#!/usr/bin/env node
/**
 * Error Handling UI Tests
 *
 * Tests for 404, 401, 429 error handling, and form validation errors.
 *
 * Run: node test_error_handling_ci.js
 */

const { setupTest, teardownTest, TestResults, log, delay, navigateTo, withTimeout } = require('./test_lib');

// ============================================================================
// 404 Error Handling Tests
// ============================================================================
const Error404Tests = {
    async nonExistentPageShows404(page, baseUrl) {
        const response = await navigateTo(page, `${baseUrl}/nonexistent-page-12345`);

        const result = await page.evaluate(() => {
            const bodyText = document.body.textContent?.toLowerCase() || '';
            return {
                has404Text: bodyText.includes('404') || bodyText.includes('not found'),
                hasErrorPage: !!document.querySelector('.error-page, .not-found, [class*="404"]'),
                hasHomeLink: !!document.querySelector('a[href="/"], a[href*="home"]'),
                pageTitle: document.title
            };
        });

        const statusCode = response?.status();
        const passed = statusCode === 404 || result.has404Text || result.hasErrorPage;

        return {
            passed,
            message: passed
                ? `404 handled (status: ${statusCode}, has404Text: ${result.has404Text})`
                : `Unexpected response for non-existent page (status: ${statusCode})`
        };
    },

    async invalidResearchIdHandled(page, baseUrl) {
        const response = await navigateTo(page, `${baseUrl}/results/invalid-research-id-12345`);

        const result = await page.evaluate(() => {
            const bodyText = document.body.textContent?.toLowerCase() || '';
            return {
                hasErrorText: bodyText.includes('not found') || bodyText.includes('error') || bodyText.includes('invalid'),
                hasRedirect: window.location.pathname === '/' || window.location.pathname === '/history',
                currentPath: window.location.pathname
            };
        });

        const statusCode = response?.status();
        const passed = statusCode === 404 || result.hasErrorText || result.hasRedirect;

        return {
            passed,
            message: passed
                ? `Invalid research ID handled (status: ${statusCode}, path: ${result.currentPath})`
                : 'Invalid research ID not handled gracefully'
        };
    },

    async invalidDocumentIdHandled(page, baseUrl) {
        // Use fetch instead of page navigation to avoid flaky domcontentloaded timeouts
        // The Flask route returns a simple text "Document not found" with status 404
        const result = await page.evaluate(async (url) => {
            try {
                const response = await fetch(`${url}/library/document/invalid-doc-id-12345`);
                const text = await response.text();
                const bodyText = text.toLowerCase();
                return {
                    status: response.status,
                    hasErrorText: bodyText.includes('not found') || bodyText.includes('error'),
                    redirected: response.redirected,
                    finalUrl: response.url
                };
            } catch (e) {
                return { error: e.message };
            }
        }, baseUrl);

        if (result.error) {
            return { passed: null, skipped: true, message: `Fetch failed: ${result.error}` };
        }

        const passed = result.status === 404 || result.hasErrorText || result.redirected;

        return {
            passed,
            message: passed
                ? `Invalid document ID handled (status: ${result.status})`
                : 'Invalid document ID not handled gracefully'
        };
    }
};

// ============================================================================
// 401 Authentication Error Tests
// ============================================================================
const Error401Tests = {
    async unauthenticatedRedirectsToLogin(page, baseUrl) {
        // Navigate to login page first to avoid pending XHR interference
        await page.goto(`${baseUrl}/auth/login`, { waitUntil: 'domcontentloaded', timeout: 15000 });

        // Clear cookies to simulate unauthenticated state
        const client = await page.target().createCDPSession();
        await client.send('Network.clearBrowserCookies');

        await navigateTo(page, `${baseUrl}/settings/`);

        const result = await page.evaluate(() => {
            const currentPath = window.location.pathname;
            const hasLoginForm = !!document.querySelector('form[action*="login"], input[type="password"], .login-form');
            const bodyText = document.body.textContent?.toLowerCase() || '';
            const hasLoginText = bodyText.includes('login') || bodyText.includes('sign in');

            return {
                currentPath,
                redirectedToLogin: currentPath.includes('login') || currentPath.includes('auth'),
                hasLoginForm,
                hasLoginText
            };
        });

        const passed = result.redirectedToLogin || result.hasLoginForm || result.hasLoginText;

        return {
            passed,
            message: passed
                ? `Unauthenticated user redirected to login (path: ${result.currentPath})`
                : 'Protected route accessible without authentication'
        };
    },

