import { test, expect, type APIRequestContext, type BrowserContext, type Page } from "@playwright/test";
import { authenticator } from "otplib";

/**
 * End-to-end coverage for Task 15 of the MFA design
 * (docs/superpowers/specs/2026-09-15-mfa-local-signin-design.md).
 *
 * Prerequisites: a running control plane (server + web) backed by MongoDB
 * and Redis, reachable at `E2E_BASE_URL` (default http://localhost:3000)
 * with the API at the same origin (the nginx fragment in
 * deploy/docker/docker-compose.yml, or an equivalent dev proxy).
 *
 * The suite needs an existing owner session to create fresh member accounts
 * per test, so state never leaks between tests. If the instance has never
 * been bootstrapped, the first test bootstraps it and every other test reuses
 * those owner credentials; set E2E_OWNER_EMAIL / E2E_OWNER_PASSWORD to point
 * at an already-bootstrapped instance's owner instead.
 */

const BASE_URL = process.env.E2E_BASE_URL ?? "http://localhost:3000";

let ownerEmail = process.env.E2E_OWNER_EMAIL ?? "";
let ownerPassword = process.env.E2E_OWNER_PASSWORD ?? "";

/** Ensures an owner account exists and returns its credentials, bootstrapping the instance if needed. */
async function ensureOwner(request: APIRequestContext): Promise<{ email: string; password: string }> {
    if (ownerEmail && ownerPassword) return { email: ownerEmail, password: ownerPassword };

    const status = await request.get(`${BASE_URL}/auth/bootstrap-status`);
    const body = await status.json();
    if (!body.needs_setup) {
        throw new Error(
            "Instance is already bootstrapped and E2E_OWNER_EMAIL/E2E_OWNER_PASSWORD were not set - " +
                "cannot create the owner account this suite needs to provision fresh members per test.",
        );
    }

    ownerEmail = `e2e-owner-${Date.now()}@vantage.test`;
    ownerPassword = "correct horse battery staple 1";
    const res = await request.post(`${BASE_URL}/auth/bootstrap`, {
        data: { instance_name: "MFA E2E", email: ownerEmail, password: ownerPassword },
    });
    if (!res.ok()) throw new Error(`bootstrap failed: ${res.status()} ${await res.text()}`);
    return { email: ownerEmail, password: ownerPassword };
}

/** Creates a fresh, unique local member with no MFA enrolled, using an owner session. */
async function createMember(request: APIRequestContext): Promise<{ email: string; password: string }> {
    const owner = await ensureOwner(request);

    const login = await request.post(`${BASE_URL}/auth/login`, {
        data: { email: owner.email, password: owner.password },
    });
    if (!login.ok()) throw new Error(`owner login failed: ${login.status()} ${await login.text()}`);

    const email = `e2e-member-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@vantage.test`;
    const password = "correct horse battery staple 1";
    const res = await request.post(`${BASE_URL}/api/org/users`, {
        data: { email, password, role: "member" },
    });
    if (!res.ok()) throw new Error(`create member failed: ${res.status()} ${await res.text()}`);

    await request.post(`${BASE_URL}/auth/logout`);
    return { email, password };
}

/** Registers Chrome's virtual authenticator (CTAP2, resident keys, internal UV) on this context. */
async function addVirtualAuthenticator(context: BrowserContext, page: Page): Promise<string> {
    const client = await context.newCDPSession(page);
    await client.send("WebAuthn.enable");
    const { authenticatorId } = await client.send("WebAuthn.addVirtualAuthenticator", {
        options: {
            protocol: "ctap2",
            transport: "internal",
            hasResidentKey: true,
            hasUserVerification: true,
            isUserVerified: true,
        },
    });
    return authenticatorId;
}

async function fillCredentials(page: Page, email: string, password: string) {
    await page.goto("/login");
    await page.getByLabel("Email").fill(email);
    await page.getByLabel("Password").fill(password);
    await page.getByRole("button", { name: "Sign In" }).click();
}

test.describe("MFA end-to-end", () => {
    test("TOTP sign-in", async ({ page, request }) => {
        const { email, password } = await createMember(request);

        // Sign in, land on the account security page, enrol TOTP.
        await fillCredentials(page, email, password);
        await expect(page).toHaveURL("/");

        await page.goto("/account/security");
        await page.getByRole("button", { name: "Set up" }).click();
        await page.getByRole("button", { name: "Use an authenticator app" }).click();

        const secret = await page.locator("p.font-mono").innerText();
        const code = authenticator.generate(secret.trim());
        await page.getByLabel("6-digit code").fill(code);
        await page.getByRole("button", { name: "Confirm" }).click();

        // Recovery codes step - acknowledge and finish.
        await page.getByLabel("I have saved these codes").check();
        await page.getByRole("button", { name: "Continue" }).click();
        await expect(page.getByText("Enabled")).toBeVisible();

