import assert from "node:assert/strict";
import {randomBytes} from "node:crypto";
import {mkdtempSync, rmSync} from "node:fs";
import {tmpdir} from "node:os";
import {join} from "node:path";
import {loadBuiltinProviders, normalizeProvider} from "./providers.mjs";
import {Vault} from "./vault.mjs";

const directory = mkdtempSync(join(tmpdir(), "xiteng-vault-test-"));
const vault = new Vault({
  databasePath: join(directory, "vault.db"),
  masterKey: randomBytes(32),
  builtinProviders: loadBuiltinProviders(new URL("providers.json", import.meta.url))
});
const admin = {issuer: "https://id.xiteng.site", sub: "admin-sub", username: "liooil", admin: true};
const user = {issuer: "https://id.xiteng.site", sub: "user-sub", username: "ziyue", admin: false};

try {
  const providers = vault.listProviders(user);
  assert.ok(providers.length >= 25);
  assert.equal(providers.find((provider) => provider.id === "ollama").connection.type, "frontend");

  assert.throws(() => vault.createCredential(user, {
    providerId: "ollama",
    name: "default",
    secret: "must-not-enter-server"
  }), /remain in the browser/i);

  const custom = normalizeProvider({
    id: "team-proxy",
    name: "Team Proxy",
    api: "openai-completions",
    connection: {
      type: "backend",
      baseUrl: "https://models.example.com/v1",
      proxy: {type: "socks5", url: "socks5://proxy.example.com:1080"}
    },
    auth: {type: "bearer"},
    defaultModel: "team-model",
    discovery: {type: "openai-models-list", url: "https://models.example.com/v1/catalog"}
  });
  vault.saveCustomProvider(user, custom);
  assert.equal(vault.getProvider(user, "team-proxy").connection.proxy.type, "socks5");
  assert.equal(vault.getProvider(user, "team-proxy").discovery.url, "https://models.example.com/v1/catalog");
  assert.equal("models" in vault.getProvider(user, "team-proxy"), false);

  const credential = vault.createCredential(user, {
    providerId: "team-proxy",
    name: "default",
    secret: {
      provider: {apiKey: "secret-one"},
      proxy: {username: "proxy-user", password: "proxy-pass"}
    }
  });
  assert.equal(vault.listCredentials(user).length, 1);
  assert.equal(vault.listCredentials(admin, {all: true}).length, 1);
  assert.equal(vault.verifyCredential(user, credential.id).verified, true);

  const resolved = vault.resolve(user, {providerId: "team-proxy", credentialName: "default"});
  assert.equal(resolved.provider.id, "team-proxy");
  assert.equal(resolved.credential.secret.provider.apiKey, "secret-one");
  assert.equal(resolved.credential.secret.proxy.username, "proxy-user");

  vault.replaceCredential(user, credential.id, {secret: "secret-two"});
  assert.equal(vault.resolve(user, {providerId: "team-proxy"}).credential.secret.provider.apiKey, "secret-two");
  assert.throws(() => vault.resolve(admin, {providerId: "team-proxy"}), /provider not found/i);

  vault.deleteCredential(user, credential.id);
  assert.equal(vault.listCredentials(user).length, 0);
  vault.deleteCustomProvider(user, "team-proxy");
  assert.equal(vault.getProvider(user, "team-proxy"), null);
  assert.ok(vault.listAudit(admin, {all: true}).length >= 7);
  console.log("Vault tests passed");
} finally {
  vault.close();
  rmSync(directory, {recursive: true, force: true});
}