    async apiUnauthorizedReturns401(page, baseUrl) {
        // Clear cookies
        const client = await page.target().createCDPSession();
        await client.send('Network.clearBrowserCookies');

        await navigateTo(page, `${baseUrl}/`);

        const result = await page.evaluate(async (url) => {
            try {
                const response = await fetch(`${url}/api/history`);
                return {
                    status: response.status,
                    is401or403: response.status === 401 || response.status === 403,
                    redirected: response.redirected,
                    finalUrl: response.url
                };
            } catch (e) {
                return { error: e.message };
            }
        }, baseUrl);

        if (result.error) {
            return { passed: null, skipped: true, message: `API call failed: ${result.error}` };
        }

        const passed = result.is401or403 || result.redirected;

        return {
            passed,
            message: passed
                ? `Unauthenticated API returns ${result.status} or redirects`
                : `API accessible without auth (status: ${result.status})`
        };
    }
};

// ============================================================================
// API Error Response Tests
// ============================================================================
const ApiErrorTests = {
    async apiMissingParamsReturns400(page, baseUrl) {
        // Re-authenticate first
        const ctx = await page.evaluate(() => ({ authenticated: !!document.cookie }));

        await navigateTo(page, `${baseUrl}/`);

        const result = await page.evaluate(async (url) => {
            try {
                // Try to start research without required params
                const response = await fetch(`${url}/api/start_research`, {
                    method: 'POST',
                    headers: { 'Content-Type': 'application/json' },
                    body: JSON.stringify({}) // Empty body, missing required 'query'
                });

                const data = await response.json().catch(() => ({}));

                return {
                    status: response.status,
                    is400: response.status === 400,
                    hasError: 'error' in data || 'message' in data,
                    errorMessage: data.error || data.message
                };
            } catch (e) {
                return { error: e.message };
            }
        }, baseUrl);

        if (result.error) {
            return { passed: null, skipped: true, message: `API call failed: ${result.error}` };
        }

        // 400 or 422 are both acceptable for validation errors
        const passed = result.status === 400 || result.status === 422 || result.hasError;

        return {
            passed,
            message: passed
                ? `Missing params returns ${result.status} with error message`
                : `Unexpected response for missing params (status: ${result.status})`
        };
    },

    async apiInvalidIdReturns404(page, baseUrl) {
        await navigateTo(page, `${baseUrl}/`);

        const result = await page.evaluate(async (url) => {
            try {
                const response = await fetch(`${url}/api/research/nonexistent-id-12345`);
                return {
                    status: response.status,
                    is404: response.status === 404
                };
            } catch (e) {
                return { error: e.message };
            }
        }, baseUrl);

        if (result.error) {
            return { passed: null, skipped: true, message: `API call failed: ${result.error}` };
        }

        // Accept 401 as well — auth session may not carry over to the API request
        const passed = result.is404 || result.status === 401;

        return {
            passed,
            message: passed
                ? `Invalid research ID returns ${result.status}`
                : `Invalid ID returns ${result.status} (expected 404 or 401)`
        };
    }
};

// ============================================================================
// Rate Limiting Tests
// ============================================================================
const RateLimitTests = {
    async rateLimitingWarningDisplays(page, baseUrl) {
        await navigateTo(page, `${baseUrl}/metrics/`);

        const result = await page.evaluate(() => {
            const bodyText = document.body.textContent?.toLowerCase() || '';
            const hasRateLimitText = bodyText.includes('rate limit') || bodyText.includes('throttle');

            const warningElement = document.querySelector(
                '.rate-limit-warning, ' +
                '.alert-warning[class*="rate"], ' +
                '[class*="rate-limit"]'
            );

            return {
                hasRateLimitText,
                hasWarningElement: !!warningElement,
                warningText: warningElement?.textContent?.trim().substring(0, 100)
            };
        });

        if (!result.hasRateLimitText && !result.hasWarningElement) {
            return { passed: null, skipped: true, message: 'No rate limiting info displayed (may not be rate limited)' };
        }

        return {
            passed: true,
            message: result.hasWarningElement
                ? `Rate limit warning: "${result.warningText?.substring(0, 50)}..."`
                : 'Rate limiting information displayed'
        };
    },

    async rateLimitingStatusEndpoint(page, baseUrl) {
        await navigateTo(page, `${baseUrl}/`);

        const result = await page.evaluate(async (url) => {
            try {
                const response = await fetch(`${url}/metrics/api/rate-limiting/current`);
                if (!response.ok) return { ok: false, status: response.status };

