const test = require("node:test");
const assert = require("node:assert/strict");
const fs = require("node:fs");
const os = require("node:os");
const path = require("node:path");
const { spawnSync } = require("node:child_process");

const passphraseHandler = require("./passphraseHandler.cjs");
const keyboardInteractiveHandler = require("./keyboardInteractiveHandler.cjs");
const {
  beginTransportDial,
  failTransportDial,
  getTransportStats,
  resetSshTransportRegistryForTests,
} = require("./sshConnectionPool.cjs");
const {
  startPortForward,
  stopPortForward,
  stopPortForwardByRuleId,
  getPortForwardStatus,
  subscribePortForward,
  listPortForwards,
  cancelTunnel,
  publishTunnelStatus,
  shouldFinalizeTunnelClose,
  isReusableTunnelStatus,
  _bindPortForwardChannelsForTests: bindPortForwardChannels,
} = require("./portForwardingBridge.cjs");

function createEncryptedKey(t) {
  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-port-forward-"));
  t.after(() => {
    fs.rmSync(dir, { recursive: true, force: true });
  });

  const keyPath = path.join(dir, "id_ed25519");
  const result = spawnSync("ssh-keygen", [
    "-q",
    "-t",
    "ed25519",
    "-N",
    "secret",
    "-f",
    keyPath,
    "-C",
    "netcatty-test",
  ], { encoding: "utf8" });

  if (result.status !== 0) {
    t.skip("ssh-keygen is unavailable");
    return null;
  }

  return keyPath;
}

function createSender() {
  return createCapturingSender();
}

function createCapturingSender(onSend = () => {}, id = 1) {
  return {
    id,
    isDestroyed: () => false,
    send: (channel, payload) => onSend(channel, payload),
  };
}

test("only live or connecting tunnels are reusable", () => {
  assert.equal(isReusableTunnelStatus("active"), true);
  assert.equal(isReusableTunnelStatus("connecting"), true);
  assert.equal(isReusableTunnelStatus("error"), false);
  assert.equal(isReusableTunnelStatus("inactive"), false);
});

test("status publication removes destroyed renderer subscribers", () => {
  const received = [];
  const destroyed = {
    id: 1,
    isDestroyed: () => true,
    send: () => assert.fail("destroyed renderer must not receive status"),
  };
  const healthy = createCapturingSender((channel, payload) => {
    received.push({ channel, payload });
  }, 2);
  const tunnel = {
    subscribers: new Map([
      [destroyed.id, destroyed],
      [healthy.id, healthy],
    ]),
  };

  publishTunnelStatus("pf-prune-subscribers", tunnel, "active");

  assert.deepEqual(Array.from(tunnel.subscribers.keys()), [healthy.id]);
  assert.equal(received.length, 1);
  assert.equal(received[0]?.payload.status, "active");
});

test("failed active tunnel cleanup publishes an error instead of a false inactive state", async () => {
  let wouldPublishDuringCleanup;
  const statuses = [];
  const tunnel = {
    status: "active",
    server: {
      close() {
        throw new Error("server close failed");
      },
    },
    conn: {
      end() {
        wouldPublishDuringCleanup = shouldFinalizeTunnelClose(tunnel);
      },
    },
  };

  await assert.rejects(
    () => cancelTunnel("pf-active-cleanup-failure", tunnel, (status, error) => {
      statuses.push({ status, error });
    }),
    /server close failed/,
  );
  assert.equal(wouldPublishDuringCleanup, false);
  assert.equal(shouldFinalizeTunnelClose(tunnel), false);
  assert.equal(tunnel.status, "error");
  assert.deepEqual(statuses, [{ status: "error", error: "server: server close failed" }]);
});

test("cancelling a tunnel clears its pending keyboard-interactive request", async () => {
  const tunnelId = "pf-keyboard-interactive-cancel";
  const requestId = keyboardInteractiveHandler.generateRequestId("port-forward");
  const finishCalls = [];
  keyboardInteractiveHandler.storeRequest(
    requestId,
    (responses) => finishCalls.push(responses),
    1,
    tunnelId,
  );

