// Tests des Kerns und des Hintergrunddienstes mit einem nachgebauten Browser (chrome.*) und einem nachgebauten Server (fetch).
// Start: node --test test/
import test from 'node:test';
import assert from 'node:assert/strict';

// ── Nachbau von chrome.* ─────────────────────────────────────────────────────────────────────────
function makeChrome() {
  const store = {};
  const calls = { notifications: [], badge: { text: '', color: '' }, tabs: [], permissionsRequested: [], permissionsRemoved: [], menus: [], windows: [] };
  const listener = () => ({ addListener() {} });
  const chromeMock = {
    storage: { local: {
      async get(keys) { const out = {}; for (const k of [].concat(keys ?? Object.keys(store))) if (k in store) out[k] = structuredClone(store[k]); return out; },
      async set(obj) { for (const [k, v] of Object.entries(obj)) store[k] = structuredClone(v); },
      async remove(keys) { for (const k of [].concat(keys)) delete store[k]; },
    } },
    permissions: {
      granted: new Set(), allow: true,
      async contains({ origins }) { return origins.every((o) => chromeMock.permissions.granted.has(o)); },
      async request({ origins }) { calls.permissionsRequested.push(...origins); if (chromeMock.permissions.allow) origins.forEach((o) => chromeMock.permissions.granted.add(o)); return chromeMock.permissions.allow; },
      async remove({ origins }) { calls.permissionsRemoved.push(...origins); origins.forEach((o) => chromeMock.permissions.granted.delete(o)); return true; },
    },
    tabs: { async create(o) { calls.tabs.push(o); return o; } },
    windows: { async create(o) { calls.windows.push(o); return o; } },
    action: {
      async setBadgeText({ text }) { calls.badge.text = text; },
      async setBadgeBackgroundColor({ color }) { calls.badge.color = color; },
      async openPopup() {},
    },
    notifications: { create(id, o) { calls.notifications.push({ id, ...o }); }, clear() {}, onClicked: listener() },
    alarms: { async get() { return null; }, create() {}, onAlarm: listener() },
    contextMenus: { removeAll(cb) { cb?.(); }, create(o) { calls.menus.push(o); }, onClicked: listener() },
    runtime: { onInstalled: listener(), onStartup: listener(), onMessage: listener(), getURL: (p) => 'chrome-extension://x/' + p, async sendMessage() { return {}; } },
  };
  return { chromeMock, store, calls };
}

/** Nachbau des Servers: Antworten werden vorgegeben, alle Aufrufe mitgeschrieben. */
function makeFetch(routes) {
  const log = [];
  const fn = async (url, init = {}) => {
    const u = new URL(url); const key = `${init.method || 'GET'} ${u.pathname.split('/api/staff/v1/')[1]}`;
    log.push({ key, url: u, init });
    const r = routes[key];
    if (!r) return new Response(JSON.stringify({ error: { code: 'NOT_FOUND', message: 'unbekannt' } }), { status: 404 });
    const res = typeof r === 'function' ? await r(u, init) : r;
    return new Response(JSON.stringify(res.body ?? null), { status: res.status ?? 200, headers: { 'content-type': 'application/json' } });
  };
  fn.log = log;
  return fn;
}

let env;
async function fresh() {
  env = makeChrome(); globalThis.chrome = env.chromeMock;
  return await import('../lib/core.js?' + Math.random());
}
const SERVER = 'https://support.example.de';
const SESSION = { serverUrl: SERVER, token: 'T'.repeat(48), expiresAt: '2099-01-01 00:00:00', staff: { id: 1, name: 'Lukas', permissions: { create_ticket: true } } };

