package main

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestCheckFrontendAllowsDocumentedNonProtoFetches(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name   string
		file   string
		target string
	}{
		{
			name:   "backup multipart upload",
			file:   "components/admin/backups/restore-new-instance-dialog.tsx",
			target: "/api/push/upload?account_id=${encodeURIComponent(accountId)}",
		},
		{
			name:   "helpdesk multipart upload",
			file:   "components/helpdesk/helpers.ts",
			target: "/api/helpdesk/upload",
		},
		{
			name:   "AI chat page stream",
			file:   "components/ai-agents/chat-page.tsx",
			target: "/api/ai/chat/stream",
		},
		{
			name:   "AI chat widget stream",
			file:   "components/ai-agents/chat-widget.tsx",
			target: "/api/ai/chat/stream",
		},
		{
			name:   "support bug report multipart upload",
			file:   "components/bug-report/bug-report-dialog.tsx",
			target: "/api/support/bug-reports",
		},
		{
			name:   "support attachment multipart upload",
			file:   "components/support/help-widget.tsx",
			target: "/api/support/tickets/${ticketId}/messages/${messageId}/attachments",
		},
		{
			name:   "support availability probe",
			file:   "lib/support/availability.ts",
			target: "/api/support/tickets",
		},
		{
			name:   "MCP device status",
			file:   "routes/admin/authorize-device.tsx",
			target: "/api/mcp/device/status",
		},
		{
			name:   "MCP device authorization",
			file:   "routes/admin/authorize-device.tsx",
			target: "/api/mcp/device/authorize",
		},
		{
			name:   "MCP device denial",
			file:   "routes/admin/authorize-device.tsx",
			target: "/api/mcp/device/deny",
		},
		{
			name:   "plugin multipart upload",
			file:   "routes/admin/plugins.tsx",
			target: "/api/plugins/upload?token=${encodeURIComponent(token)}",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			dir := t.TempDir()
			path := filepath.Join(dir, filepath.FromSlash(tt.file))
			if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
				t.Fatal(err)
			}
			source := "const response = await fetch(`" + tt.target + "`, { method: \"POST\" })\n"
			if err := os.WriteFile(path, []byte(source), 0o644); err != nil {
				t.Fatal(err)
			}

			violations, warnings := checkFrontend(dir)
			if len(violations) != 0 || len(warnings) != 0 {
				t.Fatalf("documented REST fetch returned violations=%#v warnings=%#v", violations, warnings)
			}
		})
	}
}

func TestCheckFrontendRejectsUndocumentedNonProtoFetches(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name   string
		file   string
		target string
	}{
		{
			name:   "unknown endpoint in an allowed file",
			file:   "routes/admin/authorize-device.tsx",
			target: "/api/mcp/device/revoke-all",
		},
		{
			name:   "allowed endpoint in an unknown file",
			file:   "routes/admin/unknown.tsx",
			target: "/api/mcp/device/status",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			dir := t.TempDir()
			path := filepath.Join(dir, filepath.FromSlash(tt.file))
			if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
				t.Fatal(err)
			}
			source := "const response = await fetch(`" + tt.target + "`)\n"
			if err := os.WriteFile(path, []byte(source), 0o644); err != nil {
				t.Fatal(err)
			}

			violations, warnings := checkFrontend(dir)
			if len(warnings) != 0 {
				t.Fatalf("unexpected warning for undocumented REST fetch: %#v", warnings)
			}
			if len(violations) != 1 || violations[0].rule != "no-fetch-api" ||
				!strings.Contains(violations[0].snippet, tt.target) {
				t.Fatalf("violations = %#v, want one no-fetch-api finding for %q", violations, tt.target)
			}
		})
	}
}

func TestAllowedNonProtoFetchesAreNarrowAndDocumented(t *testing.T) {
	t.Parallel()

