import { expect, test as base, type APIRequestContext, type Page } from '@playwright/test';
import { translations } from '../src/i18n/translations';

const apiUrl = 'http://localhost:5302/api';
const password = 'E2ePassword123!';

async function login(api: APIRequestContext, email: string) {
  expect((await api.post(`${apiUrl}/auth/login`, { data: { email, password } })).status()).toBe(200);
  const me = await (await api.get(`${apiUrl}/auth/me`)).json();
  const csrf = (await api.storageState()).cookies.find(cookie => cookie.name === 'XSRF-TOKEN')!.value;
  return { 'X-CSRF-TOKEN': csrf, 'X-Session-Context': me.sessionContext as string };
}

const test = base.extend<{ email: string }>({
  email: async ({ playwright, context }, provide) => {
    const admin = await playwright.request.newContext();
    try {
      const headers = await login(admin, 'e2e@example.test');
      const email = `analytics-auth-${Date.now()}-${Math.random().toString(36).slice(2)}@example.test`;
      expect((await admin.post(`${apiUrl}/users`, { headers, data: { email, password, roles: [] } })).status()).toBe(200);
      await context.addInitScript(() => { if (!localStorage.getItem('uiLanguage')) localStorage.setItem('uiLanguage', 'en'); });
      await context.route('**/*', route => {
        const url = new URL(route.request().url());
        return ['localhost', '127.0.0.1'].includes(url.hostname) || ['data:', 'blob:', 'about:'].includes(url.protocol)
          ? route.continue() : route.abort();
      });
      await provide(email);
    } finally { await admin.dispose(); }
  },
});

async function submitLogin(page: Page, email: string, language: 'en' | 'nb' = 'en', value = password) {
  const t = translations[language];
  if (new URL(page.url()).pathname !== '/login') await page.getByRole('button', { name: t.signInTitle, exact: true }).first().click();
  await page.getByLabel(t.usernameOrEmail, { exact: true }).fill(email);
  await page.getByLabel(t.profileCurrentPassword, { exact: true }).fill(value);
  await page.getByRole('button', { name: t.signInTitle, exact: true }).click();
}

test('[P5-15-01R-03 AUTH-01] native sign-in restores the non-default Analytics period', async ({ page, email }, info) => {
  await page.goto('/analytics?months=6');
  await expect(page).toHaveURL(/\/$/);
  await submitLogin(page, email);
  await expect(page.getByRole('heading', { name: translations.en.analytics, exact: true, level: 1 })).toBeVisible();
  await info.attach('analytics-native-auth-return', { body: JSON.stringify({ requested: '/analytics?months=6', returned: new URL(page.url()).pathname + new URL(page.url()).search }), contentType: 'application/json' });
  await expect(page).toHaveURL(/\/analytics\?months=6$/);
  await expect(page.getByRole('button', { name: '6 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
});

function periodLabel(language: 'en' | 'nb', months: number) {
  return translations[language].dashboardMonthsShort.replace('{count}', String(months));
}

function analyticsResponse(page: Page, months: number) {
  return page.waitForResponse(response => {
    const url = new URL(response.url());
    return url.pathname === '/api/jobapplications/analytics' && url.searchParams.get('months') === String(months);
  });
}

