/**
 * @jest-environment node
 * Comprehensive tests for auth-manager.js
 * Tests JWT generation/validation, API key management, and security boundaries
 */

const jwt = require('jsonwebtoken');
const crypto = require('crypto');
const AuthManager = require('../auth-manager');
const credentialManager = require('../credential-manager');

// Mock credential manager
jest.mock('../credential-manager');
jest.mock('../logger-utils', () => ({
  safeLog: jest.fn()
}));

describe('AuthManager', () => {
  let authManager;

  beforeEach(() => {
    authManager = new AuthManager();
    jest.clearAllMocks();
    credentialManager.save.mockResolvedValue(true);
    credentialManager.get.mockResolvedValue(null);
    credentialManager.delete.mockResolvedValue(true);
    credentialManager.list.mockResolvedValue([]);
  });

  describe('JWT Generation', () => {
    test('should generate valid JWT token', async () => {
      const payload = { sub: 'user123', role: 'admin' };
      const token = await authManager.generateJWT(payload);

      expect(token).toBeDefined();
      expect(typeof token).toBe('string');
      expect(token.split('.')).toHaveLength(3); // JWT has 3 parts
    });

    test('should include required claims in JWT', async () => {
      const payload = { sub: 'user123', role: 'admin' };
      const token = await authManager.generateJWT(payload);
      const decoded = jwt.decode(token);

      expect(decoded.sub).toBe('user123');
      expect(decoded.role).toBe('admin');
      expect(decoded.iat).toBeDefined();
      expect(decoded.exp).toBeDefined();
      expect(decoded.scope).toEqual(['read', 'write']); // default scopes
    });

    test('should respect custom expiration time', async () => {
      const payload = { sub: 'user123' };
      const token = await authManager.generateJWT(payload, '1h');
      const decoded = jwt.decode(token);

      const expectedExp = decoded.iat + 3600; // 1 hour = 3600 seconds
      expect(decoded.exp).toBeCloseTo(expectedExp, -1); // Allow 1 sec tolerance
    });

    test('should include custom scopes', async () => {
      const payload = { sub: 'user123', scope: ['read'] };
      const token = await authManager.generateJWT(payload);
      const decoded = jwt.decode(token);

      expect(decoded.scope).toEqual(['read']);
    });

    test('should reject JWT generation without sub claim', async () => {
      const payload = { role: 'admin' }; // Missing sub
      await expect(authManager.generateJWT(payload))
        .rejects.toThrow('JWT payload must include "sub"');
    });

    test('should reject JWT generation with null payload', async () => {
      await expect(authManager.generateJWT(null))
        .rejects.toThrow();
    });
  });

  describe('JWT Verification', () => {
    test('should verify valid JWT token', async () => {
      const payload = { sub: 'user123', role: 'admin' };
      const token = await authManager.generateJWT(payload);
      const verified = await authManager.verifyJWT(token);

      expect(verified).toBeDefined();
      expect(verified.userId).toBe('user123');
      expect(verified.scope).toEqual(['read', 'write']);
      expect(verified.iat).toBeDefined();
      expect(verified.exp).toBeDefined();
    });

    test('should reject invalid JWT token', async () => {
      const invalidToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.invalid.signature';
      const verified = await authManager.verifyJWT(invalidToken);

      expect(verified).toBeNull();
    });

    test('should reject malformed JWT token', async () => {
      const verified = await authManager.verifyJWT('not-a-jwt-token');
      expect(verified).toBeNull();
    });

    test('should reject expired JWT token', async () => {
      const payload = { sub: 'user123' };
      const token = await authManager.generateJWT(payload, '-1s'); // Already expired

      // Wait a tiny bit to ensure expiration
      await new Promise(resolve => setTimeout(resolve, 100));

      const verified = await authManager.verifyJWT(token);
      expect(verified).toBeNull();
    });

    test('should reject JWT with wrong signature', async () => {
      const payload = { sub: 'user123' };
      const wrongSecret = 'wrong-secret-key';
      const token = jwt.sign(payload, wrongSecret);

      const verified = await authManager.verifyJWT(token);
      expect(verified).toBeNull();
    });

    test('should handle empty token gracefully', async () => {
      const verified = await authManager.verifyJWT('');
      expect(verified).toBeNull();
    });

    test('should handle null token gracefully', async () => {
      const verified = await authManager.verifyJWT(null);
      expect(verified).toBeNull();
    });
  });

  describe('API Key Generation', () => {
    test('should generate valid API key', async () => {
      const result = await authManager.generateAPIKey('test-key');

      expect(result).toBeDefined();
      expect(result.key).toMatch(/^dk_[a-f0-9]{32}_[a-f0-9]{64}$/);
      expect(result.id).toMatch(/^[a-f0-9]{32}$/);
      expect(result.name).toBe('test-key');
      expect(result.scopes).toEqual(['read', 'write']);
      expect(result.createdAt).toBeDefined();
    });

    test('should generate unique API keys', async () => {
      const key1 = await authManager.generateAPIKey('key1');
      const key2 = await authManager.generateAPIKey('key2');

      expect(key1.key).not.toBe(key2.key);
      expect(key1.id).not.toBe(key2.id);
    });

    test('should accept custom scopes', async () => {
      const result = await authManager.generateAPIKey('readonly-key', ['read']);

      expect(result.scopes).toEqual(['read']);
    });

    test('should store API key in credential manager', async () => {
      await authManager.generateAPIKey('test-key');

      expect(credentialManager.save).toHaveBeenCalledWith(
        expect.stringMatching(/^auth\.apikey\./),
        expect.objectContaining({
          keySecret: expect.any(String)
        })
      );
    });

    test('should store API key metadata', async () => {
      await authManager.generateAPIKey('test-key', ['read']);

