/**
 * 分享功能边界条件深度测试（兼容 Cookie + CSRF）
 *
 * 测试场景：
 * 1. 已过期的分享
 * 2. 分享文件不存在
 * 3. 被封禁用户的分享
 * 4. 路径遍历攻击
 * 5. 特殊字符路径
 * 6. 并发密码尝试
 * 7. 分享统计
 * 8. 分享码唯一性
 * 9. 过期时间格式
 */

const http = require('http');
const https = require('https');
const bcrypt = require('bcryptjs');
const { db, ShareDB, UserDB } = require('./database');

const BASE_URL = process.env.TEST_BASE_URL || 'http://127.0.0.1:40001';

const results = {
  passed: 0,
  failed: 0,
  errors: []
};

const adminSession = {
  cookies: {},
  csrfToken: ''
};

let adminUserId = 1;

function makeCookieHeader(cookies) {
  return Object.entries(cookies || {})
    .map(([k, v]) => `${k}=${v}`)
    .join('; ');
}

function storeSetCookies(session, setCookieHeader) {
  if (!session || !setCookieHeader) return;
  const list = Array.isArray(setCookieHeader) ? setCookieHeader : [setCookieHeader];
  for (const raw of list) {
    const first = String(raw || '').split(';')[0];
    const idx = first.indexOf('=');
    if (idx <= 0) continue;
    const key = first.slice(0, idx).trim();
    const value = first.slice(idx + 1).trim();
    session.cookies[key] = value;
    if (key === 'csrf_token') {
      session.csrfToken = value;
    }
  }
}

function isSafeMethod(method) {
  const upper = String(method || '').toUpperCase();
  return upper === 'GET' || upper === 'HEAD' || upper === 'OPTIONS';
}

function request(method, path, options = {}) {
  const {
    data = null,
    session = null,
    headers = {},
    requireCsrf = true
  } = options;

  return new Promise((resolve, reject) => {
    const url = new URL(path, BASE_URL);
    const transport = url.protocol === 'https:' ? https : http;

    const requestHeaders = { ...headers };

    if (session) {
      const cookieHeader = makeCookieHeader(session.cookies);
      if (cookieHeader) {
        requestHeaders.Cookie = cookieHeader;
      }

      if (requireCsrf && !isSafeMethod(method)) {
        const csrfToken = session.csrfToken || session.cookies.csrf_token;
        if (csrfToken) {
          requestHeaders['X-CSRF-Token'] = csrfToken;
        }
      }
    }

    let payload = null;
    if (data !== null && data !== undefined) {
      payload = JSON.stringify(data);
      requestHeaders['Content-Type'] = 'application/json';
      requestHeaders['Content-Length'] = Buffer.byteLength(payload);
    }

    const req = transport.request({
      protocol: url.protocol,
      hostname: url.hostname,
      port: url.port || (url.protocol === 'https:' ? 443 : 80),
      path: url.pathname + url.search,
      method,
      headers: requestHeaders
    }, (res) => {
      let body = '';
      res.on('data', chunk => {
        body += chunk;
      });
      res.on('end', () => {
        if (session) {
          storeSetCookies(session, res.headers['set-cookie']);
        }

        let parsed = body;
        try {
          parsed = body ? JSON.parse(body) : {};
        } catch (e) {
          // keep raw text
        }

        resolve({
          status: res.statusCode,
          data: parsed,
          headers: res.headers
        });
      });
    });

    req.on('error', reject);

    if (payload) {
      req.write(payload);
    }
    req.end();
  });
}

async function initCsrf(session) {
  const res = await request('GET', '/api/csrf-token', {
    session,
    requireCsrf: false
  });

  if (res.status === 200 && res.data && res.data.csrfToken) {
    session.csrfToken = res.data.csrfToken;
  }

  return res;
}

function assert(condition, message) {
  if (condition) {
    results.passed++;
    console.log(`  [PASS] ${message}`);
  } else {
    results.failed++;
    results.errors.push(message);
    console.log(`  [FAIL] ${message}`);
  }
}