  await cancelTunnel(tunnelId, {}, () => {});

  assert.deepEqual(finishCalls, [[]]);
  assert.equal(keyboardInteractiveHandler.getRequests().has(requestId), false);
});

test("stopping a pending remote forward invalidates its connection immediately", async () => {
  let finishForward;
  let endCalls = 0;
  let unforwardCalls = 0;
  const conn = {
    forwardIn(_bind, _port, callback) {
      finishForward = callback;
    },
    unforwardIn(_bind, _port, callback) {
      unforwardCalls += 1;
      callback(null);
    },
    end() { endCalls += 1; },
    on() {},
    removeListener() {},
  };
  const tunnelId = "pf-remote-pending-stop";
  const tunnel = {
    tunnelId,
    conn,
    status: "connecting",
    cancelled: false,
    sshTransportManaged: false,
    chainConnections: [],
  };
  const binding = bindPortForwardChannels({
    type: "remote",
    conn,
    tunnelId,
    tunnelState: tunnel,
    sender: createSender(),
    bindAddress: "127.0.0.1",
    localPort: 22022,
    remoteHost: "127.0.0.1",
    remotePort: 22,
    chainConnections: [],
    sendStatus() {},
  });

  const stopping = cancelTunnel(tunnelId, tunnel, () => {});
  await new Promise((resolve) => setImmediate(resolve));
  assert.equal(unforwardCalls, 0);
  assert.equal(endCalls, 1, "cancel must invalidate the transport that owns the pending callback");

  finishForward(null);
  assert.deepEqual(await binding, { tunnelId, success: false, cancelled: true });
  await stopping;
  assert.equal(unforwardCalls, 0, "a late response on an invalidated transport must be ignored");
  assert.equal(endCalls, 1, "cleanup must not end the invalidated connection twice");
});

test("stopping a remote forward whose bind callback hangs discards the connection", async () => {
  let endCalls = 0;
  let unforwardCalls = 0;
  const conn = {
    forwardIn() {},
    unforwardIn() { unforwardCalls += 1; },
    end() { endCalls += 1; },
    on() {},
    removeListener() {},
  };
  const tunnelId = "pf-remote-hung-bind-stop";
  const tunnel = {
    tunnelId,
    conn,
    status: "connecting",
    cancelled: false,
    sshTransportManaged: false,
    chainConnections: [],
    _remoteForwardStartCleanupTimeoutMs: 5,
  };
  const binding = bindPortForwardChannels({
    type: "remote",
    conn,
    tunnelId,
    tunnelState: tunnel,
    sender: createSender(),
    bindAddress: "127.0.0.1",
    localPort: 22023,
    remoteHost: "127.0.0.1",
    remotePort: 22,
    chainConnections: [],
    sendStatus() {},
  });

  await Promise.race([
    cancelTunnel(tunnelId, tunnel, () => {}),
    new Promise((_, reject) => setTimeout(() => reject(new Error("cancel did not settle")), 100)),
  ]);
  assert.equal(unforwardCalls, 0);
  assert.equal(endCalls, 1);

  // The bind request itself remains pending because the fake server never
  // calls back; it must not keep the test process alive.
  void binding.catch(() => {});
});

test("port forwarding can be stopped while waiting for a key passphrase", async (t) => {
  const keyPath = createEncryptedKey(t);
  if (!keyPath) return;
  const privateKey = fs.readFileSync(keyPath, "utf8");

  const sent = [];
  let passphraseRequest;
  const promptStarted = new Promise((resolve) => {
    passphraseRequest = resolve;
  });

  const tunnelId = "pf-rule-cancel-1";
  const event = {
    sender: createCapturingSender((channel, payload) => {
      sent.push({ channel, payload });
      if (channel === "netcatty:passphrase-request") {
        passphraseRequest(payload);
      }
    }),
  };
  const startPromise = startPortForward(event, {
    ruleId: "rule-cancel-1",
    tunnelId,
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: "example.test",
    username: "alice",
    privateKey,
    keyId: "key-1",
  });

