import assert from "node:assert/strict";
import { readFile, readdir } from "node:fs/promises";
import { PGlite } from "../.data/sql-verification/node_modules/@electric-sql/pglite/dist/index.js";

const db = new PGlite();
const owner = "00000000-0000-4000-8000-000000000001";
const other = "00000000-0000-4000-8000-000000000002";
const deleted = "00000000-0000-4000-8000-000000000003";
const hash = (i) => i.toString(16).padStart(64, "0");
const rpc = async (sql, args = []) => (await db.query(sql, args)).rows[0].value;
const create = (i, account = owner, scopes = ["maps:read"], days = 30) =>
  rpc("select public.developer_key_create($1,$2,$3,$4,$5,$6) value", [
    account, `Key ${i}`, scopes, hash(i), `mgdev_${i.toString().padStart(8, "0")}`, days,
  ]);
const consume = (i) => rpc("select public.developer_key_consume($1) value", [hash(i)]);

try {
  await db.exec(`create role anon; create role authenticated; create role service_role bypassrls;
    create schema auth; create table auth.users(id uuid primary key);
    create function auth.uid() returns uuid language sql as $$select null::uuid$$;
    create schema storage; create table storage.buckets(id text primary key,name text,public boolean,file_size_limit bigint);`);
  for (const file of (await readdir("supabase/migrations")).filter((f) => f.endsWith(".sql")).sort())
    await db.exec(await readFile(`supabase/migrations/${file}`, "utf8"));
  await db.exec("grant select,insert,update,delete on all tables in schema public to service_role;");
  await db.query("insert into auth.users values($1),($2),($3)", [owner, other, deleted]);
  await db.query("insert into public.profiles(id,role) values($1,'contributor'),($2,'admin'),($3,'contributor')", [owner, other, deleted]);

  // Browser Supabase sessions cannot call RPCs or read hashes/quotas directly.
  for (const role of ["anon", "authenticated"]) {
    await db.exec(`set role ${role}`);
    for (const sql of [
      "select token_hash from public.developer_api_keys",
      "select * from public.developer_api_owner_limits",
      `select public.developer_keys_list('${owner}')`,
      `select public.developer_key_create('${owner}','forged',array['maps:read'],'${hash(1)}','mgdev_test1234',30)`,
      `select public.developer_key_revoke('${owner}','${other}')`,
      `select public.developer_key_consume('${hash(1)}')`,
    ]) await assert.rejects(db.query(sql), /permission denied/);
    await db.exec("reset role");
  }
  await db.exec("set role service_role");
  assert.deepEqual(await rpc("select public.developer_keys_list($1) value", [owner]), []);
  for (const scopes of [[], ["admin"], ["maps:read", null], ["account:write"], ["maps:read", "maps:read", "maps:read", "maps:read", "maps:read"]])
    await assert.rejects(create(1, owner, scopes), /Invalid API key scopes/);
  for (const days of [0, 366, null]) await assert.rejects(create(1, owner, ["maps:read"], days), /Invalid API key settings/);
  await assert.rejects(create(1, null), /Account required/);
  const first = await create(1, owner, ["maps:read", "account:read", "maps:read"]);
  assert.deepEqual(first.scopes, ["account:read", "maps:read"]);
  assert.equal(first.name, "Key 1");
  assert.ok(!JSON.stringify(first).includes(hash(1)));
  for (let i = 2; i <= 5; i++) await create(i);
  await assert.rejects(create(6), (error) => error.code === "22023" && error.message === "Maximum 5 active API keys");
  const otherKey = await create(10, other);
  assert.equal((await rpc("select public.developer_keys_list($1) value", [owner])).length, 5);
  assert.equal((await rpc("select public.developer_keys_list($1) value", [other])).length, 1);
  assert.equal(await rpc("select public.developer_key_revoke($1,$2) value", [other, first.id]), false);
  assert.equal((await consume(1)).ok, true);
  assert.equal(await rpc("select public.developer_key_revoke($1,$2) value", [owner, first.id]), true);
  assert.deepEqual(await consume(1), {ok: false, error: "invalid_key"});
  await create(6);
  await db.query("update public.developer_api_keys set expires_at=clock_timestamp()-interval '1 second' where token_hash=$1", [hash(6)]);
  assert.deepEqual(await consume(6), {ok: false, error: "invalid_key"});
  await create(7);
  for (const token of [null, "not-a-hash", hash(999)])
    assert.deepEqual(await rpc("select public.developer_key_consume($1) value", [token]), {ok:false,error:"invalid_key"});

