import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import test from "node:test";
import {
  buildDaemonRegistrationCommand,
  daemonStartCommand,
  quoteBash,
  quotePowerShell,
  resolveConnectOrigin,
} from "../app/dashboard/hosts/new/onboarding.ts";

test("builds a PowerShell registration command without embedding the bootstrap token", () => {
  const command = buildDaemonRegistrationCommand({
    os: "windows",
    connectOrigin: "https://connect.example.test",
    hostName: "家里'; Remove-Item *; '电脑",
  });

  assert.match(command, /NEKONEST_SERVER = 'https:\/\/connect\.example\.test'/);
  assert.match(command, /NEKONEST_TRANSPORT_MODE = 'sealed'/);
  assert.match(command, /Read-Host '粘贴一次性配对码' -AsSecureString/);
  assert.match(command, /SecureStringToBSTR/);
  assert.match(command, /PtrToStringBSTR/);
  assert.match(command, /IsNullOrWhiteSpace/);
  assert.match(command, /-register -name '家里''; Remove-Item \*; ''电脑'/);
  assert.match(command, /finally[\s\S]*Remove-Item Env:NEKONEST_BOOTSTRAP_TOKEN[\s\S]*ZeroFreeBSTR/);
  assert.doesNotMatch(command, /bootstrap-token-value/);
  assert.equal(quotePowerShell("a'b"), "'a''b'");
  assert.equal(daemonStartCommand("windows"), ".\\nekonest-daemon.exe");
});

test("builds a Bash subshell that drops the secret environment after registration", () => {
  const command = buildDaemonRegistrationCommand({
    os: "linux",
    connectOrigin: "https://connect.example.test",
    hostName: "home'; rm -rf /; 'pc",
  });

  assert.match(command, /^\([\s\S]*\)$/);
  assert.match(command, /read -rsp/);
  assert.match(command, /\[ -z "\$NEKONEST_BOOTSTRAP_TOKEN" \][\s\S]*exit 1/);
  assert.match(command, /export NEKONEST_BOOTSTRAP_TOKEN/);
  assert.match(command, /\.\/nekonest-daemon -register -name 'home'"'"'; rm -rf \/; '"'"'pc'/);
  assert.equal(quoteBash("a'b"), `'a'"'"'b'`);
  assert.equal(daemonStartCommand("linux"), "./nekonest-daemon");
});

test("rejects non-origin and insecure public control-plane addresses", () => {
  const base = { os: "linux", hostName: "home" };
  assert.throws(() => buildDaemonRegistrationCommand({ ...base, connectOrigin: "http://cloud.example.test" }), /HTTPS origin/);
  assert.throws(() => buildDaemonRegistrationCommand({ ...base, connectOrigin: "https://cloud.example.test/path" }), /HTTPS origin/);
  assert.doesNotThrow(() => buildDaemonRegistrationCommand({ ...base, connectOrigin: "http://127.0.0.1:3000" }));
  assert.equal(resolveConnectOrigin("https://connect.example.test", false), "https://connect.example.test");
  assert.throws(() => resolveConnectOrigin(undefined, false), /CONNECT_ORIGIN is required/);
  assert.equal(resolveConnectOrigin(undefined, true), "http://127.0.0.1:3000");
});

test("keeps the one-time token out of generated commands and browser persistence", async () => {
  const form = await readFile(new URL("../app/dashboard/hosts/new/PairingForm.tsx", import.meta.url), "utf8");
  const helper = await readFile(new URL("../app/dashboard/hosts/new/onboarding.ts", import.meta.url), "utf8");
  assert.match(form, /navigator\.clipboard\?\.writeText/);
  assert.match(form, /浏览器未允许自动复制/);
  assert.match(form, /onFocus=\{\(event\) => event\.currentTarget\.select\(\)\}/);
  assert.doesNotMatch(`${form}\n${helper}`, /localStorage|sessionStorage/);
  assert.doesNotMatch(helper, /bootstrapToken/);
  assert.doesNotMatch(form, /window\.location\.origin/);
  assert.match(form, /一次性码不会拼进命令、URL 或浏览器存储/);
});