test('Serveradresse: bereinigen und ablehnen', async () => {
  const { normalizeServerUrl } = await fresh();
  assert.equal(normalizeServerUrl('support.example.de'), 'https://support.example.de');
  assert.equal(normalizeServerUrl(' https://support.example.de/ '), 'https://support.example.de');
  assert.equal(normalizeServerUrl('https://example.de/helpdesk/'), 'https://example.de/helpdesk');
  assert.equal(normalizeServerUrl('http://127.0.0.1:8080'), 'http://127.0.0.1:8080');
  for (const bad of ['', 'http://support.example.de', 'https://user:pw@example.de', 'https://example.de/?x=1', 'https://example.de/#a', 'ftp://example.de', 'http://localhost.evil.de']) assert.throws(() => normalizeServerUrl(bad), undefined, bad);
});

test('apiCall sendet das Token in beiden Headern, keine Cookies, keine Weiterleitung', async () => {
  const { apiCall, setSession } = await fresh();
  await setSession(SESSION);
  globalThis.fetch = makeFetch({ 'GET tickets.php': { body: { items: [] } } });
  await apiCall('tickets.php', { query: { q: 'drucker', page: 2, leer: '' } });
  const { init, url } = globalThis.fetch.log[0];
  assert.equal(init.headers.Authorization, `Bearer ${SESSION.token}`);
  assert.equal(init.headers['X-DeskHub-Authorization'], `Bearer ${SESSION.token}`);
  assert.equal(init.credentials, 'omit'); assert.equal(init.redirect, 'error');
  assert.equal(url.searchParams.get('q'), 'drucker'); assert.equal(url.searchParams.get('page'), '2'); assert.equal(url.searchParams.has('leer'), false);
});

test('apiCall: 401 räumt die Anmeldung weg, Netzwerkfehler wird gemeldet', async () => {
  const { apiCall, setSession, getSession, ApiError } = await fresh();
  await setSession(SESSION);
  globalThis.fetch = makeFetch({ 'GET me.php': { status: 401, body: { error: { code: 'UNAUTHENTICATED', message: 'Abgelaufen.' } } } });
  await assert.rejects(apiCall('me.php'), (e) => e instanceof ApiError && e.status === 401 && e.message === 'Abgelaufen.');
  assert.equal(await getSession(), null);
  await setSession(SESSION);
  globalThis.fetch = async () => { throw new TypeError('fail'); };
  await assert.rejects(apiCall('me.php'), (e) => e.code === 'NETWORK' && e.status === 0);
  assert.notEqual(await getSession(), null, 'ein Netzwerkfehler meldet nicht ab');
});

test('Anmeldung: Berechtigung, Authenticator-Code, Speichern', async () => {
  const { login, getSession } = await fresh();
  let step = 0;
  globalThis.fetch = makeFetch({ 'POST login.php': (u, init) => {
    const b = JSON.parse(init.body);
    assert.equal(init.headers.Authorization, undefined, 'beim Anmelden gibt es noch kein Token');
    if (++step === 1) { assert.equal(b.totpCode, null); return { status: 202, body: { requiresTotp: true } }; }
    assert.equal(b.totpCode, '123456');
    return { body: { token: 'N'.repeat(48), expiresAt: '2099-01-01', staff: { id: 2, name: 'Agent' } } };
  } });
  const r1 = await login('support.example.de', 'a@b.de', 'geheim', '');
  assert.deepEqual(r1, { requiresTotp: true });
  assert.deepEqual(env.calls.permissionsRequested, ['https://support.example.de/*'], 'nur dieser eine Server');
  assert.equal(await getSession(), null, 'ohne Code noch keine Anmeldung');
  const r2 = await login('support.example.de', 'a@b.de', 'geheim', '123456');
  assert.equal(r2.session.staff.name, 'Agent');
  assert.equal((await getSession()).serverUrl, SERVER);
});

test('Anmeldung ohne erteilte Berechtigung bricht ab, ohne etwas zu senden', async () => {
  const { login } = await fresh();
  env.chromeMock.permissions.allow = false;
  globalThis.fetch = makeFetch({});
  await assert.rejects(login('support.example.de', 'a@b.de', 'x', ''), /Erlaubnis/);
  assert.equal(globalThis.fetch.log.length, 0);
});

