import assert from 'node:assert/strict';
import fs from 'node:fs/promises';

const base = 'http://127.0.0.1:8005';
function client() {
    const cookies = new Map();
    let csrf;
    let version;
    async function request(path, method = 'GET', data, inertia = true) {
        const response = await fetch(base + path, {
            method,
            redirect: 'manual',
            headers: {
                Accept: inertia ? 'application/json' : 'text/html',
                Cookie: [...cookies].map(([k, v]) => `${k}=${v}`).join('; '),
                ...(inertia
                    ? {
                          'X-Inertia': 'true',
                          'X-Inertia-Version': version ?? '',
                      }
                    : {}),
                ...(data
                    ? {
                          'Content-Type': 'application/json',
                          'X-CSRF-TOKEN': csrf,
                      }
                    : {}),
            },
            ...(data ? { body: JSON.stringify(data) } : {}),
        });
        for (const cookie of response.headers.getSetCookie()) {
            const pair = cookie.split(';', 1)[0],
                i = pair.indexOf('=');
            cookies.set(pair.slice(0, i), pair.slice(i + 1));
        }
        const text = await response.text();
        return {
            status: response.status,
            location: response.headers.get('location'),
            text,
            page: response.headers
                .get('content-type')
                ?.includes('application/json')
                ? JSON.parse(text)
                : null,
        };
    }
    return {
        request,
        async enter(role) {
            let page = await request('/avaliar', 'GET', undefined, false);
            assert.equal(page.status, 200);
            csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
            assert.equal(
                (await request('/avaliar/entrar', 'POST', { role }, false))
                    .status,
                302,
            );
            page = await request('/avaliar', 'GET', undefined, false);
            csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
            const dashboard = await request(
                '/dashboard',
                'GET',
                undefined,
                false,
            );
            const encoded = dashboard.text.match(
                /<script data-page="app" type="application\/json">([\s\S]*?)<\/script>/,
            );
            assert.ok(encoded, 'Expected Inertia bootstrap data');
            version = JSON.parse(encoded[1]).version;
        },
    };
}

const roles = [
    'admin',
    'requester',
    'department_head',
    'procurement',
    'finance',
    'warehouse',
];
let state;
for (const role of roles) {
    const c = client();
    await c.enter(role);
    const response = await c.request('/administracao/parametrizacao');
    if (role === 'admin') {
        assert.equal(response.status, 200);
        assert.equal(response.page.component, 'company/parameters');
        assert.equal(response.page.props.ready, true);
        assert.ok(response.page.props.permissions.admin);
        assert.ok(
            response.page.props.users.every(
                (u) => !('password' in u) && !('remember_token' in u),
            ),
        );
        state = {
            active: response.page.props.active,
            version: response.page.props.version,
            profiles: response.page.props.profiles.length,
        };
    } else assert.equal(response.status, 403, role);
    assert.equal((await c.request('/logout', 'POST', {}, false)).status, 302);
}
await fs.writeFile(
    'docs/proofs/organization-access-http.json',
    JSON.stringify(
        {
            checked_at: new Date().toISOString(),
            base,
            path: '/administracao/parametrizacao',
            roles,
            owner_access: true,
            other_legacy_profiles_refused: true,
            passwords_not_returned: true,
            configuration_state: state,
            business_commands: 0,
            accounts_created: 0,
            permissions_changed: false,
            visual_review: false,
        },
        null,
        2,
    ) + '\n',
);
console.log(
    'Administration parameters: owner access, six profiles, no exposed credentials or changed accounts.',
);