// @vitest-environment node
import {afterEach,describe,expect,it,vi} from 'vitest'
import {createHash,randomUUID} from 'node:crypto'
import {RunnerBrowser} from '../../src/runner/managedBrowser.js'
import type {BrowserRuntime,BrowserCallContext,BrowserScope} from '../../src/runner/browser/runtime.js'

const scope:BrowserScope={ownerKey:'a'.repeat(64),environmentId:randomUUID(),profile:'persistent'},grantId=randomUUID()
const scopes:RunnerBrowser[]=[]
function fixture(config:{enabled:boolean;idleTimeoutMs?:number}={enabled:true}){
  const runtime={status:vi.fn(async()=>({open:false,generation:1,tabs:[],downloads:[]})),open:vi.fn(async()=>({open:true,generation:1,tabs:[],downloads:[]})),execute:vi.fn(async()=>({ok:true})),pause:vi.fn(),resume:vi.fn(),close:vi.fn(),readDownload:vi.fn(),revoke:vi.fn(async()=>{}),shutdown:vi.fn(async()=>{})}
  const check=vi.fn(async(_scope:BrowserScope,_grant?:string)=>{}),probe=vi.fn(async()=>true)
  const browser=new RunnerBrowser(config,'/unused-browser-test',check,{runtime:runtime as unknown as BrowserRuntime,probe});scopes.push(browser)
  const profileAllowed=vi.fn((_profile:string)=>{})
  const invoke=(value:Record<string,unknown>,expiresAt=Date.now()+30000)=>browser.invoke({scope,profile:'default',grantId,...value},expiresAt,profileAllowed)
  return {browser,runtime,check,probe,profileAllowed,invoke}
}
afterEach(async()=>{vi.useRealTimers();for(const browser of scopes.splice(0))await browser.shutdown()})

describe('managed browser Runner transport',()=>{
  it('keeps default-disabled and missing-browser installations unavailable',async()=>{
    const f=fixture({enabled:false});await f.browser.ready
    expect(f.browser.available).toBe(false);expect(f.probe).not.toHaveBeenCalled()
    await expect(f.invoke({op:'open'})).rejects.toMatchObject({code:'browser_unavailable'})
    expect(f.runtime.open).not.toHaveBeenCalled()
    const unavailable=new RunnerBrowser({enabled:true},'/unused',async()=>{}, {runtime:f.runtime as unknown as BrowserRuntime,probe:async()=>false});scopes.push(unavailable)
    await unavailable.ready;expect(unavailable.available).toBe(false)
  })
  it('rejects forbidden Profiles, expired commands and foreign grants before execution',async()=>{
    const f=fixture();f.profileAllowed.mockImplementationOnce(()=>{throw new Error('profile forbidden')})
    await expect(f.invoke({op:'open'})).rejects.toThrow('profile forbidden')
    await expect(f.invoke({op:'open'},Date.now()-1)).rejects.toMatchObject({code:'browser_command_expired'})
    f.check.mockRejectedValueOnce(new Error('foreign grant'))
    await expect(f.invoke({op:'open'})).rejects.toThrow('foreign grant')
    expect(f.runtime.open).not.toHaveBeenCalled()
  })
  it('retains the explicit task grant for background activity after the command deadline',async()=>{
    vi.useFakeTimers();const f=fixture();let context:BrowserCallContext|undefined
    f.runtime.open.mockImplementationOnce(async(_scope?:unknown,call?:BrowserCallContext)=>{context=call;return {open:true,generation:1,tabs:[],downloads:[]}})
    await f.invoke({op:'open'},Date.now()+1000)
    await vi.advanceTimersByTimeAsync(5000)
    await context!.authorize()
    expect(f.check).toHaveBeenLastCalledWith(scope,grantId)
    expect(context!.signal!.aborted).toBe(false)
    f.check.mockRejectedValueOnce(new Error('grant revoked'))
    await expect(context!.authorize()).rejects.toThrow('grant revoked')
  })
  it('aborts in-flight execution when its transport deadline expires',async()=>{