  const request = await promptStarted;
  assert.deepEqual(await getPortForwardStatus(event, { tunnelId }), {
    tunnelId,
    status: "connecting",
    type: "local",
  });
  assert.deepEqual(await listPortForwards(), [{
    ruleId: "rule-cancel-1",
    tunnelId,
    type: "local",
    status: "connecting",
  }]);

  const adoptedStatuses = [];
  const adoptedEvent = {
    sender: createCapturingSender((channel, payload) => {
      if (channel === "netcatty:portforward:status") adoptedStatuses.push(payload);
    }, 2),
  };
  assert.deepEqual(await subscribePortForward(adoptedEvent, { tunnelId }), {
    tunnelId,
    status: "connecting",
    type: "local",
  });

  assert.deepEqual(await stopPortForward(event, { tunnelId }), {
    tunnelId,
    success: true,
  });
  assert.equal(adoptedStatuses.length, 1);
  assert.equal(adoptedStatuses[0].tunnelId, tunnelId);
  assert.equal(adoptedStatuses[0].status, "inactive");
  assert.equal(adoptedStatuses[0].error, null);
  assert.equal(adoptedStatuses[0].ruleId, "rule-cancel-1");
  assert.equal(typeof adoptedStatuses[0].epoch, "string");
  assert.equal(typeof adoptedStatuses[0].revision, "number");
  assert.equal(adoptedStatuses[0].cleanupRequired, false);
  assert.deepEqual(await getPortForwardStatus(event, { tunnelId }), {
    tunnelId,
    status: "inactive",
  });

  assert.deepEqual(await startPromise, {
    tunnelId,
    success: false,
    cancelled: true,
  });
  assert.ok(sent.some((event) =>
    event.channel === "netcatty:passphrase-cancelled" &&
    event.payload.requestId === request.requestId
  ));
  assert.deepEqual(await getPortForwardStatus(event, { tunnelId }), {
    tunnelId,
    status: "inactive",
  });
});

test("port forwarding can be stopped while waiting for a matching shared transport dial", async (t) => {
  resetSshTransportRegistryForTests({ defaultIdleTtlMs: 0 });
  t.after(() => resetSshTransportRegistryForTests({ defaultIdleTtlMs: 0 }));
  const publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestPublicKey";
  const endpoint = {
    hostId: "host-shared-wait",
    hostname: "shared-wait.test",
    port: 22,
    username: "alice",
    jumpHosts: [],
    proxy: null,
    authType: "publickey",
    keyId: "key-shared-wait",
    certificate: "",
    requiresMfa: false,
    verifyHostKeys: false,
    useSshAgent: false,
    agentForwarding: false,
    publicKey,
  };
  const leader = beginTransportDial(endpoint, { kind: "channel" });
  t.after(() => failTransportDial(leader, new Error("test cleanup")));
  const tunnelId = "pf-shared-wait";
  const event = { sender: createSender() };

  const started = startPortForward(event, {
    tunnelId,
    ruleId: "rule-shared-wait",
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: endpoint.hostname,
    hostId: endpoint.hostId,
    port: endpoint.port,
    username: endpoint.username,
    authMethod: endpoint.authType,
    keyId: endpoint.keyId,
    publicKey,
    verifyHostKeys: false,
    useSshAgent: false,
  });
  await new Promise((resolve) => setImmediate(resolve));

  assert.equal(getTransportStats().pendingDials, 1, "PF joins the matching authenticated identity");
  assert.deepEqual(await getPortForwardStatus(event, { tunnelId }), {
    tunnelId,
    status: "connecting",
    type: "local",
  });
  assert.deepEqual(await stopPortForward(event, { tunnelId }), { tunnelId, success: true });
  assert.deepEqual(await started, { tunnelId, success: false, cancelled: true });
  assert.equal(getTransportStats().pendingDials, 1, "stopping a waiter does not cancel the dial leader");
});

test("port forwarding stops when the key passphrase prompt is cancelled", async (t) => {
  const keyPath = createEncryptedKey(t);
  if (!keyPath) return;
  const privateKey = fs.readFileSync(keyPath, "utf8");