      expect(credentialManager.save).toHaveBeenCalledWith(
        expect.stringMatching(/^auth\.metadata\./),
        expect.objectContaining({
          name: 'test-key',
          scopes: ['read'],
          createdAt: expect.any(String)
        })
      );
    });

    test('should reject API key generation without name', async () => {
      await expect(authManager.generateAPIKey(''))
        .rejects.toThrow('API key name is required');

      await expect(authManager.generateAPIKey(null))
        .rejects.toThrow('API key name is required');

      await expect(authManager.generateAPIKey(undefined))
        .rejects.toThrow('API key name is required');
    });

    test('should reject non-string name', async () => {
      await expect(authManager.generateAPIKey(123))
        .rejects.toThrow('API key name is required');

      await expect(authManager.generateAPIKey({}))
        .rejects.toThrow('API key name is required');
    });
  });

  describe('API Key Validation', () => {
    test('should validate correct API key', async () => {
      const { key, id } = await authManager.generateAPIKey('test-key');

      // Mock credential manager to return the stored key
      credentialManager.get.mockResolvedValueOnce({
        keySecret: key.split('_')[2]
      });
      credentialManager.get.mockResolvedValueOnce({
        name: 'test-key',
        scopes: ['read', 'write'],
        createdAt: new Date().toISOString()
      });

      const validated = await authManager.validateAPIKey(key);

      expect(validated).toBeDefined();
      expect(validated.valid).toBe(true);
      expect(validated.keyId).toBe(id);
      expect(validated.scopes).toEqual(['read', 'write']);
    });

    test('should reject malformed API key', async () => {
      const validated = await authManager.validateAPIKey('not-an-api-key');

      expect(validated.valid).toBe(false);
    });

    test('should reject API key with wrong prefix', async () => {
      const validated = await authManager.validateAPIKey('sk_abc123_def456');

      expect(validated.valid).toBe(false);
    });

    test('should reject non-existent API key', async () => {
      const fakeKey = 'dk_' + crypto.randomBytes(16).toString('hex') + '_' + crypto.randomBytes(32).toString('hex');
      credentialManager.get.mockResolvedValue(null); // Key doesn't exist

      const validated = await authManager.validateAPIKey(fakeKey);

      expect(validated.valid).toBe(false);
    });

    test('should reject revoked API key', async () => {
      const { key } = await authManager.generateAPIKey('test-key');

      credentialManager.get.mockResolvedValueOnce({
        keySecret: key.split('_')[2],
        revoked: true // Key is revoked
      });

      const validated = await authManager.validateAPIKey(key);

      expect(validated.valid).toBe(false);
    });

    test('should handle null key gracefully', async () => {
      const validated = await authManager.validateAPIKey(null);

      expect(validated.valid).toBe(false);
    });

    test('should handle empty key gracefully', async () => {
      const validated = await authManager.validateAPIKey('');

      expect(validated.valid).toBe(false);
    });
  });

  describe('API Key Revocation', () => {
    test('should revoke API key', async () => {
      const { id } = await authManager.generateAPIKey('test-key');

      credentialManager.get.mockResolvedValue({
        keySecret: 'test-secret'
      });

      const revoked = await authManager.revokeAPIKey(id);

      expect(revoked).toBe(true);
      expect(credentialManager.save).toHaveBeenCalledWith(
        `auth.apikey.${id}`,
        expect.objectContaining({
          revoked: true,
          revokedAt: expect.any(String)
        })
      );
    });

    test('should reject revoking non-existent key', async () => {
      credentialManager.get.mockResolvedValue(null);

      await expect(authManager.revokeAPIKey('nonexistent'))
        .rejects.toThrow();
    });
  });

  describe('API Key Listing', () => {
    test('should list all API keys with metadata', async () => {
      credentialManager.list.mockResolvedValue([
        'auth.metadata.key1',
        'auth.metadata.key2'
      ]);

      credentialManager.get.mockResolvedValueOnce({
        name: 'Key 1',
        scopes: ['read'],
        createdAt: '2026-01-01T00:00:00Z'
      });

      credentialManager.get.mockResolvedValueOnce({
        name: 'Key 2',
        scopes: ['read', 'write'],
        createdAt: '2026-01-02T00:00:00Z'
      });

      const keys = await authManager.listAPIKeys();

      expect(keys).toHaveLength(2);
      expect(keys[0].name).toBe('Key 1');
      expect(keys[1].name).toBe('Key 2');
    });

    test('should return empty array when no keys exist', async () => {
      credentialManager.list.mockResolvedValue([]);

      const keys = await authManager.listAPIKeys();

      expect(keys).toEqual([]);
    });
  });

  describe('Security Boundaries', () => {
    test('should not log sensitive token data', async () => {
      const payload = { sub: 'user123' };
      const token = await authManager.generateJWT(payload);

      // Logger should never be called with the actual token
      const { safeLog } = require('../logger-utils');
      const calls = safeLog.mock.calls.flat();
      expect(calls.some(arg => String(arg).includes(token))).toBe(false);
    });

    test('should not log API key secrets', async () => {
      const { key } = await authManager.generateAPIKey('test-key');

      const { safeLog } = require('../logger-utils');
      const calls = safeLog.mock.calls.flat();
      expect(calls.some(arg => String(arg).includes(key))).toBe(false);
    });

    test('should generate cryptographically secure API keys', async () => {
      const key1 = await authManager.generateAPIKey('key1');
      const key2 = await authManager.generateAPIKey('key2');

      // Keys should be unrelated (not sequential)
      expect(parseInt(key1.id, 16)).not.toBe(parseInt(key2.id, 16) + 1);
      expect(parseInt(key1.id, 16)).not.toBe(parseInt(key2.id, 16) - 1);
    });
  });
});