test('[P5-15-01R-03] Analytics encoded period, fragment and existing defaults survive native sign-in across locales/themes', async ({ page, context, email }, info) => {
  test.setTimeout(120_000);
  const results: { requested: string; returned: string; effectiveMonths: number; language: string; mode: string; width: number }[] = [];
  for (const variant of [
    { language: 'en', mode: 'light', width: 1440, path: '/analytics?months=24#activity', months: 24 },
    { language: 'nb', mode: 'dark', width: 390, path: '/analytics?months=%36#rapport', months: 6 },
    { language: 'en', mode: 'dark', width: 768, path: '/analytics?months=12', months: 12 },
    { language: 'nb', mode: 'light', width: 320, path: '/analytics?months=3#rapport', months: 12 },
  ] as const) {
    const headers = await login(page.request, email);
    expect((await page.request.put(`${apiUrl}/auth/preferences/language`, { headers, data: { language: variant.language === 'nb' ? 'nb-NO' : 'en' } })).status()).toBe(204);
    await page.goto('about:blank');
    await context.clearCookies();
    await page.setViewportSize({ width: variant.width, height: 900 });
    await page.goto('/');
    await page.evaluate(({ language, mode }) => { localStorage.setItem('uiLanguage', language); localStorage.setItem('jobtracker.themeMode', mode); }, variant);
    await page.goto(variant.path);
    await expect(page).toHaveURL(/\/$/);
    const report = analyticsResponse(page, variant.months);
    await submitLogin(page, email, variant.language);
    await expect(page).toHaveURL(`http://localhost:3300${variant.path}`);
    expect((await report).status()).toBe(200);
    await expect(page.getByRole('heading', { name: translations[variant.language].analytics, exact: true, level: 1 })).toBeVisible();
    await expect(page.getByRole('button', { name: periodLabel(variant.language, variant.months), exact: true })).toHaveAttribute('aria-pressed', 'true');
    await expect(page.locator('html')).toHaveAttribute('data-color-scheme', variant.mode);
    const returned = new URL(page.url());
    results.push({ requested: variant.path, returned: returned.pathname + returned.search + returned.hash, effectiveMonths: variant.months, language: variant.language, mode: variant.mode, width: variant.width });
    const path = info.outputPath(`analytics-auth-${variant.language}-${variant.mode}-${variant.width}.png`);
    await page.screenshot({ path, fullPage: true, animations: 'disabled' });
    await info.attach(`analytics-auth-${variant.language}-${variant.mode}-${variant.width}`, { path, contentType: 'image/png' });
  }
  await info.attach('analytics-auth-period-matrix', { body: JSON.stringify(results), contentType: 'application/json' });
});

test('[P5-15-01R-03] failed local sign-in preserves the destination; default, history, refresh and authenticated links stay correct', async ({ page, email }, info) => {
  await page.goto('/analytics');
  await expect(page).toHaveURL(/\/$/);
  const failedLogin = page.waitForResponse(response => response.url() === `${apiUrl}/auth/login` && response.request().method() === 'POST');
  await submitLogin(page, email, 'en', 'IncorrectPassword123!');
  expect((await failedLogin).status()).toBe(401);
  await expect(page).toHaveURL(/\/login$/);
  await expect(page.getByRole('alert').filter({ hasText: 'Unauthorized' })).toBeVisible();
  const report = analyticsResponse(page, 12);
  await submitLogin(page, email);
  await expect(page).toHaveURL(/\/analytics$/);
  expect((await report).status()).toBe(200);
  await expect(page.getByRole('button', { name: '12 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
  await page.getByRole('button', { name: '6 mo', exact: true }).click();
  await expect(page).toHaveURL(/\/analytics\?months=6$/);
  await page.getByRole('button', { name: '24 mo', exact: true }).click();
  await expect(page).toHaveURL(/\/analytics\?months=24$/);
  await page.goBack();
  await expect(page).toHaveURL(/\/analytics\?months=6$/);
  await expect(page.getByRole('button', { name: '6 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
  await page.goBack();
  await expect(page).toHaveURL(/\/analytics$/);
  await expect(page.getByRole('button', { name: '12 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
  await page.goForward();
  await expect(page).toHaveURL(/\/analytics\?months=6$/);
  await page.reload();
  await expect(page.getByRole('button', { name: '6 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
  await page.goto('/analytics?months=24#activity');
  await expect(page).toHaveURL(/\/analytics\?months=24#activity$/);
  await expect(page.getByRole('button', { name: '24 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
  await info.attach('analytics-native-history-and-authentication', { body: JSON.stringify({ failedLogin: 401, retryDefault: 12, backPeriods: [6, 12], forwardAndRefresh: 6, authenticatedDirect: 24 }), contentType: 'application/json' });
});

test('[P5-15-01R-03] expired browser cookie retains the report return path; deliberate logout clears it', async ({ page, context, email }, info) => {
  await login(page.request, email);
  await page.goto('/analytics?months=24#activity');
  await expect(page.getByRole('button', { name: '24 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
  const authCookie = (await context.cookies()).find(cookie => cookie.name === 'jobtracker_auth');
  expect(authCookie).toBeDefined();
  await context.addCookies([{ ...authCookie!, expires: 1 }]);
  expect((await context.cookies()).some(cookie => cookie.name === 'jobtracker_auth')).toBe(false);
  expect((await page.request.get(`${apiUrl}/auth/me`)).status()).toBe(401);
  await page.reload();
  await expect(page).toHaveURL(/\/$/);
  await submitLogin(page, email);
  await expect(page).toHaveURL(/\/analytics\?months=24#activity$/);
  await expect(page.getByRole('button', { name: '24 mo', exact: true })).toHaveAttribute('aria-pressed', 'true');
  await page.getByRole('button', { name: translations.en.user, exact: true }).click();
  const loggedOut = page.waitForResponse(response => response.url() === `${apiUrl}/auth/logout`);
  await page.getByRole('menuitem', { name: translations.en.signOut, exact: true }).click();
  expect((await loggedOut).status()).toBe(204);
  await expect(page).toHaveURL(/\/login\?sessionChanged=1$/);
  await submitLogin(page, email);
  await expect(page).toHaveURL(/\/dashboard$/);
  await info.attach('native-expiry-versus-deliberate-logout', { body: JSON.stringify({ expiredCookieMe: 401, expiryReturn: '/analytics?months=24#activity', logout: 204, logoutSubsequentLogin: '/dashboard' }), contentType: 'application/json' });
});

