// T5DE-hosted rooms (docs/hosted-rooms.md): the REST routes and the realtime room protocol, with fake proxies.
import { afterAll, beforeAll, expect, test } from "bun:test";
import { openDatabase, type Database } from "@t5de/db";
import { createApp } from "../src/app";
import { createAuth } from "../src/auth";
import { ImvuClient, type ImvuUser } from "../src/imvu";

const webURL = "http://web.test";
const accounts = new Map<number, ImvuUser>();

const fakeIMVU: typeof fetch = (async (input: RequestInfo | URL) => {
  const url = new URL(String(input));
  const u = [...accounts.values()].find(
    (u) => url.pathname === `/user/user-${u.id}` || url.searchParams.get("username")?.toLowerCase() === u.username.toLowerCase(),
  );
  return Response.json({
    denormalized: u
      ? { [`https://api.imvu.com/user/user-${u.id}`]: { data: { legacy_cid: u.id, username: u.username, tagline: u.tagline, is_ageverified: u.ageVerified, is_ap: u.accessPass } } }
      : {},
  });
}) as typeof fetch;

let db: Database;
let close: () => Promise<void>;
let base: string;
let stop: () => void;

beforeAll(async () => {
  ({ db, close } = await openDatabase("memory"));
  const auth = createAuth(db, { apiURL: "http://api.test", webURL, secret: "test-secret-test-secret-test-secret-1234", rateLimit: false });
  const hub = createApp({ db, auth, imvu: new ImvuClient("http://imvu.test", fakeIMVU) });
  hub.app.listen({ port: 0, hostname: "127.0.0.1" });
  const server = hub.app.server as unknown as { port: number; stop: () => void };
  stop = () => server.stop();
  base = `http://127.0.0.1:${server.port}`;
});

afterAll(async () => {
  stop();
  await close();
});

type Person = { cookie: string; token: string };

async function call(p: Person | undefined, method: string, path: string, body?: unknown) {
  const res = await fetch(base + path, {
    method,
    headers: { Origin: webURL, ...(body !== undefined ? { "Content-Type": "application/json" } : {}), ...(p ? { Cookie: p.cookie } : {}) },
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
  const text = await res.text();
  return { status: res.status, json: text ? JSON.parse(text) : undefined };
}

/** Signs a person up with linked IMVU accounts (adult: age verified on IMVU). */
async function person(name: string, ...imvu: { id: number; ageVerified?: boolean }[]): Promise<Person> {
  const res = await fetch(base + "/api/auth/sign-up/email", {
    method: "POST",
    headers: { Origin: webURL, "Content-Type": "application/json" },
    body: JSON.stringify({ email: `${name}@example.test`, password: "a long password", name, username: name }),
  });
  const p = {
    cookie: res.headers.getSetCookie().map((c) => c.split(";")[0]).join("; "),
    token: res.headers.get("set-auth-token") ?? "",
  };
  expect(p.token).not.toBe("");
  for (const [i, a] of imvu.entries()) {
    const username = `${name}Av${i || ""}`;
    accounts.set(a.id, { id: a.id, username, tagline: "", ageVerified: !!a.ageVerified, accessPass: false });
    const started = await call(p, "POST", "/api/v1/account/links", { username });
    accounts.get(a.id)!.tagline = started.json.challenge.code;
    expect((await call(p, "POST", `/api/v1/account/links/${a.id}/check`)).status).toBe(200);
  }
  return p;
}

/** A proxy's live connection, signed in to the client as imvuId (0: none). */
async function proxy(p: Person, imvuId: number) {
  const ws = new WebSocket(`${base.replace("http", "ws")}/api/v1/realtime`, { headers: { Authorization: `Bearer ${p.token}` } } as any);
  const got: any[] = [];
  ws.onmessage = (e) => got.push(JSON.parse(String(e.data)));
  await new Promise((r) => (ws.onopen = r));
  const send = (m: object) => ws.send(JSON.stringify(m));
  if (imvuId) {
    send({ type: "session", imvu_id: imvuId });
    await Bun.sleep(30);
  }
  const last = (type: string, room?: number) => got.filter((m) => m.type === type && (room === undefined || m.room === room)).at(-1);
  /** Sends a message and waits for the answer of that type for that room. */
  const ask = async (m: { type: string; room: number }, answer: (m: any) => boolean) => {
    const before = got.length;
    send(m);
    await waitFor(() => got.slice(before).some(answer));
    return got.slice(before).find(answer);
  };
  const join = (room: number) =>
    ask({ type: "room.join", room }, (m) => (m.type === "room.joined" || m.type === "room.error") && m.room === room);
  return { ws, got, send, last, join };
}

async function waitFor(ok: () => boolean) {
  for (let i = 0; i < 200 && !ok(); i++) await Bun.sleep(10);
  expect(ok()).toBe(true);
}

const newRoom = (imvuId: number, over: Record<string, unknown> = {}) => ({
  name: "Lounge",
  description: "A quiet place.",
  roomPid: 1234,
  rating: "general",
  maxUsers: 10,
  imvuId,
  ...over,
});

test("rooms are made, listed, changed and closed by their owners", async () => {
  const ada = await person("adam", { id: 301, ageVerified: true }, { id: 302 });
  const ben = await person("benn", { id: 311 });

