import { expect, test } from "bun:test";
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

process.env.FORGE_APP_DATA = mkdtempSync(join(tmpdir(), "app-"));
process.env.PORT = "0";
const { server } = await import("./server.ts");
const { match, snapshot, advance, takeSeat, release, releaseAddress } = await import("./arena.ts");
const { visible } = await import("./match.ts");
const base = `http://${server.hostname}:${server.port}`;

test("serves a live match on the first paint, with no script needed", async () => {
  const response = await fetch(base + "/");
  expect(response.status).toBe(200);
  const body = await response.text();
  expect(body).toContain("<h1>val</h1>");
  // The score, the round and both team sheets are in the HTML itself.
  expect(body).toContain("red " + match().score.red);
  expect(body).toContain("round " + match().round);
  for (const player of match().players) expect(body).toContain(player.name);
});

test("the page hands out a session cookie and the script is named by content", async () => {
  const response = await fetch(base + "/", { redirect: "manual" });
  const cookie = response.headers.get("set-cookie") ?? "";
  expect(cookie).toContain("val_session=");
  expect(cookie).toContain("HttpOnly");
  const body = await response.text();
  const src = /src="(\/static\/val\.[0-9a-f]+\.js)"/.exec(body);
  expect(src).not.toBe(null);
  const script = await fetch(base + src![1]!);
  expect(script.status).toBe(200);
  expect(script.headers.get("cache-control")).toContain("immutable");
  expect(await script.text()).toContain("WebSocket");
});

test("a name is taken from a same-origin form and sanitised", async () => {
  // Every test in this file reaches the server from the same address, and a
  // playing seat is rationed per address on purpose. Earlier tests here take
  // that seat and never open a socket to close, so nothing frees it: without
  // this line the join below is correctly refused and the assertion measures
  // the leftovers of another test rather than this one's behaviour.
  releaseAddress("127.0.0.1");
  releaseAddress("::1");
  releaseAddress("::ffff:127.0.0.1");
  const form = new FormData();
  form.set("name", '  Wren<script>"  ');
  const posted = await fetch(base + "/join", { method: "POST", body: form, redirect: "manual" });
  expect(posted.status).toBe(303);
  const cookie = posted.headers.getSetCookie().join(" ");
  expect(cookie).toContain("val_name=");
  // The angle brackets and the quote never reach the cookie or the match.
  expect(cookie).not.toContain("<");
  expect(cookie).not.toContain("%3C");
  expect(match().players.every((p) => !p.name.includes("<"))).toBe(true);
  // The seat that name took is a real player in the running match.
  expect(match().players.some((p) => !p.bot && p.name.includes("Wren"))).toBe(true);

  // A join never opens a socket to close, so nothing ever frees the address
  // it claimed on its own; every other test in this run shares this same
  // loopback address, so free it explicitly rather than starve them of it.
  const sessionCookie = posted.headers.getSetCookie().find((c) => c.startsWith("val_session="));
  const session = sessionCookie?.split(";")[0]?.split("=")[1];
  if (session) release(session, "");
});

test("refuses a cross-site post", async () => {
  const form = new FormData();
  form.set("name", "Evil");
  const posted = await fetch(base + "/join", {
    method: "POST",
    body: form,
    redirect: "manual",
    headers: { origin: "https://evil.example", "sec-fetch-site": "cross-site" },
  });
  expect(posted.status).toBe(403);
  expect(match().players.some((p) => p.name === "Evil")).toBe(false);
});

test("stands on the security floor", async () => {
  const response = await fetch(base + "/");
  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
  expect(response.headers.get("x-content-type-options")).toBe("nosniff");
  const missing = await fetch(base + "/nope");
  expect(missing.status).toBe(404);
  expect(missing.headers.get("content-security-policy")).toContain("default-src 'self'");
});

test("a bug answers with the floor, not the runtime's page", async () => {
  // A percent-escape that is not one: whether the runtime decodes it or
  // throws, the answer carries the floor and never a stack trace.
  const response = await fetch(base + "/join", {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: "name=%E0%A4%A",
    redirect: "manual",
  });
  expect([303, 500]).toContain(response.status);
  expect(await response.text()).not.toContain("src/server.ts");
  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
});