  // Reset fixtures to the current minute before checking precise quota boundaries.
  await db.exec("update public.developer_api_keys set rate_window=null,rate_count=0; delete from public.developer_api_owner_limits");
  for (let n = 1; n <= 60; n++) {
    const result = await consume(2);
    assert.equal(result.ok, true);
    assert.equal(result.remaining, 60 - n);
  }
  const limited = await consume(2);
  assert.equal(limited.error, "rate_limited");
  assert.equal(limited.remaining, 0);
  assert.ok(limited.resetAt > Date.now() / 1000);
  for (const i of [3, 4]) for (let n = 0; n < 60; n++) assert.equal((await consume(i)).ok, true);
  const ownerLimited = await consume(5);
  assert.equal(ownerLimited.error, "rate_limited");
  assert.equal(ownerLimited.ownerRemaining, 0);
  assert.equal((await consume(10)).ok, true, "Another owner has an independent quota");
  const stored = (await db.query("select rate_count from public.developer_api_keys where token_hash=$1", [hash(5)])).rows[0];
  assert.equal(stored.rate_count, 0, "Rejected requests do not consume quota");
  await db.exec("update public.developer_api_keys set rate_window=date_trunc('minute',clock_timestamp())-interval '1 minute'; update public.developer_api_owner_limits set rate_window=date_trunc('minute',clock_timestamp())-interval '1 minute'");
  const nextWindow = await consume(2);
  assert.equal(nextWindow.ok, true);
  assert.equal(nextWindow.remaining, 59);
  assert.equal(nextWindow.ownerRemaining, 179);
  assert.ok((await rpc("select public.developer_keys_list($1) value", [owner])).find((k) => k.id === first.id).revokedAt);
  assert.ok((await rpc("select public.developer_keys_list($1) value", [owner])).find((k) => k.name === "Key 2").lastUsedAt);

  // History stays bounded without losing an older but still active key.
  await db.query("update public.developer_api_keys set created_at=clock_timestamp()-interval '2 years' where token_hash=$1", [hash(2)]);
  await db.query(`insert into public.developer_api_keys(owner_id,name,prefix,token_hash,scopes,created_at,expires_at,revoked_at)
    select $1,'History '||n,'mgdev_history',lpad(to_hex(n),64,'0'),array['maps:read'],
      clock_timestamp()-make_interval(secs=>n),clock_timestamp()+interval '1 day',clock_timestamp()
    from generate_series(1000,1119) n`, [owner]);
  const bounded = await rpc("select public.developer_keys_list($1) value", [owner]);
  assert.equal(bounded.length, 100);
  assert.deepEqual(new Set(bounded.slice(0,5).map((k) => k.name)), new Set(["Key 2","Key 3","Key 4","Key 5","Key 7"]));
  assert.equal(bounded[4].name, "Key 2");
  assert.ok(bounded.slice(5).every((k) => k.revokedAt || Date.parse(k.expiresAt) <= Date.now()));
  assert.ok(bounded.every((k) => !Object.hasOwn(k,"token_hash") && !Object.hasOwn(k,"tokenHash") && !Object.hasOwn(k,"rate_count")));

  // PGlite queues these invocations on one connection. This checks burst
  // boundaries; true multi-connection locking is provided by FOR UPDATE in SQL.
  const creationBurst = await Promise.allSettled(Array.from({length:6},(_,n) => create(20+n,deleted)));
  assert.equal(creationBurst.filter((result) => result.status === "fulfilled").length, 5);
  assert.equal(creationBurst.filter((result) => result.status === "rejected" && result.reason.code === "22023").length, 1);
  const quotaBurst = await Promise.all(Array.from({length:70},() => consume(20)));
  assert.equal(quotaBurst.filter((result) => result.ok).length, 60);
  assert.equal(quotaBurst.filter((result) => result.error === "rate_limited").length, 10);
  await db.exec("reset role");
  await db.query("delete from auth.users where id=$1", [deleted]);
  await db.exec("set role service_role");
  assert.deepEqual(await consume(20), {ok:false,error:"invalid_key"});
  await assert.rejects(create(21, deleted), /Account required/);
  await db.exec("reset role");
  await db.query("delete from public.profiles where id=$1", [other]);
  assert.equal((await db.query("select count(*) n from public.developer_api_keys where id=$1", [otherKey.id])).rows[0].n, 0);
  await db.exec("set role service_role");
  assert.deepEqual(await consume(10), {ok:false,error:"invalid_key"});
  console.log("Developer API SQL checks passed: restricted grants, validation, scope canonicalization, owner isolation, five-key cap, expiry, revocation, deleted accounts, per-key 60/min, shared-owner 180/min, rollover, bounded active-first metadata, queued burst boundaries.");
} finally {
  await db.close();
}