function createValidShareCode(prefix = '') {
  for (let i = 0; i < 20; i++) {
    const generated = ShareDB.generateShareCode();
    const code = (prefix + generated).replace(/[^A-Za-z0-9]/g, '').slice(0, 16);
    if (!code || code.length < 6) continue;
    const exists = db.prepare('SELECT 1 FROM shares WHERE share_code = ?').get(code);
    if (!exists) return code;
  }

  return ShareDB.generateShareCode();
}

async function testExpiredShare() {
  console.log('\n[测试] 已过期的分享...');

  const expiredShareCode = createValidShareCode('E');

  try {
    const yesterday = new Date();
    yesterday.setDate(yesterday.getDate() - 1);
    const expiresAt = yesterday.toISOString().replace('T', ' ').substring(0, 19);

    db.prepare(`
      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type, expires_at)
      VALUES (?, ?, ?, ?, ?, ?)
    `).run(adminUserId, expiredShareCode, '/expired-test.txt', 'file', 'local', expiresAt);

    console.log(`  创建过期分享: ${expiredShareCode}, 过期时间: ${expiresAt}`);

    const res = await request('POST', `/api/share/${expiredShareCode}/verify`, {
      data: {},
      requireCsrf: false
    });

    assert(res.status === 404, `过期分享应返回 404, 实际: ${res.status}`);
    assert(res.data && res.data.message === '分享不存在', '应提示分享不存在');

    db.prepare('DELETE FROM shares WHERE share_code = ?').run(expiredShareCode);
    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    results.failed++;
    db.prepare('DELETE FROM shares WHERE share_code = ?').run(expiredShareCode);
    return false;
  }
}

async function testShareWithDeletedFile() {
  console.log('\n[测试] 分享的文件不存在...');

  const shareCode = createValidShareCode('N');

  try {
    db.prepare(`
      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type)
      VALUES (?, ?, ?, ?, ?)
    `).run(adminUserId, shareCode, '/non_existent_file_xyz.txt', 'file', 'local');

    console.log(`  创建分享: ${shareCode}, 路径: /non_existent_file_xyz.txt`);

    const res = await request('POST', `/api/share/${shareCode}/verify`, {
      data: {},
      requireCsrf: false
    });

    assert(res.status === 500 || res.status === 200, `应返回500或200，实际: ${res.status}`);
    if (res.status === 500) {
      assert(!!res.data?.message, '500时应返回错误消息');
    }

    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return false;
  }
}

async function testShareByBannedUser() {
  console.log('\n[测试] 被封禁用户的分享...');

  let testUserId = null;
  const shareCode = createValidShareCode('B');

  try {
    testUserId = UserDB.create({
      username: `test_banned_${Date.now()}`,
      email: `test_banned_${Date.now()}@test.com`,
      password: 'test123',
      is_verified: 1
    });

    db.prepare(`
      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type)
      VALUES (?, ?, ?, ?, ?)
    `).run(testUserId, shareCode, '/test.txt', 'file', 'local');

    console.log(`  创建测试用户 ID: ${testUserId}`);
    console.log(`  创建分享: ${shareCode}`);

    UserDB.setBanStatus(testUserId, true);
    console.log(`  封禁用户: ${testUserId}`);

    const res = await request('POST', `/api/share/${shareCode}/verify`, {
      data: {},
      requireCsrf: false
    });

    console.log(`  被封禁用户分享访问状态码: ${res.status}`);

    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    UserDB.delete(testUserId);

    assert(true, '被封禁用户分享测试完成');
    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    if (shareCode) db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    if (testUserId) UserDB.delete(testUserId);
    return false;
  }
}

async function testPathTraversalAttacks() {
  console.log('\n[测试] 路径遍历攻击防护...');

  const shareCode = createValidShareCode('T');

  try {
    db.prepare(`
      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type)
      VALUES (?, ?, ?, ?, ?)
    `).run(adminUserId, shareCode, '/allowed-folder', 'directory', 'local');

    const attackPaths = [
      '../../../etc/passwd',
      '..\\..\\..\\etc\\passwd',
      '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd',
      '/allowed-folder/../../../etc/passwd',
      '/allowed-folder/./../../etc/passwd',
      '....//....//....//etc/passwd',
      '/allowed-folder%00.txt/../../../etc/passwd'
    ];

    let blocked = 0;
    for (const attackPath of attackPaths) {
      const res = await request('POST', `/api/share/${shareCode}/download-url`, {
        data: { path: attackPath },
        requireCsrf: false
      });

      if (res.status === 403 || res.status === 400) {
        blocked++;
        console.log(`  [BLOCKED] ${attackPath.substring(0, 40)}...`);
      } else {
        console.log(`  [WARN] 可能未阻止: ${attackPath}, 状态: ${res.status}`);
      }
    }

    assert(blocked >= attackPaths.length - 1, `路径遍历攻击应被阻止 (${blocked}/${attackPaths.length})`);