        // Sign out and sign back in - TOTP is now required.
        await page.request.post(`${BASE_URL}/auth/logout`);
        await fillCredentials(page, email, password);

        await expect(page.getByText("Enter the 6-digit code")).toBeVisible();
        const nextCode = authenticator.generate(secret.trim());
        await page.getByLabel("Verification code").fill(nextCode);
        await page.getByRole("button", { name: "Verify" }).click();

        await expect(page).toHaveURL("/");
    });

    test("passkey second factor", async ({ page, context, request }) => {
        const { email, password } = await createMember(request);
        await addVirtualAuthenticator(context, page);

        await fillCredentials(page, email, password);
        await expect(page).toHaveURL("/");

        await page.goto("/account/security");
        await page.getByRole("button", { name: "Set up" }).click();
        await page.getByRole("button", { name: "Use a passkey" }).click();

        await page.getByLabel("I have saved these codes").check();
        await page.getByRole("button", { name: "Continue" }).click();
        await expect(page.getByText("No passkeys registered.")).toHaveCount(0);

        await page.request.post(`${BASE_URL}/auth/logout`);
        await fillCredentials(page, email, password);

        await expect(page.getByText("Enter the 6-digit code")).toBeVisible();
        await page.getByRole("button", { name: "Use passkey" }).click();

        await expect(page).toHaveURL("/");
    });

    test("passwordless passkey sign-in", async ({ page, context, request }) => {
        const { email, password } = await createMember(request);
        await addVirtualAuthenticator(context, page);

        // Enrol a passkey first (typing the password once, during setup only).
        await fillCredentials(page, email, password);
        await expect(page).toHaveURL("/");
        await page.goto("/account/security");
        await page.getByRole("button", { name: "Add a passkey" }).click();
        await page.request.post(`${BASE_URL}/auth/logout`);

        // Sign back in with no password typed at all.
        await page.goto("/login");
        await page.getByRole("button", { name: "Sign in with passkey" }).click();

        await expect(page).toHaveURL("/");
    });

    test("forced enrolment when require_mfa is on", async ({ page, request }) => {
        const owner = await ensureOwner(request);
        const { email, password } = await createMember(request);

        // Owner enables the policy.
        const ownerLogin = await request.post(`${BASE_URL}/auth/login`, {
            data: { email: owner.email, password: owner.password },
        });
        expect(ownerLogin.ok()).toBeTruthy();
        const settingsRes = await request.put(`${BASE_URL}/api/settings`, {
            data: { require_mfa: true },
        });
        expect(settingsRes.ok()).toBeTruthy();
        await request.post(`${BASE_URL}/auth/logout`);

        // The member, who has no MFA yet, must enrol before reaching the app.
        await fillCredentials(page, email, password);
        await expect(page.getByText("This instance requires a second sign-in factor. Set one up to continue.")).toBeVisible();

        await page.getByRole("button", { name: "Use an authenticator app" }).click();
        const secret = await page.locator("p.font-mono").innerText();
        const code = authenticator.generate(secret.trim());
        await page.getByLabel("6-digit code").fill(code);
        await page.getByRole("button", { name: "Confirm" }).click();
        await page.getByLabel("I have saved these codes").check();
        await page.getByRole("button", { name: "Continue" }).click();

        await expect(page).toHaveURL("/");

        // Clean up: turn the policy back off so it doesn't affect other tests.
        await request.post(`${BASE_URL}/auth/login`, { data: { email: owner.email, password: owner.password } });
        await request.put(`${BASE_URL}/api/settings`, { data: { require_mfa: false } });
        await request.post(`${BASE_URL}/auth/logout`);
    });

    test("step-up on secret reveal", async ({ page, request }) => {
        const { email, password } = await createMember(request);

        // Enrol TOTP so step-up has a factor to challenge.
        await fillCredentials(page, email, password);
        await page.goto("/account/security");
        await page.getByRole("button", { name: "Set up" }).click();
        await page.getByRole("button", { name: "Use an authenticator app" }).click();
        const secret = await page.locator("p.font-mono").innerText();
        await page.getByLabel("6-digit code").fill(authenticator.generate(secret.trim()));
        await page.getByRole("button", { name: "Confirm" }).click();
        await page.getByLabel("I have saved these codes").check();
        await page.getByRole("button", { name: "Continue" }).click();

        // A brand-new session's StepUpAt is fresh from sign-in, so create a secret,
        // then create a group via the UI and attempt a reveal - the modal should
        // still appear because sign-in only counts as step-up for ten minutes and
        // this test does not wait that long; it is testing the prompt fires the
        // first time an authenticated caller with no fresh step-up reveals one.
        await request.post(`${BASE_URL}/api/secrets`, { data: { group: "e2e-stepup", values: { KEY: "value" } } });

        await page.goto("/secrets/e2e-stepup");
        await page.getByRole("button", { name: "Reveal" }).click();

        await expect(page.getByText("Confirm it's you")).toBeVisible();
        await page.getByLabel("6-digit code").fill(authenticator.generate(secret.trim()));
        await page.getByRole("button", { name: "Confirm" }).click();

        await expect(page.getByText("Confirm it's you")).toHaveCount(0);
        await expect(page.locator("span.font-mono.text-xs.break-all")).toBeVisible();

        // Reveal again within the ten-minute step-up window: no prompt this time.
        await page.getByRole("button", { name: "Hide" }).click().catch(() => {});
        await page.getByRole("button", { name: "Reveal" }).click();
        await expect(page.getByText("Confirm it's you")).toHaveCount(0);
    });
});