	seen := make(map[string]bool, len(allowedNonProtoFetches))
	for _, allowance := range allowedNonProtoFetches {
		if allowance.file == "" || allowance.target == "" || allowance.reason == "" {
			t.Fatalf("incomplete non-proto fetch allowance: %#v", allowance)
		}
		if strings.HasSuffix(allowance.target, "/") {
			t.Fatalf("non-proto fetch allowance must name an exact target, got %q", allowance.target)
		}
		key := allowance.file + "\x00" + allowance.target
		if seen[key] {
			t.Fatalf("duplicate non-proto fetch allowance for %s %s", allowance.file, allowance.target)
		}
		seen[key] = true
	}
}

func TestCheckPluginPagesFlagsQueryClientProvider(t *testing.T) {
	dir := t.TempDir()
	file := filepath.Join(dir, "editor.tsx")

	if err := os.WriteFile(file, []byte(`import { QueryClientProvider } from '@tanstack/react-query'

export function Editor() {
	return <QueryClientProvider client={client}><div /></QueryClientProvider>
}
`), 0644); err != nil {
		t.Fatalf("write editor.tsx: %v", err)
	}

	violations := checkPluginPages([]string{dir})
	found := false
	for _, v := range violations {
		if v.rule != "no-queryclientprovider-in-plugin" {
			continue
		}
		if v.snippet != "remove QueryClientProvider; BlockNinja core provides it." {
			t.Fatalf("snippet = %q, want concise remediation", v.snippet)
		}
		found = true
		break
	}

	if !found {
		t.Fatalf("expected QueryClientProvider violation, got %#v", violations)
	}
}

func TestCheckFrontendSkipsTestFiles(t *testing.T) {
	dir := t.TempDir()
	// A transport-layer regression test legitimately drives createClient over the
	// real transport to exercise interceptors — it is not shipped UI. The frontend
	// pattern checks must skip *.test.* / *.spec.* files, matching the convention
	// the coming-soon and TODO checks already follow.
	for _, name := range []string{"transport.test.ts", "auth.test.tsx", "util.spec.ts", "view.spec.tsx"} {
		if err := os.WriteFile(filepath.Join(dir, name), []byte(`import { createClient } from "@connectrpc/connect";
import axios from "axios";
const client = createClient(AuthService, transport);
`), 0644); err != nil {
			t.Fatalf("write %s: %v", name, err)
		}
	}

	violations, _ := checkFrontend(dir)
	if len(violations) != 0 {
		t.Fatalf("expected test/spec files to be skipped, got %d violation(s): %#v", len(violations), violations)
	}
}

func TestIsBrowserConfirmCall(t *testing.T) {
	tests := []struct {
		lines []string
		idx   int
		want  bool
	}{
		{lines: []string{`if (window.confirm("delete?")) {`}, idx: 0, want: true},
		{lines: []string{`if (confirm("delete?")) {`}, idx: 0, want: true},
		{lines: []string{`const confirmed = await confirm({ title: "Delete" })`}, idx: 0, want: false},
		{lines: []string{`confirm({ title: "Delete" }).then((confirmed) => {`}, idx: 0, want: false},
		{
			lines: []string{
				`const confirmed = await`,
				`  confirm({`,
				`    title: "Delete",`,
				`  })`,
			},
			idx:  1,
			want: false,
		},
		{
			lines: []string{
				`confirm({`,
				`  title: "Leave",`,
				`}).then((confirmed) => {`,
			},
			idx:  0,
			want: false,
		},
	}

	for _, tt := range tests {
		if got := isBrowserConfirmCall(tt.lines, tt.idx); got != tt.want {
			t.Fatalf("isBrowserConfirmCall(%#v, %d) = %v, want %v", tt.lines, tt.idx, got, tt.want)
		}
	}
}

func TestIsRawButtonJSXLine(t *testing.T) {
	tests := []struct {
		line string
		want bool
	}{
		{line: `<button>`, want: true},
		{line: `				<button`, want: true},
		{line: `<button className="h-8 w-8" onClick={onPick}>`, want: true},
		{line: `return <button type="button">{label}</button>`, want: true},
		{line: `<Button action="save">Save</Button>`, want: false},
		{line: `</button>`, want: false},
		{line: `{/* <button> is banned in admin UI */}`, want: false},
		{line: `<buttonish-element>`, want: false},
	}