    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return false;
  }
}

async function testSpecialCharactersInPath() {
  console.log('\n[测试] 特殊字符路径处理...');

  if (!adminSession.cookies.token) {
    console.log('  [WARN] 未登录，跳过特殊字符路径测试');
    assert(true, '未登录时跳过特殊字符路径测试');
    return true;
  }

  const specialPaths = [
    '/文件夹/中文文件.txt',
    '/folder with spaces/file.txt',
    '/folder-with-dashes/file_underscore.txt',
    '/folder.with.dots/file.name.ext.txt',
    "/folder'with'quotes/file.txt"
  ];

  let handled = 0;

  for (const virtualPath of specialPaths) {
    try {
      const createRes = await request('POST', '/api/share/create', {
        data: {
          share_type: 'file',
          file_path: virtualPath
        },
        session: adminSession
      });

      if (createRes.status === 200 || createRes.status === 400) {
        handled++;
        console.log(`  [OK] ${virtualPath.substring(0, 30)}... - 状态: ${createRes.status}`);

        if (createRes.status === 200 && createRes.data?.share_code) {
          const mySharesRes = await request('GET', '/api/share/my', {
            session: adminSession
          });

          const share = mySharesRes.data?.shares?.find(s => s.share_code === createRes.data.share_code);
          if (share) {
            await request('DELETE', `/api/share/${share.id}`, {
              session: adminSession
            });
          }
        }
      }
    } catch (error) {
      console.log(`  [ERROR] ${virtualPath}: ${error.message}`);
    }
  }

  assert(handled === specialPaths.length, '特殊字符路径处理完成');
  return true;
}

async function testConcurrentPasswordAttempts() {
  console.log('\n[测试] 并发密码尝试限流...');

  const shareCode = createValidShareCode('C');

  try {
    const hashedPassword = bcrypt.hashSync('correct123', 10);

    db.prepare(`
      INSERT INTO shares (user_id, share_code, share_path, share_type, share_password, storage_type)
      VALUES (?, ?, ?, ?, ?, ?)
    `).run(adminUserId, shareCode, '/test.txt', 'file', hashedPassword, 'local');

    const promises = [];
    for (let i = 0; i < 20; i++) {
      promises.push(
        request('POST', `/api/share/${shareCode}/verify`, {
          data: { password: `wrong${i}` },
          requireCsrf: false
        })
      );
    }

    const responses = await Promise.all(promises);

    const rateLimited = responses.filter(r => r.status === 429).length;
    const unauthorized = responses.filter(r => r.status === 401).length;

    console.log(`  并发请求: 20, 限流: ${rateLimited}, 401错误: ${unauthorized}`);

    if (rateLimited > 0) {
      assert(true, '限流机制生效');
    } else {
      console.log('  [INFO] 限流未触发（可能配置较宽松）');
      assert(true, '并发测试完成');
    }

    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return false;
  }
}

async function testShareStatistics() {
  console.log('\n[测试] 分享统计功能...');

  const shareCode = createValidShareCode('S');

  try {
    db.prepare(`
      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type, view_count, download_count)
      VALUES (?, ?, ?, ?, ?, ?, ?)
    `).run(adminUserId, shareCode, '/test.txt', 'file', 'local', 0, 0);

    for (let i = 0; i < 3; i++) {
      await request('POST', `/api/share/${shareCode}/verify`, {
        data: {},
        requireCsrf: false
      });
    }

    for (let i = 0; i < 2; i++) {
      await request('POST', `/api/share/${shareCode}/download`, {
        data: {},
        requireCsrf: false
      });
    }

    const share = db.prepare('SELECT view_count, download_count FROM shares WHERE share_code = ?').get(shareCode);

    assert(share.view_count === 3, `查看次数应为 3, 实际: ${share.view_count}`);
    assert(share.download_count === 2, `下载次数应为 2, 实际: ${share.download_count}`);

    console.log(`  查看次数: ${share.view_count}, 下载次数: ${share.download_count}`);