test('Abmelden sperrt das Token, entfernt Berechtigung und Daten', async () => {
  const { logout, setSession, getSession } = await fresh();
  await setSession(SESSION); await chrome.storage.local.set({ badgeCount: 3, lastSeen: 'x' });
  env.chromeMock.permissions.granted.add(SERVER + '/*');
  globalThis.fetch = makeFetch({ 'POST logout.php': { body: { ok: true } } });
  await logout();
  assert.equal(globalThis.fetch.log[0].key, 'POST logout.php');
  assert.deepEqual(env.calls.permissionsRemoved, [SERVER + '/*']);
  assert.equal(await getSession(), null);
  assert.deepEqual(await chrome.storage.local.get(['badgeCount', 'lastSeen']), {});
});

test('Ticketpfad und Textumwandlung', async () => {
  const { ticketPath, plainToHtml } = await fresh();
  assert.equal(ticketPath('T-2026-0001'), '/staff/ticket_view.php?n=T-2026-0001');
  for (const bad of ['', 'a b', '../x', 'x&y=1', '<script>', 'a'.repeat(41)]) assert.throws(() => ticketPath(bad), undefined, bad);
  assert.equal(plainToHtml('a < b & "c"\nzweite\r\ndritte'), 'a &lt; b &amp; "c"<br>zweite<br>dritte');
  assert.equal(plainToHtml('<img src=x onerror=alert(1)>'), '&lt;img src=x onerror=alert(1)&gt;');
});

test('Weboberfläche öffnen: nur die eigene Adresse und nur die Anmelde-Seite', async () => {
  const { openWeb, setSession } = await fresh();
  await setSession(SESSION);
  globalThis.fetch = makeFetch({ 'POST web_pages.php': (u, init) => ({ body: { url: `${SERVER}/staff/app_login.php?t=abc` } }) });
  await openWeb('/staff/ticket_view.php?n=T-1');
  assert.equal(env.calls.tabs[0].url, `${SERVER}/staff/app_login.php?t=abc`);
  assert.deepEqual(JSON.parse(globalThis.fetch.log[0].init.body), { path: '/staff/ticket_view.php?n=T-1' });
  for (const evil of ['https://evil.example/staff/app_login.php?t=1', `${SERVER}/other.php`, 'http://support.example.de/staff/app_login.php', 'javascript:alert(1)']) {
    globalThis.fetch = makeFetch({ 'POST web_pages.php': { body: { url: evil } } });
    env.calls.tabs.length = 0;
    await assert.rejects(openWeb('/staff/ticket_view.php?n=T-1'), undefined, evil);
    assert.equal(env.calls.tabs.length, 0, 'es wurde kein Tab geöffnet: ' + evil);
  }
});

// ── Hintergrunddienst ─────────────────────────────────────────────────────────────────────────────
async function freshBackground() {
  const core = await fresh();
  const bg = await import('../background.js?' + Math.random());
  return { core, bg };
}

test('Hintergrund: erster Abruf legt nur den Bezugspunkt fest', async () => {
  const { core, bg } = await freshBackground();
  await core.setSession(SESSION);
  globalThis.fetch = makeFetch({ 'GET activity.php': { body: { newReplies: 0, newUnassigned: 0, serverTime: '2026-10-25 10:00:00', health: [] } } });
  const r = await bg.poll();
  assert.equal(globalThis.fetch.log[0].url.searchParams.has('since'), false);
  assert.equal(r.fresh, 0);
  assert.equal((await chrome.storage.local.get('lastSeen')).lastSeen, '2026-10-25 10:00:00');
  assert.equal(env.calls.notifications.length, 0);
});

