import { afterEach, describe, expect, it, vi } from 'vitest';

import { createSessionAuthStorage } from '../session-auth';

class MemoryStorage {
  values = new Map<string, string>();
  getItem(key: string) {
    return this.values.get(key) ?? null;
  }
  setItem(key: string, value: string) {
    this.values.set(key, value);
  }
}

class Channel extends EventTarget {
  static peers = new Set<Channel>();
  constructor() {
    super();
    Channel.peers.add(this);
  }
  close() {
    Channel.peers.delete(this);
  }
  postMessage(data: unknown) {
    for (const peer of Channel.peers) {
      if (peer !== this) queueMicrotask(() => peer.dispatchEvent(new MessageEvent('message', { data })));
    }
  }
}

const value = (accessToken: null | string) => JSON.stringify({ accessToken, refreshToken: null });
const disposals: (() => void)[] = [];
function tab(persistent: MemoryStorage, session = new MemoryStorage(), connected = true) {
  const events = new EventTarget();
  const onRemoteChange = vi.fn();
  const channel = connected ? new Channel() : undefined;
  const auth = createSessionAuthStorage({
    key: 'app-core-access',
    persistent,
    session,
    channel: channel as unknown as BroadcastChannel,
    events: events as Window,
    onRemoteChange,
  });
  disposals.push(auth.dispose);
  return { auth, session, events, onRemoteChange, channel };
}
async function start(auth: ReturnType<typeof tab>['auth']) {
  const ready = auth.start();
  await vi.advanceTimersByTimeAsync(400);
  await ready;
}

afterEach(() => {
  for (const dispose of disposals.splice(0)) dispose();
  Channel.peers.clear();
  vi.useRealTimers();
});

describe('session authentication', () => {
  it('keeps credentials out of persistent storage and restores on refresh', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    await start(a.auth);
    a.auth.setItem('', value('test-token'));
    expect([...persistent.values.values()].join(',')).not.toContain('test-token');
    a.auth.dispose();
    const refreshed = tab(persistent, a.session);
    await start(refreshed.auth);
    expect(refreshed.auth.getItem()).toBe(value('test-token'));
  });

  it('shares the same credential with a new tab without another login', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    await start(a.auth);
    a.auth.setItem('', value('same-token'));
    const b = tab(persistent);
    await start(b.auth);
    expect(b.auth.getItem()).toBe(value('same-token'));
    expect(b.onRemoteChange).not.toHaveBeenCalled();
    expect(a.onRemoteChange).not.toHaveBeenCalled();
  });

  it('broadcasts login to an already open login page and logout to all peers', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    const b = tab(persistent);
    await start(a.auth);
    await start(b.auth);
    a.auth.setItem('', value('token'));
    await vi.advanceTimersByTimeAsync(0);
    expect(b.auth.getItem()).toBe(value('token'));
    expect(b.onRemoteChange).toHaveBeenCalledTimes(1);
    a.auth.setItem('', value(null));
    await vi.advanceTimersByTimeAsync(0);
    expect(b.auth.getItem()).toBe(value(null));
    expect(b.onRemoteChange).toHaveBeenCalledTimes(2);
    expect(a.onRemoteChange).not.toHaveBeenCalled();
  });

  it('has no credential after all pages close and a fresh session starts', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    await start(a.auth);
    a.auth.setItem('', value('token'));
    a.auth.dispose();
    const b = tab(persistent);
    await start(b.auth);
    expect(b.auth.getItem()).toBeNull();
  });

  it('rejects a delayed pre-logout response', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    await start(a.auth);
    a.auth.setItem('', value('old-token'));
    const oldRevision = persistent.getItem('app-core-access-revision');
    a.auth.setItem('', value(null));
    a.channel!.dispatchEvent(
      new MessageEvent('message', {
        data: {
          type: 'snapshot',
          snapshot: { revision: oldRevision, value: value('old-token') },
        },
      }),
    );
    expect(a.auth.getItem()).toBe(value(null));
  });

  it('invalidates a sleeping tab on focus and does not let stale writes revoke a newer session', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    await start(a.auth);
    a.auth.setItem('', value('old-token'));
    const sleeping = tab(persistent, a.session, false);
    await start(sleeping.auth);
    a.auth.setItem('', value('new-token'));
    const revision = persistent.getItem('app-core-access-revision');
    sleeping.auth.setItem('', value(null));
    expect(persistent.getItem('app-core-access-revision')).toBe(revision);
    sleeping.events.dispatchEvent(new Event('focus'));
    await vi.advanceTimersByTimeAsync(300);
    expect(sleeping.auth.getItem()).toBeNull();
    expect(sleeping.onRemoteChange).toHaveBeenCalledTimes(1);
  });

  it('rejects a saved session revoked while its tab was closed', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    await start(a.auth);
    a.auth.setItem('', value('token'));
    const saved = new MemoryStorage();
    saved.values = new Map(a.session.values);
    a.auth.setItem('', value(null));
    a.auth.dispose();
    const restored = tab(persistent, saved);
    await start(restored.auth);
    expect(restored.auth.getItem()).toBeNull();
  });

  it('documents that browser-restored session storage can restore authentication', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const a = tab(persistent);
    await start(a.auth);
    a.auth.setItem('', value('token'));
    a.auth.dispose();
    const restored = tab(persistent, a.session);
    await start(restored.auth);
    expect(restored.auth.getItem()).toBe(value('token'));
  });

  it('documents that a restored peer can authenticate a login page after refresh', async () => {
    vi.useFakeTimers();
    const persistent = new MemoryStorage();
    const original = tab(persistent);
    await start(original.auth);
    original.auth.setItem('', value('previous-browser-session'));
    const savedSecondTab = new MemoryStorage();
    savedSecondTab.values = new Map(original.session.values);
    original.auth.dispose();

    // The first restored page has no session; the second is restored later.
    const first = tab(persistent);
    await start(first.auth);
    expect(first.auth.getAccessToken()).toBeNull();
    const second = tab(persistent, savedSecondTab);
    await start(second.auth);
    expect(second.auth.getAccessToken()).toBe('previous-browser-session');
    expect(first.auth.getAccessToken()).toBeNull();

    first.auth.dispose();
    const refreshedFirst = tab(persistent, first.session);
    await start(refreshedFirst.auth);
    expect(refreshedFirst.auth.getAccessToken()).toBe('previous-browser-session');
  });
});