#!/usr/bin/env node
import assert from 'node:assert/strict';
import { spawn } from 'node:child_process';
import fs from 'node:fs/promises';
import path from 'node:path';
import { createDbPool } from '../db.mjs';
import { loadH5Environment } from './load-env.mjs';

loadH5Environment(import.meta.dirname);

const suffix = `${Date.now()}${Math.floor(Math.random() * 1000)}`;
const portalPort = Number(process.env.MINDSPACE_PUBLICATION_PORT ?? 18142);
const baseUrl = `http://127.0.0.1:${portalPort}`;
const storageRoot = path.join('/tmp', `mindspace-publications-${suffix}`);
const users = [
  {
    username: `msp_pub_owner_${suffix}`,
    email: `msp-pub-owner-${suffix}@example.test`,
    password: 'MindSpace-Publication-Owner-2026',
  },
  {
    username: `msp_pub_other_${suffix}`,
    email: `msp-pub-other-${suffix}@example.test`,
    password: 'MindSpace-Publication-Other-2026',
  },
];

const portal = spawn(process.execPath, ['server.mjs'], {
  cwd: path.join(import.meta.dirname, '..'),
  env: {
    ...process.env,
    H5_PORT: String(portalPort),
    H5_PUBLIC_BASE_URL: baseUrl,
    TKMIND_API_TARGET: 'http://127.0.0.1:9',
    MINDSPACE_STORAGE_ROOT: storageRoot,
    MINDSPACE_FREE_PUBLIC_PAGE_LIMIT: '1',
  },
  stdio: ['ignore', 'pipe', 'pipe'],
});
let portalLogs = '';
portal.stdout.on('data', (chunk) => {
  portalLogs += chunk.toString();
});
portal.stderr.on('data', (chunk) => {
  portalLogs += chunk.toString();
});

async function waitForPortal() {
  for (let attempt = 0; attempt < 60; attempt += 1) {
    if (portal.exitCode != null) throw new Error(`Portal 提前退出\n${portalLogs}`);
    try {
      const response = await fetch(`${baseUrl}/auth/status`);
      if (response.ok) return;
    } catch {
      // Portal is still starting.
    }
    await new Promise((resolve) => setTimeout(resolve, 100));
  }
  throw new Error(`Portal 启动超时\n${portalLogs}`);
}

async function request(pathname, options = {}) {
  const url = /^https?:\/\//i.test(pathname) ? pathname : `${baseUrl}${pathname}`;
  const response = await fetch(url, options);
  const contentType = response.headers.get('content-type') ?? '';
  const body = contentType.includes('application/json')
    ? await response.json()
    : await response.text();
  return { response, body };
}

async function registerAndLogin(user) {
  const registration = await request('/auth/register', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ ...user, displayName: user.username }),
  });
  assert.equal(registration.response.status, 200, JSON.stringify(registration.body));
  const login = await request('/auth/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ username: user.username, password: user.password }),
  });
  assert.equal(login.response.status, 200, JSON.stringify(login.body));
  return {
    id: registration.body.user.id,
    cookie: login.response.headers.get('set-cookie')?.split(';', 1)[0],
  };
}

function authHeaders(cookie) {
  return { Cookie: cookie, 'Content-Type': 'application/json' };
}

const pool = createDbPool();
let originalPublicPageLimit = null;

async function setPublicPageLimitForTest() {
  const [rows] = await pool.query(
    "SELECT value FROM mindspace_config WHERE `key` = 'public_page_limit' LIMIT 1",
  );
  originalPublicPageLimit = rows[0]?.value ?? null;
  await pool.query(
    `INSERT INTO mindspace_config (\`key\`, value, description, updated_at)
     VALUES ('public_page_limit', '1', '公开页面数量上限', ?)
     ON DUPLICATE KEY UPDATE value = VALUES(value), updated_at = VALUES(updated_at)`,
    [Date.now()],
  );
}