                // Guard against HTML responses (e.g. login page redirects)
                const contentType = response.headers.get('content-type') || '';
                if (!contentType.includes('application/json')) {
                    return { ok: false, status: response.status, error: `Non-JSON content-type: ${contentType}` };
                }

                const data = await response.json();
                return {
                    ok: true,
                    status: response.status,
                    hasLimits: Object.keys(data).length > 0
                };
            } catch (e) {
                return { ok: false, error: e.message };
            }
        }, baseUrl);

        if (!result.ok && result.status === 404) {
            return { passed: null, skipped: true, message: 'Rate limiting status endpoint not found' };
        }

        if (!result.ok && (result.status === 401 || result.status === 403)) {
            return { passed: null, skipped: true, message: `Rate limiting endpoint requires auth (status ${result.status})` };
        }

        if (!result.ok && result.error && result.error.startsWith('Non-JSON content-type')) {
            return { passed: null, skipped: true, message: `Rate limiting endpoint returned non-JSON (likely auth redirect)` };
        }

        return {
            passed: result.ok,
            message: result.ok
                ? 'Rate limiting status endpoint responds'
                : `Rate limiting endpoint failed: ${result.error || 'status ' + result.status}`
        };
    }
};

// ============================================================================
// Form Validation Error Tests
// ============================================================================
const FormValidationTests = {
    async emptyQueryShowsError(page, baseUrl) {
        await navigateTo(page, `${baseUrl}/`);

        // Try to submit empty research form
        const result = await page.evaluate(() => {
            const form = document.querySelector('form.research-form, form[action*="research"], #research-form');
            const submitBtn = document.querySelector('button[type="submit"], .submit-btn, .btn-primary');

            if (!form && !submitBtn) return { hasForm: false };

            // Clear any existing query
            const queryInput = document.querySelector('input[name*="query"], textarea[name*="query"], #query');
            if (queryInput) queryInput.value = '';

            // Click submit
            if (submitBtn) submitBtn.click();

            return new Promise(resolve => {
                let attempts = 0;
                const check = () => {
                    const hasError = !!document.querySelector(
                        '.error, .invalid-feedback, .form-error, .alert-danger, [class*="error"]'
                    );
                    const hasInvalidInput = !!document.querySelector('input:invalid, textarea:invalid');
                    const errorText = document.querySelector('.error, .invalid-feedback')?.textContent?.trim();

                    if (hasError || hasInvalidInput || ++attempts >= 15) {
                        resolve({
                            hasForm: true,
                            hasError,
                            hasInvalidInput,
                            errorText
                        });
                    } else {
                        setTimeout(check, 200);
                    }
                };
                setTimeout(check, 200);
            });
        });

        if (!result.hasForm) {
            return { passed: null, skipped: true, message: 'No research form found' };
        }

        const passed = result.hasError || result.hasInvalidInput;

        return {
            passed,
            message: passed
                ? `Empty query validation works (error: ${result.errorText || 'shown'})`
                : 'Empty query did not show validation error'
        };
    },

    async invalidSettingsShowsError(page, baseUrl) {
        await navigateTo(page, `${baseUrl}/settings/`);

        const result = await page.evaluate(() => {
            // Look for any numeric input and try to set invalid value
            const numericInput = document.querySelector(
                'input[type="number"], ' +
                'input[name*="temperature"], ' +
                'input[name*="iterations"]'
            );

            if (!numericInput) return { hasInput: false };

            // Set invalid value
            numericInput.value = '-999';
            numericInput.dispatchEvent(new Event('change', { bubbles: true }));
            numericInput.dispatchEvent(new Event('input', { bubbles: true }));

            return new Promise(resolve => {
                let attempts = 0;
                const check = () => {
                    const hasError = !!document.querySelector(
                        '.error, .invalid-feedback, .form-error, [class*="error"]'
                    );
                    const hasInvalidInput = !!document.querySelector('input:invalid');

                    if (hasError || hasInvalidInput || ++attempts >= 15) {
                        resolve({
                            hasInput: true,
                            hasError,
                            hasInvalidInput
                        });
                    } else {
                        setTimeout(check, 200);
                    }
                };
                setTimeout(check, 200);
            });
        });

        if (!result.hasInput) {
            return { passed: null, skipped: true, message: 'No numeric input found to test validation' };
        }

        const passed = result.hasError || result.hasInvalidInput;

