import { mkdtemp, mkdir, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { describe, expect, it } from "vitest";

import { failureCount, gates, tenantAuthInventoryScanRoots, renderReport, reportPath, runTenantAuthInventory } from "./verify-tenant-auth-baseline.mjs";

const focusedSmokeTargets = [
  "apps/web/app/routes/app.$tenant.host-aware.test.ts",
  "apps/web/app/routes/app.$tenant.test.tsx",
  "apps/web/app/routes/admin/settings/authentication.test.tsx",
  "apps/web/app/utils/data/.server/auth-boundary-imports.test.ts",
  "packages/db/src/index.test.ts",
  "packages/entitlements/src/index.test.ts",
];

describe("Tenant Auth baseline runner configuration", () => {
  it("defines the required non-E2E gates and report path", () => {
    expect(reportPath).toMatch(/\.tc\/baselines\/tenant-auth\/baseline-health\.md$/);
    expect(gates.map((gate) => gate.id)).toEqual(["typecheck", "lint", "ci-baseline", "vitest-tenantAuth-tenant-auth-smoke", "tenantAuth-tenant-auth-inventory"]);
    expect(gates.some((gate) => gate.args?.some((arg) => /playwright|cypress|browser|e2e/i.test(arg)))).toBe(false);
    expect(tenantAuthInventoryScanRoots).toEqual(["apps/web/app/routes", "apps/web/app/utils", "apps/web/app/modules", "packages/db/src", "packages/entitlements/src", "prisma"]);
  });

  it("keeps focused tenant/auth smoke tests in the Vitest gate", () => {
    const vitestGate = gates.find((gate) => gate.id === "vitest-tenantAuth-tenant-auth-smoke");

    expect(vitestGate?.args).toEqual(["exec", "vitest", "run", ...focusedSmokeTargets]);
  });
});

describe("Tenant Auth baseline runner failure counting", () => {
  it("counts failed typecheck diagnostics conservatively", () => {
    expect(failureCount("typecheck", "src/a.ts(1,1): error TS2307: Cannot find module\nsrc/b.ts(2,2): error TS2322: Type mismatch", "", 1)).toBe(2);
    expect(failureCount("typecheck", "Build failed", "", 1)).toBe(1);
  });

  it("counts failed ESLint diagnostics conservatively", () => {
    expect(failureCount("lint", "✖ 4 problems (3 errors, 1 warning)", "", 1)).toBe(3);
    expect(failureCount("lint", "2 errors and 0 warnings", "", 1)).toBe(2);
    expect(failureCount("lint", "Lint crashed", "", 1)).toBe(1);
  });

  it("counts failed CI and Vitest diagnostics conservatively", () => {
    expect(failureCount("ci-baseline", "FAIL package.json: missing script\nFAIL .eslintrc: missing rule", "", 1)).toBe(2);
    expect(failureCount("vitest-tenantAuth-tenant-auth-smoke", "Tests 2 failed | 8 passed", "", 1)).toBe(2);
    expect(failureCount("vitest-tenantAuth-tenant-auth-smoke", "Test Files 1 failed | 2 passed", "", 1)).toBe(1);
  });

  it("returns zero for clean exits and read-only inventory gates", () => {
    expect(failureCount("lint", "warning only", "", 0)).toBe(0);
    expect(failureCount("tenantAuth-tenant-auth-inventory", "total matches: 12", "", 1)).toBe(0);
  });
});

describe("Tenant Auth inventory scan", () => {
  it("scans existing roots, records missing roots, and ignores generated dependency and TC paths", async () => {
    const root = await mkdtemp(join(tmpdir(), "tenantAuth-baseline-inventory-"));
    await mkdir(join(root, "apps", "web", "app", "routes"), { recursive: true });
    await mkdir(join(root, "apps", "web", "app", "utils"), { recursive: true });
    await mkdir(join(root, "packages", "db", "src"), { recursive: true });
    await mkdir(join(root, ".tc"), { recursive: true });
    await mkdir(join(root, "apps", "web", "app", "routes", "generated"), { recursive: true });
    await mkdir(join(root, "node_modules", "ignored"), { recursive: true });