async function restorePublicPageLimit() {
  if (originalPublicPageLimit == null) {
    await pool.query("DELETE FROM mindspace_config WHERE `key` = 'public_page_limit'");
    return;
  }
  await pool.query(
    "UPDATE mindspace_config SET value = ?, updated_at = ? WHERE `key` = 'public_page_limit'",
    [originalPublicPageLimit, Date.now()],
  );
}

try {
  await waitForPortal();
  await setPublicPageLimitForTest();
  const owner = await registerAndLogin(users[0]);
  const other = await registerAndLogin(users[1]);

  const created = await request('/api/mindspace/v1/pages', {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      title: '发布隔离测试',
      summary: '第一版摘要',
      content: '# 第一版\n\n这是线上应该保持的 V1 内容。',
      template_id: 'editorial',
    }),
  });
  assert.equal(created.response.status, 201, JSON.stringify(created.body));
  const page = created.body.data;

  const checked = await request(`/api/mindspace/v1/pages/${page.id}/publish-check`, {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      page_version_id: page.currentVersionId,
      access_mode: 'public',
      url_slug: 'immutable-page',
    }),
  });
  assert.equal(checked.response.status, 200, JSON.stringify(checked.body));
  assert.equal(checked.body.data.allowed, true);

  const published = await request(`/api/mindspace/v1/pages/${page.id}/publish`, {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      page_version_id: page.currentVersionId,
      access_mode: 'public',
      url_slug: 'immutable-page',
      acknowledged_finding_ids: [],
    }),
  });
  assert.equal(published.response.status, 201, JSON.stringify(published.body));
  const publicUrl = published.body.data.publicUrl;

  const publicV1 = await request(publicUrl, {
    headers: {
      'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 18_0) Mobile',
      Referer: 'https://example.com/campaign/private-path',
    },
  });
  assert.equal(publicV1.response.status, 200);
  assert.match(publicV1.body, /V1 内容/);

  const usageAfterPublish = await request('/api/mindspace/v1/space', {
    headers: { Cookie: owner.cookie },
  });
  assert.equal(usageAfterPublish.body.data.quota.publicPageUsed, 1);
  assert.equal(usageAfterPublish.body.data.quota.monthlyViewUsed, 1);
  assert.equal(
    usageAfterPublish.body.data.categories.find((category) => category.code === 'public')
      .itemCount,
    1,
  );

  const overLimitPage = await request('/api/mindspace/v1/pages', {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      title: '第二个公开页面',
      content: '这个页面应被套餐数量限制阻止。',
      template_id: 'editorial',
    }),
  });
  const overLimit = await request(
    `/api/mindspace/v1/pages/${overLimitPage.body.data.id}/publish`,
    {
      method: 'POST',
      headers: authHeaders(owner.cookie),
      body: JSON.stringify({
        page_version_id: overLimitPage.body.data.currentVersionId,
        access_mode: 'public',
        url_slug: 'over-limit-page',
        acknowledged_finding_ids: [],
      }),
    },
  );
  assert.equal(overLimit.response.status, 429);
  assert.equal(overLimit.body.error.code, 'public_page_limit_exceeded');

  const updated = await request(`/api/mindspace/v1/pages/${page.id}`, {
    method: 'PUT',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      expected_version: 1,
      title: '发布隔离测试 v2',
      summary: '第二版摘要',
      content: '# 第二版\n\n这是尚未重新发布的 V2 内容。',
      template_id: 'report',
    }),
  });
  assert.equal(updated.response.status, 200, JSON.stringify(updated.body));

  const stillV1 = await request(publicUrl);
  assert.equal(stillV1.response.status, 200);
  assert.match(stillV1.body, /V1 内容/);
  assert.doesNotMatch(stillV1.body, /V2 内容/);

  const blockedRepublish = await request(`/api/mindspace/v1/pages/${page.id}/publish`, {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      page_version_id: updated.body.data.currentVersionId,
      access_mode: 'owner_only',
      url_slug: 'immutable-page',
      acknowledged_finding_ids: [],
    }),
  });
  assert.equal(blockedRepublish.response.status, 409);
  assert.equal(blockedRepublish.body.error.code, 'page_already_online');