	for _, tt := range tests {
		if got := isRawButtonJSXLine(tt.line); got != tt.want {
			t.Fatalf("isRawButtonJSXLine(%q) = %v, want %v", tt.line, got, tt.want)
		}
	}
}

func TestCheckFrontendFlagsRawButton(t *testing.T) {
	dir := t.TempDir()
	if err := os.MkdirAll(filepath.Join(dir, "components", "editor"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(dir, "components", "editor", "toolbar.tsx"), []byte(`export function Toolbar() {
	return (
		<div>
			<button onClick={save}>Save</button>
			<Button action="cancel">Cancel</Button>
		</div>
	)
}
`), 0o644); err != nil {
		t.Fatal(err)
	}

	violations, _ := checkFrontend(dir)
	var rawButton []frontendViolation
	for _, v := range violations {
		if v.rule == "no-raw-button" {
			rawButton = append(rawButton, v)
		}
	}
	if len(rawButton) != 1 {
		t.Fatalf("expected exactly one no-raw-button violation, got %d: %#v", len(rawButton), violations)
	}
	if rawButton[0].line != 4 {
		t.Fatalf("violation line = %d, want 4", rawButton[0].line)
	}
}

func TestCheckFrontendRawButtonExemptions(t *testing.T) {
	dir := t.TempDir()
	if err := os.MkdirAll(filepath.Join(dir, "components", "ui"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.MkdirAll(filepath.Join(dir, "lib"), 0o755); err != nil {
		t.Fatal(err)
	}

	// The Button primitive itself renders a raw <button> — components/ui/ is exempt.
	if err := os.WriteFile(filepath.Join(dir, "components", "ui", "button.tsx"), []byte(`const Comp = asChild ? Slot : "button";
return <button className={cn(buttonVariants({ variant, size, className }))} ref={ref} {...props} />
`), 0o644); err != nil {
		t.Fatal(err)
	}

	// Non-React surfaces build DOM via HTML strings in plain .ts — <Button> does not exist there.
	if err := os.WriteFile(filepath.Join(dir, "lib", "iframe-script.ts"), []byte("const html = `<button class=\"bn-edit\">Edit</button>`\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	violations, _ := checkFrontend(dir)
	for _, v := range violations {
		if v.rule == "no-raw-button" {
			t.Fatalf("expected no no-raw-button violations, got %#v", v)
		}
	}
}

func TestCheckPluginPagesFlagsRawButton(t *testing.T) {
	dir := t.TempDir()
	if err := os.WriteFile(filepath.Join(dir, "settings.tsx"), []byte(`export function Settings() {
	return <button onClick={connect}>Connect</button>
}
`), 0o644); err != nil {
		t.Fatal(err)
	}

	violations := checkPluginPages([]string{dir})
	found := false
	for _, v := range violations {
		if v.rule == "no-raw-button-in-plugin" {
			found = true
			break
		}
	}
	if !found {
		t.Fatalf("expected no-raw-button-in-plugin violation, got %#v", violations)
	}
}

func TestPluginRESTFileAllowed(t *testing.T) {
	if !pluginRESTFileAllowed("/tmp/repo/backend/internal/plugins/calcomblock/web/settings.tsx") {
		t.Fatalf("expected documented calcom settings panel to be allowlisted")
	}
	if !pluginRESTFileAllowed("/tmp/repo/backend/internal/plugins/calcomblock/web/editor.tsx") {
		t.Fatalf("expected documented calcom editor panel to be allowlisted")
	}
	if pluginRESTFileAllowed("/tmp/repo/backend/internal/plugins/calcomblock/web/dashboard.tsx") {
		t.Fatalf("unexpected allowlist hit for non-allowlisted plugin file")
	}
}