        return {
            passed,
            message: passed
                ? 'Invalid settings value shows validation error'
                : 'Invalid settings value did not trigger validation'
        };
    },

    async requiredFieldsMarked(page, baseUrl) {
        await navigateTo(page, `${baseUrl}/`);

        const result = await page.evaluate(() => {
            const requiredInputs = document.querySelectorAll('[required], .required');
            const requiredLabels = document.querySelectorAll('label.required, label:has(+ [required])');
            // Note: :contains() is not valid CSS - check for asterisks differently
            const asteriskIndicators = document.querySelectorAll('.required-indicator, .asterisk');
            // Check for labels that contain asterisks in their text content
            const labelsWithAsterisk = Array.from(document.querySelectorAll('label')).filter(label => label.textContent.includes('*'));

            return {
                requiredInputCount: requiredInputs.length,
                requiredLabelCount: requiredLabels.length,
                hasAsterisks: asteriskIndicators.length > 0 ||
                              labelsWithAsterisk.length > 0 ||
                              document.body.innerHTML.includes('*</label>') ||
                              document.body.innerHTML.includes('required')
            };
        });

        if (result.requiredInputCount === 0 && result.requiredLabelCount === 0) {
            return { passed: null, skipped: true, message: 'No required field indicators found' };
        }

        return {
            passed: true,
            message: `Required fields marked (${result.requiredInputCount} inputs, ${result.requiredLabelCount} labels)`
        };
    }
};

// ============================================================================
// Main Test Runner
// ============================================================================
async function main() {
    log.section('Error Handling Tests');

    const ctx = await setupTest({ authenticate: true });
    const results = new TestResults('Error Handling Tests');
    const { page } = ctx;
    const { baseUrl } = ctx.config;

    try {
        // 404 Error Tests
        log.section('404 Errors');
        await results.run('404', 'Non-existent Page Shows 404', () => Error404Tests.nonExistentPageShows404(page, baseUrl), { page });
        await results.run('404', 'Invalid Research ID Handled', () => Error404Tests.invalidResearchIdHandled(page, baseUrl), { page });
        await results.run('404', 'Invalid Document ID Handled', () => Error404Tests.invalidDocumentIdHandled(page, baseUrl), { page });

        // 401 Authentication Tests
        log.section('401 Authentication');
        await results.run('401', 'Unauthenticated Redirects To Login', () => Error401Tests.unauthenticatedRedirectsToLogin(page, baseUrl), { page });

        // After 401 test cleared cookies, re-authenticate on a fresh login page.
        // We avoid waitForNavigation here — if login fails (CSRF, wrong password),
        // it stays on /auth/login and waitForNavigation hangs for the full timeout.
        // Instead: click submit, then poll for URL change or session cookie.
        let reAuthOk = false;
        try {
            await page.goto(`${baseUrl}/auth/login`, { waitUntil: 'domcontentloaded', timeout: 15000 });
            await page.waitForSelector('input[name="username"]', { timeout: 10000 });
            await page.$eval('input[name="username"]', el => el.value = '');
            await page.$eval('input[name="password"]', el => el.value = '');
            await page.type('input[name="username"]', 'test_admin');
            await page.type('input[name="password"]', 'testpass123');
            await page.click('button[type="submit"]');

            // Poll for up to 15s: either we leave /auth/login or get a session cookie
            for (let i = 0; i < 30; i++) {
                await delay(500);
                const url = page.url();
                if (!url.includes('/auth/login')) {
                    reAuthOk = true;
                    break;
                }
                const cookies = await page.cookies();
                if (cookies.some(c => c.name === 'session')) {
                    // Have session cookie but still on login page — navigate away
                    await page.goto(baseUrl, { waitUntil: 'domcontentloaded', timeout: 15000 });
                    reAuthOk = true;
                    break;
                }
            }
        } catch (reAuthError) {
            log.warning(`Direct re-auth failed: ${reAuthError.message}`);
        }

        // Fallback: try ensureAuthenticated if direct login failed
        if (!reAuthOk) {
            try {
                await withTimeout(
                    ctx.authHelper.ensureAuthenticated(),
                    60000,
                    'Re-authentication after 401 tests'
                );
                reAuthOk = true;
            } catch (error) {
                log.warning(`Re-authentication timed out: ${error.message}`);
            }
        }

        if (reAuthOk) {
            const apiAuthResult = await Error401Tests.apiUnauthorizedReturns401(page, baseUrl);
            if (apiAuthResult.skipped) {
                results.skip('401', 'API Unauthorized Returns 401', apiAuthResult.message);
            } else {
                results.add('401', 'API Unauthorized Returns 401', apiAuthResult.passed, apiAuthResult.message);
            }
        } else {
            results.skip('401', 'API Unauthorized Returns 401', 'Skipped — re-authentication timed out');
        }