  const offlineBeforeRepublish = await request(
    `/api/mindspace/v1/publications/${published.body.data.id}/offline`,
    {
      method: 'POST',
      headers: authHeaders(owner.cookie),
      body: '{}',
    },
  );
  assert.equal(offlineBeforeRepublish.response.status, 200);

  const republished = await request(`/api/mindspace/v1/pages/${page.id}/publish`, {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      page_version_id: updated.body.data.currentVersionId,
      access_mode: 'owner_only',
      url_slug: 'immutable-page',
      acknowledged_finding_ids: [],
    }),
  });
  assert.equal(republished.response.status, 201, JSON.stringify(republished.body));

  const anonymousProtected = await request(publicUrl);
  assert.equal(anonymousProtected.response.status, 404);
  const foreignProtected = await request(publicUrl, { headers: { Cookie: other.cookie } });
  assert.equal(foreignProtected.response.status, 404);
  const ownerProtected = await request(publicUrl, { headers: { Cookie: owner.cookie } });
  assert.equal(ownerProtected.response.status, 200);
  assert.match(ownerProtected.body, /V2 内容/);

  let currentPublicationId = republished.body.data.id;
  const offlineCurrentPublication = async () => {
    if (!currentPublicationId) return;
    const response = await request(
      `/api/mindspace/v1/publications/${currentPublicationId}/offline`,
      {
        method: 'POST',
        headers: authHeaders(owner.cookie),
        body: '{}',
      },
    );
    assert.equal(response.response.status, 200, JSON.stringify(response.body));
  };

  const publishMode = async (accessMode, extra = {}) => {
    await offlineCurrentPublication();
    const response = await request(`/api/mindspace/v1/pages/${page.id}/publish`, {
      method: 'POST',
      headers: authHeaders(owner.cookie),
      body: JSON.stringify({
        page_version_id: updated.body.data.currentVersionId,
        access_mode: accessMode,
        url_slug: 'immutable-page',
        acknowledged_finding_ids: [],
        ...extra,
      }),
    });
    assert.equal(response.response.status, 201, JSON.stringify(response.body));
    currentPublicationId = response.body.data.id;
    return response.body.data;
  };

  const loginRequired = await publishMode('login_required');
  const anonymousLoginRequired = await request(publicUrl);
  assert.equal(anonymousLoginRequired.response.status, 401);
  const loggedInVisitor = await request(publicUrl, { headers: { Cookie: other.cookie } });
  assert.equal(loggedInVisitor.response.status, 200);
  assert.match(loggedInVisitor.body, /V2 内容/);

  const accessPassword = 'Protected-Page-2026';
  const passwordProtected = await publishMode('password', { password: accessPassword });
  const passwordGate = await request(publicUrl);
  assert.equal(passwordGate.response.status, 200);
  assert.match(passwordGate.body, /此页面受密码保护/);
  assert.doesNotMatch(passwordGate.body, /V2 内容/);
  const wrongPassword = await request(publicUrl, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({ password: 'wrong-password' }),
  });
  assert.equal(wrongPassword.response.status, 403);
  const correctPassword = await request(publicUrl, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({ password: accessPassword }),
  });
  assert.equal(correctPassword.response.status, 200);
  assert.match(correctPassword.body, /V2 内容/);

  const privateLink = await publishMode('private_link');
  assert.match(privateLink.publicUrl, /^\/s\/[A-Za-z0-9_-]+$/);
  const privateLinkPage = await request(privateLink.publicUrl);
  assert.equal(privateLinkPage.response.status, 200);
  assert.match(privateLinkPage.body, /V2 内容/);
  const hiddenLongRoute = await request(publicUrl);
  assert.equal(hiddenLongRoute.response.status, 404);

  const timeLimited = await publishMode('time_limited', {
    expires_at: Date.now() + 60_000,
  });
  const beforeExpiry = await request(publicUrl);
  assert.equal(beforeExpiry.response.status, 200);
  await pool.query(`UPDATE h5_publish_records SET expires_at = ? WHERE id = ?`, [
    Date.now() - 1,
    timeLimited.id,
  ]);
  const afterExpiry = await request(publicUrl);
  assert.equal(afterExpiry.response.status, 404);
  currentPublicationId = null;