test("a body is capped by the bytes read, whatever it claims", async () => {
  const response = await fetch(base + "/join", {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: "name=" + "x".repeat(1024 * 1024),
  });
  expect(response.status).toBe(413);
});

test("HEAD sees the app up", async () => {
  const response = await server.fetch(new Request(base + "/", { method: "HEAD" }));
  expect(response.status).toBe(200);
  expect(await response.text()).toBe("");
});

test("the map is served as data, once, for the client to draw", async () => {
  const response = await fetch(base + "/map.json");
  const body = (await response.json()) as { rows: string[]; tile: number };
  expect(body.tile).toBe(80);
  expect(body.rows.length).toBeGreaterThan(10);
  expect(body.rows.some((r) => r.includes("A"))).toBe(true);
  expect(body.rows.some((r) => r.includes("B"))).toBe(true);
});

test("a websocket is refused to another site", async () => {
  const response = await server.fetch(
    new Request(base + "/ws", { headers: { "sec-fetch-site": "cross-site", origin: "https://evil.example" } }),
  );
  expect(response.status).toBe(403);
});

test("a snapshot only carries the enemies that viewer can see", () => {
  const state = match();
  const viewer = state.players.find((p) => p.side === "atk")!;
  const enemy = state.players.find((p) => p.side === "def")!;
  viewer.x = 1200;
  viewer.y = 1320;
  viewer.blind = 0;
  // Both of them alive on purpose: the arena is one live match that other
  // tests run forward, and a dead enemy is invisible for a different reason
  // than the one this test is about.
  viewer.alive = true;
  enemy.alive = true;
  enemy.x = 1200;
  enemy.y = 1240;
  enemy.revealed = 0;
  const near = JSON.parse(snapshot(viewer.id)) as { players: { id: string }[] };
  expect(near.players.some((p) => p.id === enemy.id)).toBe(true);
  // Behind the wall on the far side of the map, the same enemy is gone.
  enemy.x = 200;
  enemy.y = 200;
  const far = JSON.parse(snapshot(viewer.id)) as { players: { id: string }[]; board: unknown[] };
  expect(far.players.some((p) => p.id === enemy.id)).toBe(false);
  // The scoreboard still lists everyone; it carries no position.
  expect(far.board.length).toBe(10);
  expect(JSON.stringify(far.board)).not.toContain('"x"');
});

test("the whole snapshot carries no id or position of a body the viewer cannot see", () => {
  // Generic on purpose: this scans the whole stringified payload rather
  // than one named field, so it would have caught each of the three leaks
  // of this shape — a hidden body's id or coordinate reaching the wire
  // through some field other than `players` — and would catch a fourth.
  const state = match();
  const viewer = state.players.find((p) => p.side === "atk")!;
  viewer.x = 1200;
  viewer.y = 1320;
  viewer.blind = 0;
  viewer.alive = true;
  const enemy = state.players.find((p) => p.side === "def")!;
  enemy.alive = true;
  enemy.revealed = 0;
  // A distinctive decimal, not a round number, so it cannot be mistaken for
  // an unrelated field (hp, credits, damage) that legitimately holds 200.
  enemy.x = 217.3;
  enemy.y = 233.9;
  expect(visible(state, viewer, enemy)).toBe(false);

  // A molly lands at the thrower's own feet — the shape any thrown ability
  // takes — planted on the enemy this viewer cannot see.
  const zoneId = state.nextZone++;
  state.zones.push({
    id: zoneId,
    kind: "molly",
    owner: enemy.id,
    side: enemy.side,
    x: enemy.x,
    y: enemy.y,
    r: 40,
    life: 5,
    fuse: 0,
    beat: 0,
    pulses: 0,
    damage: 0,
    blocks: false,
    solid: false,
  });

  const text = snapshot(viewer.id);
  const round2 = (n: number) => Math.round(n * 10) / 10;
  // A number counts only bare, not as a substring of a larger one — "217.3"
  // inside "1217.3" would be a false alarm, "217.3" on its own is the leak.
  const bare = (n: number) => new RegExp(String.raw`(?<![\d.-])${n}(?![\d.])`);
  // The scoreboard is a named, reviewed exception: it lists every id on
  // purpose (kills, deaths, credits for the whole match), never a position.
  // The id check walks everything else; the position check still walks the
  // scoreboard too, so a coordinate added there would still be caught.
  const { board: _board, ...rest } = JSON.parse(text) as Record<string, unknown>;
  expect(JSON.stringify(rest)).not.toContain(JSON.stringify(enemy.id));
  expect(bare(round2(enemy.x)).test(text)).toBe(false);
  expect(bare(round2(enemy.y)).test(text)).toBe(false);