test('Hintergrund: Neues wird gezählt, gemeldet und summiert; Serverzeit wird weitergereicht', async () => {
  const { core, bg } = await freshBackground();
  await core.setSession(SESSION);
  await chrome.storage.local.set({ lastSeen: '2026-10-25 10:00:00', badgeCount: 1 });
  globalThis.fetch = makeFetch({ 'GET activity.php': { body: { newReplies: 2, newUnassigned: 1, serverTime: '2026-10-25 10:01:00' } } });
  const r = await bg.poll();
  assert.equal(globalThis.fetch.log[0].url.searchParams.get('since'), '2026-10-25 10:00:00');
  assert.equal(r.fresh, 3); assert.equal(r.total, 4);
  assert.equal(env.calls.badge.text, '4');
  assert.match(env.calls.notifications[0].message, /1 neu und nicht zugewiesen, 2 Aktualisierungen/);
  assert.equal((await chrome.storage.local.get('lastSeen')).lastSeen, '2026-10-25 10:01:00');
});

test('Hintergrund: Benachrichtigungen lassen sich ausschalten, der Zähler bleibt', async () => {
  const { core, bg } = await freshBackground();
  await core.setSession(SESSION); await core.setSettings({ notifications: false });
  await chrome.storage.local.set({ lastSeen: 'x' });
  globalThis.fetch = makeFetch({ 'GET activity.php': { body: { newReplies: 0, newUnassigned: 5, serverTime: 'y' } } });
  await bg.poll();
  assert.equal(env.calls.notifications.length, 0); assert.equal(env.calls.badge.text, '5');
});

test('Hintergrund: Netzwerkfehler bleiben still und verlieren nichts', async () => {
  const { core, bg } = await freshBackground();
  await core.setSession(SESSION); await chrome.storage.local.set({ lastSeen: 'alt', badgeCount: 2 });
  globalThis.fetch = async () => { throw new TypeError('offline'); };
  const r = await bg.poll();
  assert.equal(r.error, 'NETWORK');
  const s = await chrome.storage.local.get(['lastSeen', 'badgeCount']);
  assert.equal(s.lastSeen, 'alt'); assert.equal(s.badgeCount, 2); assert.equal(env.calls.notifications.length, 0);
});

test('Hintergrund: abgelaufene Anmeldung zeigt „!“ und bittet um neue Anmeldung', async () => {
  const { core, bg } = await freshBackground();
  await core.setSession(SESSION); await chrome.storage.local.set({ lastSeen: 'x' });
  globalThis.fetch = makeFetch({ 'GET activity.php': { status: 401, body: { error: { code: 'UNAUTHENTICATED', message: 'abgelaufen' } } } });
  await bg.poll();
  assert.equal(env.calls.badge.text, '!');
  assert.equal(env.calls.notifications[0].id, 'deskhub-login');
  assert.equal(await core.getSession(), null);
  // danach (ohne Anmeldung) passiert nichts mehr
  globalThis.fetch = makeFetch({});
  const r = await bg.poll();
  assert.equal(r.skipped, true); assert.equal(globalThis.fetch.log.length, 0);
});

test('Manifest: nur nötige Rechte, kein Zugriff auf alle Webseiten ab Start, strenge Inhaltsrichtlinie', async () => {
  const { readFile } = await import('node:fs/promises');
  const m = JSON.parse(await readFile(new URL('../manifest.json', import.meta.url), 'utf8'));
  assert.equal(m.manifest_version, 3);
  assert.deepEqual([...m.permissions].sort(), ['alarms', 'contextMenus', 'notifications', 'storage']);
  assert.equal(m.host_permissions, undefined, 'Serverzugriff wird erst bei der Anmeldung für genau einen Server erfragt');
  assert.match(m.content_security_policy.extension_pages, /script-src 'self'/);
  assert.doesNotMatch(m.content_security_policy.extension_pages, /unsafe-inline|unsafe-eval/);
  for (const f of Object.values(m.icons)) await readFile(new URL('../' + f, import.meta.url));
});