  const originalRequestPassphrase = passphraseHandler.requestPassphrase;
  t.after(() => {
    passphraseHandler.requestPassphrase = originalRequestPassphrase;
  });
  passphraseHandler.requestPassphrase = async () => ({ cancelled: true });

  const tunnelId = "pf-rule-cancel-2";
  const event = { sender: createSender() };
  const result = await startPortForward(event, {
    tunnelId,
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: "example.test",
    username: "alice",
    privateKey,
    keyId: "key-1",
  });

  assert.deepEqual(result, {
    tunnelId,
    success: false,
    cancelled: true,
  });
  assert.deepEqual(await getPortForwardStatus(event, { tunnelId }), {
    tunnelId,
    status: "inactive",
  });
});

test("concurrent starts reuse the existing tunnel for the same rule", async (t) => {
  const keyPath = createEncryptedKey(t);
  if (!keyPath) return;
  const privateKey = fs.readFileSync(keyPath, "utf8");

  let promptCount = 0;
  let firstPromptStarted;
  const promptStarted = new Promise((resolve) => {
    firstPromptStarted = resolve;
  });
  const event = {
    sender: createCapturingSender((channel) => {
      if (channel === "netcatty:passphrase-request") {
        promptCount++;
        firstPromptStarted();
      }
    }),
  };
  const secondEvent = {
    sender: createCapturingSender((channel) => {
      if (channel === "netcatty:portforward:status") {
        throw new Error("renderer closed during send");
      }
    }, 2),
  };
  const thirdWindowEvents = [];
  const thirdEvent = {
    sender: createCapturingSender((channel, payload) => {
      thirdWindowEvents.push({ channel, payload });
    }, 3),
  };
  const payload = {
    ruleId: "shared-rule",
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: "example.test",
    username: "alice",
    privateKey,
    keyId: "key-shared",
  };

  const firstStart = startPortForward(event, {
    ...payload,
    tunnelId: "pf-shared-rule-first",
  });
  await promptStarted;

  const secondStart = await startPortForward(secondEvent, {
    ...payload,
    tunnelId: "pf-shared-rule-second",
  });
  const thirdStart = await startPortForward(thirdEvent, {
    ...payload,
    tunnelId: "pf-shared-rule-third",
  });

  assert.deepEqual(secondStart, {
    tunnelId: "pf-shared-rule-first",
    success: true,
    reused: true,
    status: "connecting",
  });
  assert.deepEqual(thirdStart, {
    tunnelId: "pf-shared-rule-first",
    success: true,
    reused: true,
    status: "connecting",
  });
  assert.equal(promptCount, 1);
  assert.deepEqual(await listPortForwards(), [{
    ruleId: "shared-rule",
    tunnelId: "pf-shared-rule-first",
    type: "local",
    status: "connecting",
  }]);

  assert.equal((await stopPortForwardByRuleId(event, { ruleId: "shared-rule" })).stopped, 1);
  assert.ok(thirdWindowEvents.some(({ channel, payload }) => (
    channel === "netcatty:portforward:status" &&
    payload.tunnelId === "pf-shared-rule-first" &&
    payload.status === "inactive"
  )));
  assert.equal((await firstStart).cancelled, true);
});

test("stop by rule id only cancels the matching passphrase prompt", async (t) => {
  const keyPath = createEncryptedKey(t);
  if (!keyPath) return;
  const privateKey = fs.readFileSync(keyPath, "utf8");

  const sent = [];
  const requests = [];
  let resolveBothPrompts;
  const bothPromptsStarted = new Promise((resolve) => {
    resolveBothPrompts = resolve;
  });
  const event = {
    sender: createCapturingSender((channel, payload) => {
      sent.push({ channel, payload });
      if (channel === "netcatty:passphrase-request") {
        requests.push(payload);
        if (requests.length === 2) {
          resolveBothPrompts();
        }
      }
    }),
  };