  state.zones = state.zones.filter((z) => z.id !== zoneId);
});

test("a command from a seat plants the spike, and nonsense from anyone else does nothing", async () => {
  const { command } = await import("./arena.ts");
  const { siteCentre } = await import("./map.ts");
  const state = match();
  state.phase = "live";
  state.clock = 100;
  const spot = siteCentre("B");
  const carrier = state.players.find((p) => p.side === "atk")!;
  // Nobody is a bot for these five seconds: no fight can end the round
  // underneath the plant and make this depend on who shot whom. And nobody
  // else is mid-plant: this arena is live and shared, and once in a dozen
  // runs a bot was standing on A with the spike and F held when this test
  // began. Left with `spike` set and `use` held, it planted on A first, and
  // every seat test after this one failed because the bots were never
  // restored — the deploy gate's coin flip.
  for (const player of state.players) {
    player.bot = false;
    player.alive = true;
    player.hp = 100;
    player.spike = false;
    player.planting = 0;
    player.input.fire = false;
    player.input.use = false;
    player.input.mx = 0;
    player.input.my = 0;
  }
  try {
    carrier.x = spot.x;
    carrier.y = spot.y;
    carrier.spike = true;
    state.spike = { carried: carrier.id, x: spot.x, y: spot.y, planted: false, fuse: 0, site: null, defuse: 0, checkpoint: 0 };
    // Garbage is ignored, and a seat nobody holds cannot be driven.
    command(carrier.id, { t: "i", mx: "left" as unknown as number, a: Number.NaN, u: "yes" });
    command("nobody", { t: "i", u: true });
    expect(carrier.input.use).toBe(false);
    command(carrier.id, { t: "i", u: true, mx: 0, my: 0 });
    advance(5);
    expect(state.spike.planted).toBe(true);
    expect(state.spike.site).toBe("B");
  } finally {
    for (const player of state.players) player.bot = true;
  }
});

test("the scoreboard is sent when it changes and left out when it has not", async () => {
  // Ten names, agents and tallies were almost half of every snapshot, thirty
  // times a second, for a table that changes a few times a round. A seat is
  // sent it the first time and again only when it differs.
  const { snapshotForSeat } = await import("./arena.ts");
  const state = match();
  const player = state.players[0]!;
  const seat = { playerId: player.id, token: "t", address: "198.51.100.200", send: () => {}, stickyCache: "" };
  const first = JSON.parse(snapshotForSeat(seat)) as { board?: unknown[]; last?: unknown };
  expect(first.board?.length).toBe(10);
  const second = JSON.parse(snapshotForSeat(seat)) as { board?: unknown[] };
  expect(second.board).toBeUndefined();
  // Something on the board moves — a kill — and it comes back with the next tick.
  player.kills += 1;
  const third = JSON.parse(snapshotForSeat(seat)) as { board?: { kills: number }[] };
  expect(third.board?.length).toBe(10);
  expect(third.board?.find((p) => (p as { id?: string }).id === player.id)?.kills).toBe(player.kills);
  // The full snapshot a socket is handed on open, and every test reads, is untouched.
  expect((JSON.parse(snapshot(player.id)) as { board: unknown[] }).board.length).toBe(10);
  // The bytes: the board is the bulk of what was going out.
  const withBoard = Buffer.byteLength(snapshot(player.id));
  const without = Buffer.byteLength(snapshotForSeat(seat));
  expect(without).toBeLessThan(withBoard * 0.7);
});

test("the match keeps running and is never parked", () => {
  const state = match();
  const before = state.now;
  advance(30);
  expect(state.now).toBeGreaterThan(before);
  expect(["buy", "live", "end", "over"]).toContain(state.phase);
});