    vi.useFakeTimers();const f=fixture()
    f.runtime.execute.mockImplementationOnce(async(_scope?:unknown,_operation?:unknown,context?:BrowserCallContext)=>new Promise((_resolve,reject)=>context!.signal!.addEventListener('abort',()=>reject(context!.signal!.reason),{once:true})))
    const result=f.invoke({op:'execute',operation:{generation:1,operationId:'slow',action:{kind:'text',text:'test'}}},Date.now()+1000).catch(error=>error)
    await vi.advanceTimersByTimeAsync(2100)
    expect(await result).toMatchObject({code:'browser_command_expired'})
    expect(f.runtime.execute).toHaveBeenCalledTimes(1)
  })
  it('disconnect aborts current calls and revokes all opened scopes',async()=>{
    const f=fixture()
    f.runtime.execute.mockImplementationOnce(async(_scope?:unknown,_operation?:unknown,context?:BrowserCallContext)=>new Promise((_resolve,reject)=>context!.signal!.addEventListener('abort',()=>reject(context!.signal!.reason),{once:true})))
    const result=f.invoke({op:'execute',operation:{generation:1,operationId:'inflight',action:{kind:'screenshot'}}}).catch(error=>error)
    await vi.waitFor(()=>expect(f.runtime.execute).toHaveBeenCalled())
    await f.browser.disconnect();expect(await result).toBeInstanceOf(Error)
    expect(f.runtime.revoke).toHaveBeenCalledWith(scope)
  })
  it('serves validated 512-KiB chunks, rechecking grants even for cached files',async()=>{
    const f=fixture(),id=randomUUID(),buffer=Buffer.alloc(512*1024+7,97),sha256=createHash('sha256').update(buffer).digest('hex')
    f.runtime.readDownload.mockResolvedValue({name:'large.txt',mimeType:'text/plain',buffer,metadata:{id,name:'large.txt',mimeType:'text/plain',size:buffer.length,sha256,url:'https://example.com/file',createdAt:Date.now()}})
    const first=await f.invoke({op:'download',downloadId:id,offset:0}) as {data:string;offset:number;done:boolean;sha256:string}
    const last=await f.invoke({op:'download',downloadId:id,offset:512*1024}) as typeof first
    expect(Buffer.from(first.data,'base64')).toHaveLength(512*1024);expect(first.done).toBe(false)
    expect(Buffer.from(last.data,'base64')).toHaveLength(7);expect(last.done).toBe(true);expect(last.sha256).toBe(sha256)
    expect(f.runtime.readDownload).toHaveBeenCalledTimes(1)
    await expect(f.invoke({op:'download',downloadId:id,offset:buffer.length+1})).rejects.toMatchObject({code:'browser_download_invalid'})
    f.check.mockRejectedValueOnce(new Error('download grant revoked'))
    await expect(f.invoke({op:'download',downloadId:id,offset:0})).rejects.toThrow('download grant revoked')
    await f.invoke({op:'close'});await f.invoke({op:'download',downloadId:id,offset:0})
    expect(f.runtime.readDownload).toHaveBeenCalledTimes(2)
  })
  it('rejects invalid upload bytes and removes idle or unauthorized browser scopes',async()=>{
    vi.useFakeTimers();const f=fixture({enabled:true,idleTimeoutMs:60000})
    await expect(f.invoke({op:'execute',upload:{id:randomUUID(),name:'file',mimeType:'text/plain',data:'a'}})).rejects.toMatchObject({code:'browser_upload_limit'})
    expect(f.runtime.execute).not.toHaveBeenCalled()
    await f.invoke({op:'open'});await vi.advanceTimersByTimeAsync(61000);await f.browser.sweep()
    expect(f.runtime.revoke).toHaveBeenCalledWith(scope)
    f.runtime.revoke.mockClear();await f.invoke({op:'open'});f.check.mockRejectedValueOnce(new Error('owner disabled'));await f.browser.sweep()
    expect(f.runtime.revoke).toHaveBeenCalledWith(scope)
  })
})