  const firstTunnelId = "pf-rule-1";
  const secondTunnelId = "pf-rule-long-1";
  const firstStart = startPortForward(event, {
    ruleId: "rule",
    tunnelId: firstTunnelId,
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: "first.example",
    username: "alice",
    privateKey,
    keyId: "key-1",
  });
  const secondStart = startPortForward(event, {
    ruleId: "rule-long",
    tunnelId: secondTunnelId,
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: "second.example",
    username: "alice",
    privateKey,
    keyId: "key-2",
  });

  await bothPromptsStarted;
  const firstRequest = requests.find((request) => request.hostname === "first.example");
  const secondRequest = requests.find((request) => request.hostname === "second.example");
  assert.ok(firstRequest);
  assert.ok(secondRequest);

  assert.deepEqual(await stopPortForwardByRuleId(event, { ruleId: "rule" }), {
    stopped: 1,
    failed: 0,
    errors: [],
  });
  assert.deepEqual(await firstStart, {
    tunnelId: firstTunnelId,
    success: false,
    cancelled: true,
  });
  assert.ok(sent.some((event) =>
    event.channel === "netcatty:passphrase-cancelled" &&
    event.payload.requestId === firstRequest.requestId
  ));
  assert.equal(sent.some((event) =>
    event.channel === "netcatty:passphrase-cancelled" &&
    event.payload.requestId === secondRequest.requestId
  ), false);
  assert.deepEqual(await getPortForwardStatus(event, { tunnelId: secondTunnelId }), {
    tunnelId: secondTunnelId,
    status: "connecting",
    type: "local",
  });

  assert.deepEqual(await stopPortForward(event, { tunnelId: secondTunnelId }), {
    tunnelId: secondTunnelId,
    success: true,
  });
  assert.deepEqual(await secondStart, {
    tunnelId: secondTunnelId,
    success: false,
    cancelled: true,
  });
});

test("stop by rule id reports cleanup failures and keeps the tunnel retryable", async (t) => {
  const keyPath = createEncryptedKey(t);
  if (!keyPath) return;
  const privateKey = fs.readFileSync(keyPath, "utf8");
  let passphraseRequest;
  const promptStarted = new Promise((resolve) => {
    passphraseRequest = resolve;
  });
  const event = {
    sender: createCapturingSender((channel, payload) => {
      if (channel === "netcatty:passphrase-request") passphraseRequest(payload);
    }),
  };
  const tunnelId = "pf-rule-cleanup-failure";
  const startPromise = startPortForward(event, {
    ruleId: "cleanup-failure-rule",
    tunnelId,
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: "cleanup-failure.example",
    username: "alice",
    privateKey,
    keyId: "cleanup-failure-key",
  });
  await promptStarted;

  const originalAbort = AbortController.prototype.abort;
  AbortController.prototype.abort = function abortFailure() {
    throw new Error("abort failed");
  };
  t.after(() => {
    AbortController.prototype.abort = originalAbort;
  });

  assert.deepEqual(await stopPortForwardByRuleId(event, { ruleId: "cleanup-failure-rule" }), {
    stopped: 0,
    failed: 1,
    errors: ["passphrase prompt: abort failed"],
  });
  assert.deepEqual(await getPortForwardStatus(event, { tunnelId }), {
    tunnelId,
    status: "error",
    type: "local",
    error: "passphrase prompt: abort failed",
  });

  assert.deepEqual(await startPortForward(event, {
    ruleId: "cleanup-failure-rule",
    tunnelId: "pf-rule-cleanup-failure-retry",
    type: "local",
    localPort: 0,
    bindAddress: "127.0.0.1",
    remoteHost: "127.0.0.1",
    remotePort: 80,
    hostname: "cleanup-failure.example",
    username: "alice",
    privateKey,
    keyId: "cleanup-failure-key",
  }), {
    tunnelId,
    success: false,
    blockedByCleanup: true,
    error: "The existing tunnel could not be cleaned up. Stop it successfully before restarting.",
  });

  AbortController.prototype.abort = originalAbort;
  assert.deepEqual(await stopPortForwardByRuleId(event, { ruleId: "cleanup-failure-rule" }), {
    stopped: 1,
    failed: 0,
    errors: [],
  });
  assert.deepEqual(await startPromise, {
    tunnelId,
    success: false,
    cancelled: true,
  });
});