test("the kit is public: every ability, its price and what it does", async () => {
  const response = await fetch(base + "/agents.json");
  expect(response.status).toBe(200);
  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
  const body = (await response.json()) as { agents: { id: string; abilities: Record<string, { name: string; cost: number; text: string }> }[] };
  expect(body.agents.length).toBe(5);
  const veil = body.agents.find((a) => a.id === "veil")!;
  expect(veil.abilities.c.name).toBe("Cloudburst");
  expect(veil.abilities.c.cost).toBe(100);
  expect(veil.abilities.e.text).toContain("smoke");
  // The ultimate is never for sale, and no server-only state leaks out.
  expect(veil.abilities.x.cost).toBe(0);
  expect(JSON.stringify(body)).not.toContain("kind");
});

test("the page carries the first-run card and the prompt line", async () => {
  const body = await (await fetch(base + "/")).text();
  expect(body).toContain('id="help"');
  expect(body).toContain("How to play");
  expect(body).toContain('id="prompt"');
  // Every buy button says what it costs, so the panel is readable at a glance,
  // and the rows are labelled for somebody meeting the panel for the first
  // time: which of these is a gun, which is armour, which is an ability.
  expect(body).toContain('data-buy="vandal" data-cost="2900"');
  for (const label of ["agent", "gun", "armour", "abilities"]) expect(body).toContain(`<span class="lbl">${label}</span>`);
  expect(body).not.toContain("refused server-side");
  expect(body).toContain('id="viewtoggle"');
});

test("the first paint says who took the round while it is over", async () => {
  // Somebody arriving between rounds used to read "round over" and nothing
  // else; the outcome was in the log three lines down at eighty percent.
  const state = match();
  const was = { phase: state.phase, clock: state.clock, last: state.last };
  state.phase = "end";
  state.clock = 4;
  state.last = { round: state.round, winner: "blue", why: "Spike defused" };
  try {
    const body = await (await fetch(base + "/")).text();
    expect(body).toContain("round over — blue took it, spike defused");
  } finally {
    Object.assign(state, was);
  }
});

test("a stale socket closing does not evict a live reconnect's seat", async () => {
  // A reload opens the new socket before the old one's close event lands.
  // The old close must not turn a player who is still connected into a bot.
  const { attach, release } = await import("./arena.ts");
  const player = takeSeat("203.0.113.1", "reload-session", "Reload")!;
  attach("reload-session", player.id, "203.0.113.1", "first", () => {});
  attach("reload-session", player.id, "203.0.113.1", "second", () => {});
  release("reload-session", "first");
  expect(player.bot).toBe(false);
});

test("one session cannot claim two seats on opposite teams", () => {
  // A websocket upgrade finishes on a later tick than the request that asked
  // for it, so two requests for the same session used to both read the seat
  // map before either had written to it — one client, two seats, opposite
  // sides, the vision of both. Nothing here waits for a socket to open:
  // the claim has to land the moment a seat is handed out.
  const first = takeSeat("203.0.113.2", "cheat-session", "Cheat")!;
  const second = takeSeat("203.0.113.2", "cheat-session", "Cheat")!;
  expect(second.id).toBe(first.id);
  expect(match().players.filter((p) => !p.bot && p.name === "Cheat").length).toBe(1);
});

test("one address cannot hold seats on both sides through a second session", async () => {
  // Three GETs of "/" mint three different, equally legitimate-looking
  // cookies. A session names a browser tab, not a person, so capping by
  // session alone still lets one machine sit on both teams and read both
  // snapshots — every position on the map, no forged traffic required.
  const { addressCapped } = await import("./arena.ts");
  const first = takeSeat("198.51.100.9", "session-a", "OneMachine")!;
  expect(addressCapped("198.51.100.9", "session-b")).toBe(true);
  const second = takeSeat("198.51.100.9", "session-b", "OneMachine");
  expect(second).toBe(null);
  // The same session reconnecting is not a second claim, and is let through.
  expect(addressCapped("198.51.100.9", "session-a")).toBe(false);
  expect(takeSeat("198.51.100.9", "session-a", "OneMachine")!.id).toBe(first.id);
});

test("a real second connection from one address gets a spectator view, positions and all excluded", async () => {
  // The end-to-end path: two sockets from this test's own loopback address,
  // one cookie each. The second must come back with no seat and nothing in
  // its snapshot that carries a coordinate — score and clock, not a map.
  // This loopback address is shared with every other test that runs a real
  // request; start from a clean slate rather than trust none of them left it
  // holding a seat.
  releaseAddress("127.0.0.1");
  const first = await fetch(base + "/");
  const cookieOne = (first.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
  const second = await fetch(base + "/");
  const cookieTwo = (second.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
  expect(cookieOne).not.toBe(cookieTwo);