    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
    return false;
  }
}

async function testShareCodeUniqueness() {
  console.log('\n[测试] 分享码唯一性...');

  try {
    const codes = new Set();

    for (let i = 0; i < 10; i++) {
      const code = ShareDB.generateShareCode();
      if (codes.has(code)) {
        console.log(`  [WARN] 发现重复分享码: ${code}`);
      }
      codes.add(code);
    }

    assert(codes.size === 10, `应生成 10 个唯一分享码, 实际: ${codes.size}`);
    console.log(`  生成了 ${codes.size} 个唯一分享码`);

    const sampleCode = ShareDB.generateShareCode();
    assert(sampleCode.length === 8, `分享码长度应为 8, 实际: ${sampleCode.length}`);
    assert(/^[a-zA-Z0-9]+$/.test(sampleCode), '分享码应只包含字母数字');

    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    return false;
  }
}

async function testExpiryTimeFormat() {
  console.log('\n[测试] 过期时间格式...');

  try {
    const testDays = [1, 7, 30, 365];

    for (const days of testDays) {
      const result = ShareDB.create(adminUserId, {
        share_type: 'file',
        file_path: `/test_${days}_days.txt`,
        expiry_days: days
      });

      const share = db.prepare('SELECT expires_at FROM shares WHERE share_code = ?').get(result.share_code);

      const expiresAt = new Date(share.expires_at);
      const now = new Date();
      const diffDays = Math.round((expiresAt - now) / (1000 * 60 * 60 * 24));

      assert(Math.abs(diffDays - days) <= 1, `${days}天过期应正确设置, 实际差异: ${diffDays}天`);

      db.prepare('DELETE FROM shares WHERE share_code = ?').run(result.share_code);
    }

    return true;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    return false;
  }
}

async function login() {
  console.log('\n[准备] 登录获取认证...');

  try {
    await initCsrf(adminSession);

    const res = await request('POST', '/api/login', {
      data: {
        username: 'admin',
        password: 'admin123'
      },
      session: adminSession,
      requireCsrf: false
    });

    if (res.status === 200 && res.data?.success && adminSession.cookies.token) {
      await initCsrf(adminSession);

      const profileRes = await request('GET', '/api/user/profile', {
        session: adminSession
      });

      if (profileRes.status === 200 && profileRes.data?.user?.id) {
        adminUserId = profileRes.data.user.id;
      }

      console.log('  认证成功');
      return true;
    }

    console.log(`  认证失败: status=${res.status}, message=${res.data?.message || 'unknown'}`);
    return false;
  } catch (error) {
    console.log(`  [ERROR] ${error.message}`);
    return false;
  }
}

async function runTests() {
  console.log('========================================');
  console.log(' 分享功能边界条件深度测试（Cookie + CSRF）');
  console.log('========================================');

  const loggedIn = await login();
  if (!loggedIn) {
    console.log('\n[WARN] 登录失败，部分测试可能无法执行');
  }

  await testExpiredShare();
  await testShareWithDeletedFile();
  await testShareByBannedUser();
  await testPathTraversalAttacks();
  await testSpecialCharactersInPath();
  await testConcurrentPasswordAttempts();
  await testShareStatistics();
  await testShareCodeUniqueness();
  await testExpiryTimeFormat();

  console.log('\n========================================');
  console.log(' 测试结果统计');
  console.log('========================================');
  console.log(`通过: ${results.passed}`);
  console.log(`失败: ${results.failed}`);

  if (results.errors.length > 0) {
    console.log('\n失败的测试:');
    results.errors.forEach((err, i) => {
      console.log(`  ${i + 1}. ${err}`);
    });
  }

  console.log('\n========================================');

  process.exit(results.failed > 0 ? 1 : 0);
}

runTests().catch(error => {
  console.error('测试执行失败:', error);
  process.exit(1);
});