    const signal = [
      "const tenant = 'workspace tenant orgId tenantId workspaceId';",
      "const invite = 'invite invitation invited inviter invitee';",
      "const lifecycle = 'expiresAt expired revoke revoked accept accepted';",
      "const oauth = 'OAuth Google Apple provider strategy';",
      "const magic = 'magicLink passwordless oneTime token';",
      "const callback = 'callback redirectTo hostAware hostname origin';",
      "const context = 'contextSwitch switchTenant currentWorkspace';",
      "const access = 'role permission featureFlag entitlement plan revalidate';",
      "const enterprise = 'SSO SAML OIDC OpenID IdP';",
    ].join("\n");
    const ignoredSignal = "tenant invite expiresAt OAuth magicLink callback contextSwitch entitlement SAML";

    await writeFile(join(root, "apps", "web", "app", "routes", "auth.tsx"), signal, "utf8");
    await writeFile(join(root, "apps", "web", "app", "utils", "auth.ts"), "export const redirectTo = 'host-aware callback';", "utf8");
    await writeFile(join(root, "packages", "db", "src", "tenant.ts"), "export const tenantId = 'workspace';", "utf8");
    await writeFile(join(root, ".tc", "ignored.tsx"), ignoredSignal, "utf8");
    await writeFile(join(root, "apps", "web", "app", "routes", "generated", "ignored.tsx"), ignoredSignal, "utf8");
    await writeFile(join(root, "node_modules", "ignored", "ignored.tsx"), ignoredSignal, "utf8");

    const inventory = await runTenantAuthInventory(root);
    const allMatches = inventory.matches.join("\n");

    expect(inventory.roots).toEqual(["apps/web/app/routes", "apps/web/app/utils", "packages/db/src"]);
    expect(inventory.missingRoots).toEqual(["apps/web/app/modules", "packages/entitlements/src", "prisma"]);
    expect(inventory.counts).toMatchObject({
      "tenant-workspace": 8,
      invite: 6,
      "expiry-revocation-accept": 6,
      "oauth-google-apple": 6,
      "magic-link": 4,
      "callback-redirect-host-aware": 9,
      "context-switch": 3,
      "role-feature-plan-revalidation": 6,
      "sso-saml-oidc": 5,
    });
    expect(allMatches).toContain("apps/web/app/routes/auth.tsx");
    expect(allMatches).toContain("apps/web/app/utils/auth.ts");
    expect(allMatches).toContain("packages/db/src/tenant.ts");
    expect(allMatches).not.toContain(".tc/ignored.tsx");
    expect(allMatches).not.toContain("generated/ignored.tsx");
    expect(allMatches).not.toContain("node_modules/ignored/ignored.tsx");
  });
});

describe("Tenant Auth report rendering", () => {
  it("renders gate metadata, fingerprints, and inventory counts", () => {
    const report = renderReport([
      { id: "typecheck", command: "pnpm run typecheck", exitCode: 2, durationMs: 1500, failureCount: 7, fingerprint: { hash: "abc123def456", excerpt: "error TS2322" } },
      {
        id: "tenantAuth-tenant-auth-inventory",
        command: "read-only Tenant Auth tenant/auth/OAuth/invite inventory",
        exitCode: 0,
        durationMs: 42,
        failureCount: 0,
        inventory: { roots: ["apps/web/app/routes"], missingRoots: ["prisma"], filesScanned: 3, counts: { "tenant-workspace": 1, invite: 2 }, totalMatches: 3, matches: [] },
        fingerprint: { hash: "fed456abc123", excerpt: "tenant-workspace: 1" },
      },
    ]);

    expect(report).toContain("# Tenant Auth Baseline Health");
    expect(report).toContain("non-E2E baseline gates for Tenant Auth baseline");
    expect(report).toContain("tenant/workspace, invite");
    expect(report).toContain("## typecheck");
    expect(report).toContain("## tenantAuth-tenant-auth-inventory");
    expect(report).toContain("- Exitcode: 2");
    expect(report).toContain("- Failure Count: 7");
    expect(report).toContain("- Output Fingerprint: abc123def456");
    expect(report).toContain("- Inventory Roots: apps/web/app/routes");
    expect(report).toContain("- Missing Roots Skipped: prisma");
    expect(report).toContain("  - tenant-workspace: 1");
    expect(report).toContain("- Total Inventory Matches: 3");
  });
});