  const wsUrl = base.replace(/^http/, "ws") + "/ws";
  const wsOne = new WebSocket(wsUrl, { headers: { cookie: cookieOne } } as unknown as string[]);
  const snapOne = await new Promise<{ spectator?: boolean; me?: unknown }>((resolve, reject) => {
    wsOne.onmessage = (event) => resolve(JSON.parse(String(event.data)));
    wsOne.onerror = reject;
  });
  // The first connection from this address is the one that actually plays.
  expect(snapOne.spectator).toBeUndefined();
  expect(snapOne.me).toBeDefined();

  const wsTwo = new WebSocket(wsUrl, { headers: { cookie: cookieTwo } } as unknown as string[]);
  const snapTwo = await new Promise<unknown>((resolve, reject) => {
    wsTwo.onmessage = (event) => resolve(JSON.parse(String(event.data)));
    wsTwo.onerror = reject;
  });
  // It says why it has no seat, because the two reasons have different
  // answers, and it carries the kill feed — names and a gun, never a place.
  expect(snapTwo).toMatchObject({ t: "s", spectator: true, why: "address" });
  expect(Array.isArray((snapTwo as { feed?: unknown[] }).feed)).toBe(true);
  // No coordinate anywhere, not under "me", not under a different key either.
  expect(JSON.stringify(snapTwo)).not.toMatch(/"x"|"y"/);

  // And a connection carrying no session at all is told the other reason.
  const wsThree = new WebSocket(wsUrl);
  const snapThree = await new Promise<unknown>((resolve, reject) => {
    wsThree.onmessage = (event) => resolve(JSON.parse(String(event.data)));
    wsThree.onerror = reject;
  });
  expect(snapThree).toMatchObject({ spectator: true, why: "cookie" });

  wsOne.close();
  wsTwo.close();
  wsThree.close();
  await Bun.sleep(50);
});

test("two people who pick the same name do not end up with the same name", () => {
  // Everything that addresses a player — the kill feed, the round log, the
  // scoreboard — does it by name, so the match may never hold two of one.
  const first = takeSeat("198.51.100.10", "clash-a", "Twin")!;
  const second = takeSeat("198.51.100.11", "clash-b", "Twin")!;
  expect(first.name).toBe("Twin");
  expect(second.name).not.toBe("Twin");
  expect(second.name.startsWith("Twin")).toBe(true);
  expect(second.name.length).toBeLessThanOrEqual(16);
  const names = match().players.map((p) => p.name);
  expect(new Set(names).size).toBe(names.length);
});

test("an empty room freezes the world instead of playing on", async () => {
  const { match, beat, takeSeat, attach, release } = await import("./arena.ts");
  // Whatever else this file left attached, the rule is about the gate itself:
  // with nobody there a beat of real time changes nothing.
  const { attendance } = await import("./arena.ts");
  const start = attendance();
  const quiet = { now: match().now, round: match().round };
  if (start === 0) {
    for (let i = 0; i < 450; i += 1) beat();
    expect({ now: match().now, round: match().round }).toEqual(quiet);
  }

  // Somebody arrives and time starts again from where it stopped.
  const seat = takeSeat("198.51.100.77", "empty-room-session", "Guest");
  expect(seat).not.toBeNull();
  attach("empty-room-session", seat!.id, "198.51.100.77", "tok", () => {});
  const before = match().now;
  for (let i = 0; i < 30; i += 1) beat();
  expect(match().now).toBeGreaterThan(before);
  release("empty-room-session", "tok");
});

test("attendance counts seats and watchers, and nothing else", async () => {
  const { attendance, takeSeat, attach, release, watch, unwatch } = await import("./arena.ts");
  const base = attendance();
  const seat = takeSeat("198.51.100.78", "counted-session", "Guest");
  attach("counted-session", seat!.id, "198.51.100.78", "tok2", () => {});
  expect(attendance()).toBe(base + 1);
  watch("watcher-token", () => {});
  expect(attendance()).toBe(base + 2);
  unwatch("watcher-token");
  release("counted-session", "tok2");
  expect(attendance()).toBe(base);
});