        // Re-authenticate again for remaining tests
        if (!reAuthOk) {
            try {
                await withTimeout(
                    ctx.authHelper.ensureAuthenticated(),
                    60000,
                    'Re-authentication for API tests'
                );
                reAuthOk = true;
            } catch (error) {
                log.warning(`Re-authentication timed out again: ${error.message}`);
            }
        }

        // API Error Tests (require authenticated session)
        log.section('API Errors');
        if (reAuthOk) {
            const missingParamsResult = await ApiErrorTests.apiMissingParamsReturns400(page, baseUrl);
            if (missingParamsResult.skipped) {
                results.skip('API', 'API Missing Params Returns 400', missingParamsResult.message);
            } else {
                results.add('API', 'API Missing Params Returns 400', missingParamsResult.passed, missingParamsResult.message);
            }

            await results.run('API', 'API Invalid ID Returns 404', () => ApiErrorTests.apiInvalidIdReturns404(page, baseUrl), { page });
        } else {
            results.skip('API', 'API Missing Params Returns 400', 'Skipped — could not re-authenticate after 401 tests');
            results.skip('API', 'API Invalid ID Returns 404', 'Skipped — could not re-authenticate after 401 tests');
        }

        // Rate Limiting Tests (require authenticated session)
        log.section('Rate Limiting');
        if (reAuthOk) {
            const rateLimitWarningResult = await RateLimitTests.rateLimitingWarningDisplays(page, baseUrl);
            if (rateLimitWarningResult.skipped) {
                results.skip('RateLimit', 'Rate Limiting Warning Displays', rateLimitWarningResult.message);
            } else {
                results.add('RateLimit', 'Rate Limiting Warning Displays', rateLimitWarningResult.passed, rateLimitWarningResult.message);
            }

            const rateLimitStatusResult = await RateLimitTests.rateLimitingStatusEndpoint(page, baseUrl);
            if (rateLimitStatusResult.skipped) {
                results.skip('RateLimit', 'Rate Limiting Status Endpoint', rateLimitStatusResult.message);
            } else {
                results.add('RateLimit', 'Rate Limiting Status Endpoint', rateLimitStatusResult.passed, rateLimitStatusResult.message);
            }
        } else {
            results.skip('RateLimit', 'Rate Limiting Warning Displays', 'Skipped — could not re-authenticate after 401 tests');
            results.skip('RateLimit', 'Rate Limiting Status Endpoint', 'Skipped — could not re-authenticate after 401 tests');
        }

        // Form Validation Tests
        log.section('Form Validation');
        const emptyQueryResult = await FormValidationTests.emptyQueryShowsError(page, baseUrl);
        if (emptyQueryResult.skipped) {
            results.skip('Validation', 'Empty Query Shows Error', emptyQueryResult.message);
        } else {
            results.add('Validation', 'Empty Query Shows Error', emptyQueryResult.passed, emptyQueryResult.message);
        }

        const invalidSettingsResult = await FormValidationTests.invalidSettingsShowsError(page, baseUrl);
        if (invalidSettingsResult.skipped) {
            results.skip('Validation', 'Invalid Settings Shows Error', invalidSettingsResult.message);
        } else {
            results.add('Validation', 'Invalid Settings Shows Error', invalidSettingsResult.passed, invalidSettingsResult.message);
        }

        const requiredFieldsResult = await FormValidationTests.requiredFieldsMarked(page, baseUrl);
        if (requiredFieldsResult.skipped) {
            results.skip('Validation', 'Required Fields Marked', requiredFieldsResult.message);
        } else {
            results.add('Validation', 'Required Fields Marked', requiredFieldsResult.passed, requiredFieldsResult.message);
        }

    } catch (error) {
        log.error(`Fatal error: ${error.message}`);
        console.error(error.stack);
    } finally {
        results.print();
        results.save();
        await teardownTest(ctx);
        process.exit(results.exitCode());
    }
}

// Run if executed directly
if (require.main === module) {
    main().catch(error => {
        console.error('Test runner failed:', error);
        process.exit(1);
    });
}

module.exports = { Error404Tests, Error401Tests, ApiErrorTests, RateLimitTests, FormValidationTests };
