import { test, beforeEach } from 'node:test'
import assert from 'node:assert/strict'
import fs from 'node:fs'
import path from 'node:path'
import { fileURLToPath } from 'node:url'

import {
  RESERVED_KEYS,
  registerEmailBlock,
  getEmailBlock,
  listEmailBlocks,
  newEmailBlock,
} from '../src/emailBlocks/registry.js'

// Engagement Phase 5b — the client half of the template editor.
//
// Two kinds of test, and the second kind is the one worth explaining.
//
// `registry.js` is plain `.js` and imports nothing, so it is exercised directly.
// `types.jsx` and `EngagementTemplates.jsx` cannot be: this runner has no JSX
// transform and no DOM, the same limit `moduleRegistry.test.js` documents. So the
// properties that live in those files are asserted **against their source text**.
//
// That is a weaker test than executing them, and it is used for exactly two things
// where a weak test still beats none:
//
//   • **The preview sandbox.** `sandbox=""` with no `allow-scripts` is the reason
//     operator-authored HTML cannot run under this site's origin. It is one
//     attribute, on one element, and it is precisely the sort of thing someone
//     removes to debug a rendering problem and does not put back. A source
//     assertion catches that in review; nothing else here would.
//   • **Registry drift.** Every `email.*` type this client offers must exist in
//     the server registry with the same version, because the server validates
//     against its own and a drifted client produces a refused save with no
//     explanation on screen. Reading both trees is the only way to check a
//     pairing that spans a process boundary.

const here = path.dirname(fileURLToPath(import.meta.url))
const read = (rel) => fs.readFileSync(path.join(here, '..', rel), 'utf8')

// The registry is module state; each test starts from a known entry.
beforeEach(() => {
  if (!getEmailBlock('email.test')) {
    registerEmailBlock({
      type: 'email.test',
      version: 2,
      label: 'Test block',
      defaults: () => ({ text: 'hi' }),
      editor: () => null,
    })
  }
})

// ── The registry ───────────────────────────────────────────────────────────

test('a definition must be namespaced "email."', () => {
  assert.throws(() => registerEmailBlock({ type: 'heading' }), /namespaced/)
  assert.throws(() => registerEmailBlock({}), /namespaced/)
})

test('a duplicate type is a programmer error, caught at import', () => {
  assert.throws(() => registerEmailBlock({ type: 'email.test' }), /already registered/)
})

test('a new block carries the envelope the server expects, and a unique id', () => {
  const a = newEmailBlock('email.test')
  const b = newEmailBlock('email.test')
  assert.deepEqual(Object.keys(a).sort(), [...RESERVED_KEYS].sort())
  assert.equal(a.type, 'email.test')
  assert.equal(a.version, 2)
  assert.deepEqual(a.props, { text: 'hi' })
  // Ids are unique across a whole document. A counter would re-issue an id after
  // a delete and the save would be refused for a reason nothing on screen explains.
  assert.notEqual(a.id, b.id)
})

test('an unknown type yields nothing rather than a half-built block', () => {
  assert.equal(newEmailBlock('email.nope'), null)
  assert.equal(getEmailBlock('email.nope'), null)
})

// ── The sandbox: §4.6.2's security posture, as an attribute ────────────────

test('the preview frame is sandboxed with no allow-scripts', () => {
  const source = read('src/routes/admin/views/EngagementTemplates.jsx')

  // It renders in an iframe at all — not into the page.
  assert.match(source, /<iframe/)

  // Read the ATTRIBUTE, not the file. The first version of this test searched the
  // whole source for "allow-scripts" and failed on the comment above the iframe
  // explaining that there is no allow-scripts — a check that a correct file fails
  // is worse than no check, because the fix is to delete the explanation.
  const sandboxes = [...source.matchAll(/sandbox=(?:"([^"]*)"|\{([^}]*)\})/g)].map((m) => m[1] ?? m[2])
  assert.equal(sandboxes.length, 1, 'expected exactly one sandboxed frame')
  // Empty: every restriction on, nothing granted back.
  assert.equal(sandboxes[0], '')
  // The two grants that would undo it, whatever else were listed.
  assert.doesNotMatch(sandboxes[0], /allow-scripts/)
  assert.doesNotMatch(sandboxes[0], /allow-same-origin/)

  // And no iframe without one at all.
  assert.equal((source.match(/<iframe/g) || []).length, sandboxes.length)

  // From srcDoc — an opaque origin — rather than a src pointing at this site.
  assert.match(source, /srcDoc=/)
})

test('the preview HTML is never injected into this document', () => {
  const source = read('src/routes/admin/views/EngagementTemplates.jsx')
  // The one API that would undo all of the above in a single line.
  assert.doesNotMatch(source, /dangerouslySetInnerHTML/)
})

// ── Drift between the two registries ───────────────────────────────────────

test('every client email block pairs with a server definition at the same version', () => {
  const clientSource = read('src/emailBlocks/types.jsx')
  const clientTypes = [...clientSource.matchAll(/type:\s*'(email\.[A-Za-z]+)',\s*\n\s*version:\s*(\d+)/g)].map(
    (m) => [m[1], Number(m[2])],
  )
  assert.ok(clientTypes.length >= 6, 'expected the six block definitions to be found')

  const serverDir = path.join(here, '..', '..', 'server', 'src', 'emailBlocks', 'types')
  const serverTypes = new Map()
  for (const file of fs.readdirSync(serverDir)) {
    const src = fs.readFileSync(path.join(serverDir, file), 'utf8')
    const type = src.match(/type:\s*'(email\.[A-Za-z]+)'/)
    const version = src.match(/\n\s*version:\s*(\d+)/)
    if (type) serverTypes.set(type[1], version ? Number(version[1]) : 1)
  }

  for (const [type, version] of clientTypes) {
    assert.ok(serverTypes.has(type), `${type} has no server definition`)
    assert.equal(serverTypes.get(type), version, `${type} version differs between client and server`)
  }
  // And the other direction: a server block with no authoring form is a block an
  // operator can be sent a template containing and cannot edit.
  for (const type of serverTypes.keys()) {
    assert.ok(
      clientTypes.some(([t]) => t === type),
      `${type} exists on the server but has no editor in this client`,
    )
  }
})

test('no client email block declares a React renderer', () => {
  // The structural claim in registry.js's header. A `component` here would be a
  // second renderer for a body the server produces, and the two would agree only
  // until the first Outlook fix.
  const clientSource = read('src/emailBlocks/types.jsx')
  assert.doesNotMatch(clientSource, /\n\s*component:/)
  assert.ok(listEmailBlocks().every((d) => !('component' in d)))
})