  const finalPublication = await publishMode('public');
  const finalView = await request(publicUrl, {
    headers: {
      Cookie: owner.cookie,
      'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)',
    },
  });
  assert.equal(finalView.response.status, 200);
  const stats = await request(
    `/api/mindspace/v1/publications/${finalPublication.id}/stats`,
    { headers: { Cookie: owner.cookie } },
  );
  assert.equal(stats.response.status, 200);
  assert.equal(stats.body.data.totalViews, 1);
  assert.deepEqual(stats.body.data.devices, [{ deviceType: 'desktop', views: 1 }]);
  assert.deepEqual(stats.body.data.sources, [{ source: 'direct', views: 1 }]);
  const publicHomepage = await request(`/u/${users[0].username}`);
  assert.equal(publicHomepage.response.status, 200);
  assert.match(publicHomepage.body, /当前公开发布且在线的 MindSpace 页面/);
  assert.match(publicHomepage.body, /发布隔离测试 v2/);
  assert.match(publicHomepage.body, /1 个公开页面/);
  const foreignStats = await request(
    `/api/mindspace/v1/publications/${finalPublication.id}/stats`,
    { headers: { Cookie: other.cookie } },
  );
  assert.equal(foreignStats.response.status, 404);

  const risky = await request('/api/mindspace/v1/pages', {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      title: '高风险页面',
      content: '身份证号码 310101199001011234',
      template_id: 'editorial',
    }),
  });
  const blocked = await request(`/api/mindspace/v1/pages/${risky.body.data.id}/publish`, {
    method: 'POST',
    headers: authHeaders(owner.cookie),
    body: JSON.stringify({
      page_version_id: risky.body.data.currentVersionId,
      access_mode: 'public',
      url_slug: 'blocked-page',
      acknowledged_finding_ids: [],
    }),
  });
  assert.equal(blocked.response.status, 422);
  assert.equal(blocked.body.error.code, 'security_risk_blocked');

  const foreignOffline = await request(
    `/api/mindspace/v1/publications/${finalPublication.id}/offline`,
    {
      method: 'POST',
      headers: authHeaders(other.cookie),
      body: '{}',
    },
  );
  assert.equal(foreignOffline.response.status, 404);

  const offlined = await request(
    `/api/mindspace/v1/publications/${finalPublication.id}/offline`,
    {
      method: 'POST',
      headers: authHeaders(owner.cookie),
      body: '{}',
    },
  );
  assert.equal(offlined.response.status, 200);
  const afterOffline = await request(publicUrl, { headers: { Cookie: owner.cookie } });
  assert.equal(afterOffline.response.status, 404);
  const usageAfterOffline = await request('/api/mindspace/v1/space', {
    headers: { Cookie: owner.cookie },
  });
  assert.equal(usageAfterOffline.body.data.quota.publicPageUsed, 0);

  const [events] = await pool.query(
    `SELECT event_type FROM h5_publication_events
     WHERE publish_id IN (
       SELECT id FROM h5_publish_records WHERE page_id = ?
     ) ORDER BY created_at`,
    [page.id],
  );
  assert.equal(events[0].event_type, 'published');
  assert.equal(events.at(-1).event_type, 'offlined');
  assert.equal(
    events.filter((event) => event.event_type === 'republished').length,
    6,
  );

  console.log('MindSpace publication API E2E passed');
} finally {
  await restorePublicPageLimit();
  await pool.query(`DELETE FROM h5_users WHERE username IN (?, ?)`, [
    users[0].username,
    users[1].username,
  ]);
  await pool.end();
  portal.kill('SIGTERM');
  await new Promise((resolve) => portal.once('exit', resolve));
  await new Promise((resolve) => portalLogs.includes('TKMind H5') ? resolve() : setTimeout(resolve, 10));
  await fs.rm(storageRoot, { recursive: true, force: true });
}