import { expect, test, type BrowserContext, type Page } from '@playwright/test'

import { authenticateAs, createAccessToken } from '@/e2e/fixtures/session'

const authenticate = async (context: BrowserContext, page: Page, role: 'admin' | 'user', status: 'active' | 'pending' = 'active') => {
  if (status === 'active') {
    await authenticateAs(context, page, role)

    return
  }

  await context.addCookies([
    { name: 'accessToken', value: createAccessToken(role), domain: '127.0.0.1', path: '/' },
    { name: 'userRole', value: role, domain: '127.0.0.1', path: '/' },
    { name: 'userStatus', value: status, domain: '127.0.0.1', path: '/' },
  ])
}

test('redirects a guest from an admin route to the admin auth page', async ({ page }) => {
  await page.goto('/dashboard')

  await expect(page).toHaveURL(/\/auth\?redirect=%2Fdashboard$/)
  // Auth mobile step has no page title — assert the OTP entry form instead.
  await expect(page.getByLabel('شماره موبایل')).toBeVisible()
  await expect(page.getByRole('button', { name: 'ادامه' })).toBeVisible()
})

test('root redirects guests toward auth via the dashboard gate', async ({ page }) => {
  const response = await page.goto('/')

  await expect(page).toHaveURL(/\/auth/)
  await expect(page.locator('body')).toBeVisible()
  expect(response?.headers()['content-security-policy']).toContain("frame-ancestors 'none'")
  expect(response?.headers()['x-content-type-options']).toBe('nosniff')
  expect(response?.headers()['referrer-policy']).toBe('strict-origin-when-cross-origin')
})

test('prevents a consumer from opening admin routes', async ({ context, page }) => {
  await authenticate(context, page, 'user')
  await page.goto('/dashboard')

  await expect(page).toHaveURL(/\/auth/)
})

test('ignores a forged userRole=admin cookie when the access JWT is a consumer', async ({ context, page }) => {
  const accessToken = createAccessToken('user')

  await context.addCookies([
    { name: 'accessToken', value: accessToken, domain: '127.0.0.1', path: '/' },
    { name: 'userRole', value: 'admin', domain: '127.0.0.1', path: '/' },
    { name: 'userStatus', value: 'active', domain: '127.0.0.1', path: '/' },
  ])
  await page.addInitScript(
    ({ token }) => {
      localStorage.setItem(
        'user',
        JSON.stringify({
          accessToken: token,
          userId: 'user-id',
          role: 'user',
          sessionId: 'user-session',
          AccessTokenExpireTime: Date.now() + 3_600_000,
          refreshTokenExpireTime: Date.now() + 86_400_000,
          status: 'active',
        })
      )
    },
    { token: accessToken }
  )
  await page.route('**/api/v1/**', (route) =>
    route.fulfill({
      status: 200,
      contentType: 'application/json',
      body: JSON.stringify({ success: true, data: { items: [], meta: {} } }),
    })
  )
  await page.goto('/dashboard')

  await expect(page).toHaveURL(/\/auth/)
})

test('redirects an authenticated admin from root to the dashboard', async ({ context, page }) => {
  await authenticate(context, page, 'admin')
  await page.goto('/')

  await expect(page).toHaveURL(/\/dashboard$/)
})