  // Validation and permissions.
  expect((await call(undefined, "POST", "/api/v1/hosted-rooms", newRoom(301))).status).toBe(401);
  expect((await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(301, { name: "   " }))).json.error).toBe("invalid");
  expect((await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(301, { maxUsers: 31 }))).status).toBe(400);
  expect((await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(301, { maxUsers: 1 }))).status).toBe(400);
  expect((await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(301, { roomPid: 0 }))).status).toBe(400);
  expect((await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(301, { rating: "x" }))).status).toBe(400);
  expect((await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(301, { description: "x".repeat(513) }))).status).toBe(400);
  expect((await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(311))).json.error).toBe("not_linked");
  expect((await call(ben, "POST", "/api/v1/hosted-rooms", newRoom(311, { rating: "adult" }))).json.error).toBe("not_adult");

  // Made: owned by the chosen account, shown with its IMVU name.
  const made = await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(302, { name: "  The   Lounge ", maxUsers: undefined }));
  expect(made.status).toBe(201);
  const n = made.json.room.n;
  expect(made.json.room).toMatchObject({
    instanceId: `302-${2_100_000_000 + n}`,
    chatId: 2_100_000_000 + n,
    name: "The Lounge",
    description: "A quiet place.",
    roomPid: 1234,
    rating: "general",
    maxUsers: 10,
    ownerImvuId: 302,
    ownerName: "adamAv1",
    occupancy: 0,
  });
  const adult = (await call(ada, "POST", "/api/v1/hosted-rooms", newRoom(301, { name: "Late", rating: "adult" }))).json.room;
  expect(adult.rating).toBe("adult");

  // Listed newest first; adult rooms only for adults.
  const names = async (p?: Person, q = "") => ((await call(p, "GET", `/api/v1/hosted-rooms${q}`)).json.rooms as any[]).map((r) => r.name);
  expect(await names(ada)).toEqual(["Late", "The Lounge"]);
  expect(await names(ben)).toEqual(["The Lounge"]);
  expect(await names()).toEqual(["The Lounge"]);
  expect(await names(ben, "?mine=1")).toEqual([]);
  expect(await names(ada, "?mine=1")).toEqual(["Late", "The Lounge"]);
  expect((await call(undefined, "GET", "/api/v1/hosted-rooms?mine=1")).status).toBe(401);

  // One room, with its scene.
  const got = await call(ben, "GET", `/api/v1/hosted-rooms/${n}`);
  expect(got.json.scene.contents).toEqual([]);
  expect(got.json.scene.hash).toMatch(/^[0-9a-f]{64}$/);
  expect((await call(ben, "GET", `/api/v1/hosted-rooms/${adult.n}`)).status).toBe(404);
  expect((await call(ben, "GET", "/api/v1/hosted-rooms/999999")).status).toBe(404);
  expect((await call(ben, "GET", "/api/v1/hosted-rooms/x")).status).toBe(400);

  // Changes: owner only.
  expect((await call(ben, "PATCH", `/api/v1/hosted-rooms/${n}`, { name: "Mine now" })).status).toBe(403);
  expect((await call(ada, "PATCH", `/api/v1/hosted-rooms/${n}`, { maxUsers: 40 })).status).toBe(400);
  const patched = await call(ada, "PATCH", `/api/v1/hosted-rooms/${n}`, { name: "Lounge 2", maxUsers: 4, description: "" });
  expect(patched.json.room).toMatchObject({ name: "Lounge 2", maxUsers: 4, description: "", roomPid: 1234 });

