src/popup/index.html`);
    await page.waitForTimeout(2000);
    const scripts = await page.evaluate(() => {
      const html = document.documentElement.innerHTML;
      const scriptMatches = html.match(/<script[^>]*>/gi) || [];
      return scriptMatches.filter(s => !s.includes('src='));
    });
    expect(scripts.length).toBe(0);
    await ctx.close();
  });

  test("SEQC02 - no eval() in content script", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundEval = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist", "assets", file), "utf-8");
      if (content.includes("eval(") && !content.includes("new Function")) {
        foundEval = true;
        break;
      }
    }
    expect(foundEval).toBeFalsy();
    await ctx.close();
  });

  test("SEQC03 - CSP meta tag present in HTML", async () => {
    const html = await fs.readFile(join(__dirname, "..", "dist", "src", "popup", "index.html"), "utf-8");
    const hasCSP = html.includes("Content-Security-Policy") || html.includes("csp");
    expect(hasCSP).toBeTruthy();
    await ctx.close();
  });

  test("SEQC04 - no remote script loading in content script", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundRemote = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist", "assets", file), "utf-8");
      if (content.match(/https?:\/\/[^"']+\.js/)) {
        foundRemote = true;
        break;
      }
    }
    expect(foundRemote).toBeFalsy();
    await ctx.close();
  });
});

test.describe("Encryption Verification", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECE01 - Argon2id parameters documented in code", async () => {
    const argon2File = await fs.readdir(join(__dirname, "..", "dist", "assets")).then(f =>
      f.find(f => f.includes("argon") || f.includes("crypto"))
    );
    expect(argon2File).toBeDefined();
    const content = await fs.readFile(join(__dirname, "..", "dist", "assets", argon2File!), "utf-8");
    expect(content).toMatch(/65536|3|4|argon/);
    await ctx.close();
  });

  test("SECE02 - AES-GCM used for vault encryption", async () => {
    const aesFiles = await fs.readdir(join(__dirname, "..", "dist", "assets")).then(f =>
      f.filter(f => f.includes("aes"))
    );
    expect(aesFiles.length).toBeGreaterThan(0);
    const content = await fs.readFile(join(__dirname, "..", "dist", "assets", aesFiles[0]), "utf-8");
    expect(content).toMatch(/AES-GCM|aes-gcm|AESGCM|AES.*GCM/);
    await ctx.close();
  });

  test("SECE03 - no ECB mode in encryption", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundECB = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist", "assets", file), "utf-8");
      if (content.includes("ECB") && !content.includes("// ECB")) {
        foundECB = true;
        break;
      }
    }
    expect(foundECB).toBeFalsy();
    await ctx.close();
  });

  test("SECE04 - crypto.getRandomValues used for all random", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundMathRandom = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist", "assets", file), "utf-8");
      const mathRandMatches = content.match(/Math\.random\(\)/g) || [];
      const cryptoRandMatches = content.match(/crypto\.getRandomValues\(/g) || [];
      if (mathRandMatches.length > cryptoRandMatches.length) {
        foundMathRandom = true;
        break;
      }
    }
    expect(foundMathRandom).toBeFalsy();
    await ctx.close();
  });

  test("SECE05 - salt generated for each encryption operation", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let hasSaltGen = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist", "assets", file), "utf-8");
      if (content.includes("generateSalt") || content.includes("getRandomValues")) {
        hasSaltGen = true;
        break;
      }
    }
    expect(hasSaltGen).toBeTruthy();
    await ctx.close();
  });

  test("SECE06 - key stored in secure memory not plain", async () => {
    const { popup } = await setupVault(ctx);
    await popup.waitForTimeout(1000);
    const keyInDOM = await popup.evaluate(() => {
      const inputs = document.querySelectorAll("input");
      for (const input of inputs) {
        if (input.value && input.value.length > 20 && !input.type) {
          return true;
        }
      }
      return false;
    });
    expect(keyInDOM).toBeFalsy();
    await ctx.close();
  });

  test("SECE07 - export uses PBKDF2 with high iterations", async () => {
    const exportFile = await fs.readdir(join(__dirname, "..", "dist", "assets")).then(f =>
      f.find(f => f.includes("export") || f.includes("Export"))
    );
    expect(exportFile).toBeDefined();
    const content = await fs.readFile(join(__dirname, "..", "dist", "assets", exportFile!), "utf-8");
    if (content.includes("PBKDF2")) {
      expect(content).toMatch(/iterations.*[0-9]{4,}|250000/);
    }
    await ctx.close();
  });
});

test.describe("CSRF Protection", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECC01 - service worker rejects cross-origin messages", async () => {
    const { popup } = await setupVault(ctx);
    const response = await popup.evaluate(async () => {
      return new Promise(resolve => {
        chrome.runtime.sendMessage({ type: "IS_UNLOCKED" }, r => resolve(r));
      });
    });
    expect(response).toBeDefined();
    await ctx.close();
  });

