import assert from "node:assert/strict";
import { execFileSync, spawnSync } from "node:child_process";
import { chmod, mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { pathToFileURL } from "node:url";
import test from "node:test";

const verifier = new URL("../scripts/verify-git-package.mjs", import.meta.url);

function isolatedGitEnvironment() {
  const environment = { ...process.env };
  delete environment.GIT_INDEX_FILE;
  return environment;
}

function runVerifier(args: string[], cache?: string) {
  const environment = isolatedGitEnvironment();
  if (cache !== undefined) environment.CODEX_APP_SERVER_BRIDGE_NPM_CACHE = cache;
  return spawnSync(process.execPath, [verifier.pathname, ...args], {
    encoding: "utf8",
    env: environment,
    timeout: 60_000,
  });
}

test("Git-package verifier requires exactly one immutable package spec without leaking credentials", () => {
  const secret = "credential-must-not-appear";
  const invalid = [
    [],
    ["git+https://git.example.invalid/team/codex-app-server-bridge.git#main"],
    [`git+https://user:${secret}@git.example.invalid/team/codex-app-server-bridge.git#main`],
    ["git+https://git.example.invalid/team/codex-app-server-bridge.git#abc123"],
    [
      "git+https://git.example.invalid/team/codex-app-server-bridge.git#v0.1.1",
      "git+https://git.example.invalid/team/codex-app-server-bridge.git#v0.1.0",
    ],
  ];

  for (const args of invalid) {
    const result = runVerifier(args);
    assert.notEqual(result.status, 0);
    assert.equal(result.stderr.includes(secret), false);
    assert.match(result.stderr, /Git-package verification failed:/);
  }
});

test("Git-package verifier installs and launches a disposable prebuilt Git revision", async () => {
  const root = await mkdtemp(join(tmpdir(), "codex-app-server-bridge-git-test-"));
  const repository = join(root, "codex-app-server-bridge.git");
  const cache = join(root, "npm-cache");
  try {
    await Promise.all([
      mkdir(join(repository, "bin"), { recursive: true }),
      mkdir(join(repository, "dist"), { recursive: true }),
    ]);
    await writeFile(join(repository, "package.json"), `${JSON.stringify({
      name: "codex-app-server-bridge",
      version: "9.9.9",
      private: true,
      type: "module",
      bin: { "codex-app-server-bridge": "bin/codex-app-server-bridge.js" },
      files: ["bin/", "dist/cli.js", "dist/config.js"],
      engines: { node: ">=24" },
    }, null, 2)}\n`);
    const launcher = `#!/usr/bin/env node
if (process.argv.slice(2).join(" ") !== "app-server") {
  process.stderr.write("codex-app-server-bridge: Usage: codex-app-server-bridge app-server\\n");
  process.exitCode = 1;
}
`;
    const executable = join(repository, "bin", "codex-app-server-bridge.js");
    await writeFile(executable, launcher);
    await chmod(executable, 0o755);
    await writeFile(join(repository, "dist", "cli.js"), "export async function runBridge() { return 1; }\n");
    await writeFile(join(repository, "dist", "config.js"), "export const USAGE = 'fixture';\n");
    const gitEnvironment = isolatedGitEnvironment();
    execFileSync("git", ["init", "--quiet"], { cwd: repository, env: gitEnvironment });
    execFileSync("git", ["config", "user.name", "Codex Test"], { cwd: repository, env: gitEnvironment });
    execFileSync("git", ["config", "user.email", "codex-test@example.invalid"], { cwd: repository, env: gitEnvironment });
    execFileSync("git", ["add", "."], { cwd: repository, env: gitEnvironment });
    execFileSync("git", ["commit", "--quiet", "-m", "prebuilt fixture"], { cwd: repository, env: gitEnvironment });
    const revision = execFileSync("git", ["rev-parse", "HEAD"], {
      cwd: repository,
      encoding: "utf8",
      env: gitEnvironment,
    }).trim();
    const packageSpec = `git+${pathToFileURL(repository).href}#${revision}`;

    const result = runVerifier([packageSpec], cache);
    assert.equal(result.status, 0, result.stderr);
    const report = JSON.parse(result.stdout) as {
      ok: boolean;
      revision: string;
      storage: string;
      invocation: string;
    };
    assert.equal(report.ok, true);
    assert.equal(report.revision, revision);
    assert.equal(report.storage, "isolated-prefix");
    assert.equal(report.invocation, "verified");
  } finally {
    await rm(root, { recursive: true, force: true });
  }
});