  // The scene: owner only, checked.
  const scene = { contents: [[1, 5678, "1 0 0 0 0 0 0 1"], [2, "abcdefghij", "1 2 0 0"]] };
  expect((await call(ben, "PUT", `/api/v1/hosted-rooms/${n}/scene`, scene)).status).toBe(403);
  expect((await call(ada, "PUT", `/api/v1/hosted-rooms/${n}/scene`, { contents: [[1, "Nope!", "x"]] })).status).toBe(400);
  expect((await call(ada, "PUT", `/api/v1/hosted-rooms/${n}/scene`, { contents: [[1, 2]] })).status).toBe(400);
  expect((await call(ada, "PUT", `/api/v1/hosted-rooms/${n}/scene`, { contents: [[1, 2, "x".repeat(201)]] })).status).toBe(400);
  const tooMany = { contents: Array.from({ length: 501 }, (_, i) => [i, 2, ""]) };
  expect((await call(ada, "PUT", `/api/v1/hosted-rooms/${n}/scene`, tooMany)).status).toBe(400);
  const put = await call(ada, "PUT", `/api/v1/hosted-rooms/${n}/scene`, { ...scene, roomPid: 4321 });
  expect(put.status).toBe(200);
  expect(put.json.scene.contents).toEqual(scene.contents);
  expect(put.json.scene.hash).not.toBe(got.json.scene.hash);
  const after = await call(ben, "GET", `/api/v1/hosted-rooms/${n}`);
  expect(after.json.scene).toEqual(put.json.scene);
  expect(after.json.room.roomPid).toBe(4321);

  // Closing: owner only; then it's gone from lists and answers 410.
  expect((await call(ben, "DELETE", `/api/v1/hosted-rooms/${n}`)).status).toBe(403);
  expect((await call(ada, "DELETE", `/api/v1/hosted-rooms/${n}`)).status).toBe(204);
  expect((await call(ben, "GET", `/api/v1/hosted-rooms/${n}`)).json.error).toBe("closed");
  expect(await names(ada)).toEqual(["Late"]);
  expect((await call(ada, "PATCH", `/api/v1/hosted-rooms/${n}`, { name: "Back" })).status).toBe(410);

  // Unlinking the owner account hides its rooms.
  await call(ada, "DELETE", "/api/v1/account/links/301");
  expect(await names(ada)).toEqual([]);
});

test("a person may own up to 10 open rooms", async () => {
  const cy = await person("cyd", { id: 321 });
  const ns: number[] = [];
  for (let i = 0; i < 10; i++) {
    const r = await call(cy, "POST", "/api/v1/hosted-rooms", newRoom(321, { name: `Room ${i}` }));
    expect(r.status).toBe(201);
    ns.push(r.json.room.n);
  }
  expect((await call(cy, "POST", "/api/v1/hosted-rooms", newRoom(321))).json.error).toBe("room_cap");
  await call(cy, "DELETE", `/api/v1/hosted-rooms/${ns[0]}`);
  expect((await call(cy, "POST", "/api/v1/hosted-rooms", newRoom(321))).status).toBe(201);
});

test("joining, seats and messages in a hosted room", async () => {
  const dee = await person("deen", { id: 401, ageVerified: true });
  const eli = await person("elia", { id: 402 });
  const fay = await person("faye", { id: 403 });
  const room = (await call(dee, "POST", "/api/v1/hosted-rooms", newRoom(401, { maxUsers: 2 }))).json.room;
  const n: number = room.n;
  const adultRoom = (await call(dee, "POST", "/api/v1/hosted-rooms", newRoom(401, { rating: "adult" }))).json.room.n;

  const d = await proxy(dee, 401);
  const e = await proxy(eli, 402);
  const f = await proxy(fay, 403);

  // Refusals: no linked account in use, no such room, adult room for a non-adult.
  const nobody = await proxy(eli, 0);
  expect((await nobody.join(n)).reason).toBe("not_linked");
  nobody.ws.close();
  const notMine = await proxy(eli, 403); // Fay's account, not Eli's
  expect((await notMine.join(n)).reason).toBe("not_linked");
  notMine.ws.close();
  expect((await e.join(999_999)).reason).toBe("not_found");
  expect((await e.join(adultRoom)).reason).toBe("adult");
  e.send({ type: "room.join", room: 0 });
  await waitFor(() => e.got.some((m) => m.message === "bad room"));

  // Dee and Eli join; each sees the other.
  const dj = await d.join(n);
  expect(dj).toEqual({ type: "room.joined", room: n, chat: 2_100_000_000 + n, participants: [{ imvu_id: 401, seat: 0 }], sequence: 0 });
  const ej = await e.join(n);
  expect(ej.participants).toEqual([{ imvu_id: 401, seat: 0 }, { imvu_id: 402, seat: 0 }]);
  await waitFor(() => d.last("room.participants", n)?.participants.length === 2);
  expect((await call(undefined, "GET", `/api/v1/hosted-rooms/${n}`)).json.room.occupancy).toBe(2);

  // Full at two people; joining again (a reconnect) answers the same.
  expect((await f.join(n)).reason).toBe("full");
  expect((await e.join(n)).type).toBe("room.joined");