  test("SECC02 - no token exposure in URL parameters", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill("URLToken");
    await popup.locator('input[placeholder="domain.com"]').fill("https://token.com");
    await popup.locator('input[placeholder="username or email"]').fill("token@user.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("pass");
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    const url = popup.url();
    expect(url).not.toMatch(/token|key|secret|session/i);
    await ctx.close();
  });

  test("SECC03 - clipboard cleared after copy operation", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator('input[placeholder="search vault..."]').click();
    await popup.getByRole("button", { name: /new entry/i }).click();
    await popup.locator(".peach-new-name-input").fill("ClipboardSec");
    await popup.locator('input[placeholder="domain.com"]').fill("https://clip.com");
    await popup.locator('input[placeholder="username or email"]').fill("clip@user.com");
    await popup.locator(".peach-new-field-input[placeholder='password']").fill("clipsecret");
    await popup.getByRole("button", { name: /create/i }).click();
    await popup.waitForTimeout(1500);
    await popup.locator(".peach-entry-name-button").first().click();
    await popup.waitForTimeout(500);
    const copyBtn = popup.locator(".peach-copy-btn").first();
    if (await copyBtn.isVisible({ timeout: 2000 }).catch(() => false)) {
      await copyBtn.click();
      await popup.waitForTimeout(35000);
      const clipboard = await popup.evaluate(() => navigator.clipboard.readText());
      expect(clipboard).not.toBe("clipsecret");
    }
    await ctx.close();
  });
});

test.describe("Breach Detection Security", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECB01 - HIBP API call uses k-anonymity model", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundHIBP = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist", "assets", file), "utf-8");
      if (content.includes("hibp") || content.includes("pwned")) {
        foundHIBP = true;
        expect(content).toMatch(/range|hash|k-anon|sha1/i);
        break;
      }
    }
    expect(foundHIBP).toBeTruthy();
    await ctx.close();
  });

  test("SECB02 - breach check does not expose full password", async () => {
    const distFiles = await fs.readdir(join(__dirname, "..", "dist", "assets"));
    const jsFiles = distFiles.filter(f => f.endsWith(".js"));
    let foundHash = false;
    for (const file of jsFiles) {
      const content = await fs.readFile(join(__dirname, "..", "dist", "assets", file), "utf-8");
      if (content.includes("breach") || content.includes("hibp")) {
        if (content.includes("sha1") || content.includes("SHA-1")) {
          foundHash = true;
          break;
        }
      }
    }
    expect(foundHash).toBeTruthy();
    await ctx.close();
  });

  test("SECB03 - breach status stored securely", async () => {
    const { popup } = await setupVault(ctx);
    await popup.waitForTimeout(500);
    const storage = await popup.evaluate(() => {
      return new Promise(resolve => {
        chrome.storage.local.get(null, r => resolve(r));
      });
    }) as any;
    if (storage) {
      const hasBreachClearText = JSON.stringify(storage).includes("breached");
      expect(hasBreachClearText).toBeFalsy();
    }
    await ctx.close();
  });
});

test.describe("Password Generation Security", () => {
  let ctx: BrowserContext;
  test.afterEach(async () => { await ctx.close(); });
  test.beforeEach(async () => { ctx = await makeContext(); });

  test("SECP01 - generator uses crypto.getRandomValues", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator(".peach-icon-btn[aria-label='Settings']").click();
    await popup.waitForTimeout(300);
    await popup.getByRole("button", { name: /password generator/i }).click();
    await popup.waitForTimeout(500);
    const pwd1 = await popup.locator(".peach-pwgen-output").textContent();
    expect(pwd1?.length).toBeGreaterThan(0);
    await ctx.close();
  });

  test("SECP02 - generated passwords not logged", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator(".peach-icon-btn[aria-label='Settings']").click();
    await popup.waitForTimeout(300);
    await popup.getByRole("button", { name: /password generator/i }).click();
    await popup.waitForTimeout(500);
    const pwd = await popup.locator(".peach-pwgen-output").textContent();
    expect(pwd).not.toContain("console.log");
    await ctx.close();
  });

  test("SECP03 - password entropy meets minimum threshold", async () => {
    const { popup } = await setupVault(ctx);
    await popup.locator(".peach-icon-btn[aria-label='Settings']").click();
    await popup.waitForTimeout(300);
    await popup.getByRole("button", { name: /password generator/i }).click();
    await popup.waitForTimeout(500);
    const slider = popup.locator(".peach-pwgen-slider");
    await slider.fill("32");
    await popup.waitForTimeout(300);
    const pwd = await popup.locator(".peach-pwgen-output").textContent();
    expect(pwd?.length).toBe(32);
    const uniqueChars = new Set(pwd?.split("")).size;
    expect(uniqueChars).toBeGreaterThan(10);
    await ctx.close();
  });
});