test('[P5-15-01R-03 PRES-E09] another protected section keeps its destination without bypassing ownership or unsafe-target validation', async ({ page, playwright, email }, info) => {
  test.setTimeout(90_000);
  const owner = await playwright.request.newContext();
  const admin = await playwright.request.newContext();
  try {
    const ownerHeaders = await login(owner, email);
    const company = await owner.post(`${apiUrl}/companies`, { headers: ownerHeaders, data: { name: 'Private Analytics-auth employer' } });
    expect(company.status()).toBe(201);
    const job = await owner.post(`${apiUrl}/jobapplications`, { headers: ownerHeaders, data: { companyId: (await company.json()).id, jobTitle: 'Private Analytics-auth role', status: 'Saved' } });
    expect(job.status()).toBe(201);
    const jobId = (await job.json()).id;
    const destination = `/jobs/${jobId}?section=documents#documents`;
    await page.goto(destination);
    await expect(page).toHaveURL(/\/$/);
    await submitLogin(page, email);
    await expect(page).toHaveURL(`http://localhost:3300${destination}`);
    await expect(page.getByRole('region', { name: translations.en.workspaceCurrentDocuments, exact: true })).toBeVisible();
    await page.reload();
    await expect(page.getByRole('region', { name: translations.en.workspaceCurrentDocuments, exact: true })).toBeVisible();
    await page.getByRole('button', { name: translations.en.user, exact: true }).click();
    await page.getByRole('menuitem', { name: translations.en.signOut, exact: true }).click();
    await expect(page).toHaveURL(/\/login\?sessionChanged=1$/);

    const adminHeaders = await login(admin, 'e2e@example.test');
    const emailB = `analytics-auth-other-${Date.now()}-${Math.random().toString(36).slice(2)}@example.test`;
    expect((await admin.post(`${apiUrl}/users`, { headers: adminHeaders, data: { email: emailB, password, roles: [] } })).status()).toBe(200);
    await page.goto(destination);
    await expect(page).toHaveURL(/\/$/);
    const denied = page.waitForResponse(response => new URL(response.url()).pathname === `/api/jobapplications/${jobId}/workspace`);
    await submitLogin(page, emailB);
    await expect(page).toHaveURL(`http://localhost:3300${destination}`);
    expect((await denied).status()).toBe(404);
    await expect(page.getByText(translations.en.workspaceLoadFailed, { exact: true })).toBeVisible();
    await expect(page.getByText('Private Analytics-auth role', { exact: true })).toHaveCount(0);
    expect((await page.request.get(`${apiUrl}/jobapplications/${jobId}`)).status()).toBe(404);
    expect((await (await owner.get(`${apiUrl}/jobapplications/${jobId}`)).json()).jobTitle).toBe('Private Analytics-auth role');

    const rejected: string[] = [];
    for (const target of ['//outside.example.test/analytics', '/%2f%2foutside.example.test/analytics']) {
      await page.getByRole('button', { name: translations.en.user, exact: true }).click();
      await page.getByRole('menuitem', { name: translations.en.signOut, exact: true }).click();
      await expect(page).toHaveURL(/\/login\?sessionChanged=1$/);
      await page.goto('/login');
      await page.evaluate(from => { history.replaceState({ ...history.state, usr: { from } }, '', location.href); }, target);
      await page.reload();
      await submitLogin(page, emailB);
      await expect(page).toHaveURL(/\/dashboard$/);
      rejected.push(target);
    }
    await info.attach('native-return-target-and-ownership', { body: JSON.stringify({ ownedDestination: destination, foreignResource: 404, foreignWorkspace: 404, ownerReadbackUnchanged: true, rejectedTargets: rejected, fallback: '/dashboard' }), contentType: 'application/json' });
  } finally { await owner.dispose(); await admin.dispose(); }
});