  // Seats.
  e.send({ type: "room.seat", room: n, seat: 3 });
  await waitFor(() => d.last("room.participants", n)?.participants.some((p: any) => p.imvu_id === 402 && p.seat === 3));
  e.send({ type: "room.seat", room: n, seat: 100 });
  await waitFor(() => e.got.some((m) => m.message === "bad seat"));

  // Messages go to the others, numbered; forged senders are dropped.
  const chat = (userId: number, message: string) => JSON.stringify({ userId, chatId: 2_100_000_000 + n, message, to: 0 });
  e.send({ type: "room.send", room: n, mount: "messages", message: chat(402, "hi") });
  e.send({ type: "room.send", room: n, mount: "messages", message: chat(401, "I'm Dee") });
  e.send({ type: "room.send", room: n, mount: "messages", message: "not JSON" });
  e.send({ type: "room.send", room: n, mount: "control", message: JSON.stringify({ command: "PlayAction" }) });
  await waitFor(() => d.got.filter((m) => m.type === "room.message").length === 2);
  await Bun.sleep(50);
  const msgs = d.got.filter((m) => m.type === "room.message");
  expect(msgs).toEqual([
    { type: "room.message", room: n, from: 402, mount: "messages", message: chat(402, "hi"), sequence: 1 },
    { type: "room.message", room: n, from: 402, mount: "control", message: JSON.stringify({ command: "PlayAction" }), sequence: 2 },
  ]);
  expect(e.got.filter((m) => m.type === "room.message")).toEqual([]); // not back to the sender
  e.send({ type: "room.send", room: n, mount: "other", message: "x" });
  await waitFor(() => e.got.some((m) => m.message === "bad mount"));
  e.send({ type: "room.send", room: n, mount: "control", message: "x".repeat(64 * 1024 + 1) });
  await waitFor(() => e.got.some((m) => m.message === "bad message"));
  f.send({ type: "room.send", room: n, mount: "control", message: "{}" });
  await waitFor(() => f.got.some((m) => m.message === "not in that room"));

  // Rate: a burst of 20, then the rest is dropped.
  for (let i = 0; i < 30; i++) e.send({ type: "room.send", room: n, mount: "control", message: `{"i":${i}}` });
  await Bun.sleep(150);
  const burst = d.got.filter((m) => m.type === "room.message").length - 2;
  expect(burst).toBeGreaterThanOrEqual(18);
  expect(burst).toBeLessThanOrEqual(23);
  expect((await d.join(n)).sequence).toBe(2 + burst);

  // Leaving makes room; a closed connection leaves too.
  e.send({ type: "room.leave", room: n });
  await waitFor(() => d.last("room.participants", n)?.participants.length === 1);
  expect((await f.join(n)).type).toBe("room.joined");
  f.ws.close();
  await waitFor(() => d.last("room.participants", n)?.participants.length === 1);

  // Closing tells everyone in it; joining it again is refused.
  expect((await e.join(n)).type).toBe("room.joined");
  expect((await call(dee, "DELETE", `/api/v1/hosted-rooms/${n}`)).status).toBe(204);
  await waitFor(() => e.last("room.closed", n) !== undefined && d.last("room.closed", n) !== undefined);
  expect((await e.join(n)).reason).toBe("closed");
  d.ws.close();
  e.ws.close();
});

test("a room made adult sends non-adults out; an unlinked account leaves its rooms", async () => {
  const gil = await person("gilt", { id: 501, ageVerified: true });
  const hal = await person("hale", { id: 502 });
  const n = (await call(gil, "POST", "/api/v1/hosted-rooms", newRoom(501))).json.room.n;
  const g = await proxy(gil, 501);
  const h = await proxy(hal, 502);
  await g.join(n);
  await h.join(n);
  expect((await call(gil, "PATCH", `/api/v1/hosted-rooms/${n}`, { rating: "adult" })).status).toBe(200);
  await waitFor(() => h.last("room.closed", n) !== undefined);
  await waitFor(() => g.last("room.participants", n)?.participants.length === 1);
  expect(g.last("room.closed", n)).toBeUndefined();

  await call(gil, "PATCH", `/api/v1/hosted-rooms/${n}`, { rating: "general" });
  await h.join(n);
  await waitFor(() => g.last("room.participants", n)?.participants.length === 2);
  await call(hal, "DELETE", "/api/v1/account/links/502");
  await waitFor(() => h.got.filter((m) => m.type === "room.closed").length === 2);
  await waitFor(() => g.last("room.participants", n)?.participants.length === 1);
  g.ws.close();
  h.ws.close();
});