<?php

namespace Tests\Feature\Security;

use App\Models\TranscriptionProject;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Http\UploadedFile;
use Illuminate\Support\Facades\Queue;
use Illuminate\Support\Facades\Storage;
use Tests\TestCase;

class Phase6Test extends TestCase
{
    use RefreshDatabase;

    // -------------------------------------------------------
    // Helpers
    // -------------------------------------------------------

    private function makeMp3File(string $name = 'audio.mp3'): array
    {
        $tmpPath = tempnam(sys_get_temp_dir(), 'mp3_');
        // MPEG-1 Layer 3 frame sync word: FF FB = 11111111 11111011
        // Followed by header byte 0x90 (128kbps, 44100Hz) and frame data
        file_put_contents($tmpPath, "\xFF\xFB\x90\x00" . str_repeat("\xFF", 512));
        return [$tmpPath, new UploadedFile($tmpPath, $name, 'audio/mpeg', null, true)];
    }

    private function makeWavFile(string $name = 'audio.wav'): array
    {
        $tmpPath = tempnam(sys_get_temp_dir(), 'wav_');
        // WAV: RIFF header  0x52 0x49 0x46 0x46
        file_put_contents($tmpPath, "\x52\x49\x46\x46\x00\x00\x00\x00\x57\x41\x56\x45" . str_repeat("\x00", 512));
        return [$tmpPath, new UploadedFile($tmpPath, $name, 'audio/wav', null, true)];
    }

    private function makeInvalidFile(string $name = 'malicious.mp3'): array
    {
        $tmpPath = tempnam(sys_get_temp_dir(), 'fake_');
        file_put_contents($tmpPath, "<?php echo 'malicious'; ?>" . str_repeat("X", 512));
        return [$tmpPath, new UploadedFile($tmpPath, $name, 'audio/mpeg', null, true)];
    }

    // -------------------------------------------------------
    // Security Headers
    // -------------------------------------------------------

    public function test_security_headers_present_on_web_response(): void
    {
        $response = $this->get(route('login'));
        $response->assertOk();

        $response->assertHeader('X-Frame-Options', 'SAMEORIGIN');
        $response->assertHeader('X-Content-Type-Options', 'nosniff');
        $response->assertHeader('X-XSS-Protection', '1; mode=block');
        $response->assertHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
    }

    public function test_csp_and_permissions_headers_present(): void
    {
        $response = $this->get(route('login'));
        $response->assertOk();

        $this->assertNotEmpty($response->headers->get('Content-Security-Policy'));
        $this->assertNotEmpty($response->headers->get('Permissions-Policy'));
    }

    public function test_security_headers_present_on_authenticated_response(): void
    {
        $user = User::factory()->create();

        $response = $this->actingAs($user)->get(route('user.dashboard'));
        $response->assertOk();

        $response->assertHeader('X-Frame-Options', 'SAMEORIGIN');
        $response->assertHeader('X-Content-Type-Options', 'nosniff');
    }

    public function test_csp_blocks_framing_from_other_origins(): void
    {
        $csp = $this->get(route('login'))->headers->get('Content-Security-Policy');

        $this->assertStringContainsString("frame-ancestors", $csp === null ? '' : $csp);
    }

    // -------------------------------------------------------
    // Magic Bytes Validation
    // -------------------------------------------------------

    public function test_upload_accepts_valid_mp3_magic_bytes(): void
    {
        Storage::fake('private');
        Queue::fake();

        $user = User::factory()->create();
        [$tmpPath, $file] = $this->makeMp3File();

        $this->actingAs($user)
            ->post(route('user.projects.store'), [
                'title' => 'Audio MP3 Sah',
                'audio' => $file,
            ])->assertRedirect();

        Queue::assertPushed(\App\Jobs\TranscribeAudioJob::class);

        @unlink($tmpPath);
    }

    public function test_upload_accepts_valid_wav_magic_bytes(): void
    {
        Storage::fake('private');
        Queue::fake();

        $user = User::factory()->create();
        [$tmpPath, $file] = $this->makeWavFile();

        $this->actingAs($user)
            ->post(route('user.projects.store'), [
                'title' => 'Audio WAV Sah',
                'audio' => $file,
            ])->assertRedirect();

        @unlink($tmpPath);
    }

    public function test_upload_rejects_file_with_invalid_magic_bytes(): void
    {
        Storage::fake('private');
        Queue::fake();

        $user = User::factory()->create();
        [$tmpPath, $file] = $this->makeInvalidFile();

        $this->actingAs($user)
            ->post(route('user.projects.store'), [
                'title' => 'Fail Palsu',
                'audio' => $file,
            ])->assertSessionHasErrors('audio');

        Queue::assertNothingPushed();
        Storage::disk('private')->assertDirectoryEmpty('transcriptions');

        @unlink($tmpPath);
    }

    public function test_upload_rejects_polyglot_file_with_valid_extension_wrong_content(): void
    {
        Storage::fake('private');
        Queue::fake();

        $user = User::factory()->create();

        $tmpPath = tempnam(sys_get_temp_dir(), 'poly_');
        // HTML disguised as MP3
        file_put_contents($tmpPath, '<html><body>XSS</body></html>' . str_repeat('X', 512));
        $file = new UploadedFile($tmpPath, 'audio.mp3', 'audio/mpeg', null, true);

        $this->actingAs($user)
            ->post(route('user.projects.store'), [
                'title' => 'Polyglot',
                'audio' => $file,
            ])->assertSessionHasErrors('audio');

        Queue::assertNothingPushed();

        @unlink($tmpPath);
    }

    // -------------------------------------------------------
    // Rate Limiting — Login (5 per minute)
    // -------------------------------------------------------

    public function test_login_throttled_after_5_failed_attempts(): void
    {
        User::factory()->create(['email' => 'pengguna@test.com']);

        for ($i = 0; $i < 5; $i++) {
            $this->post('/login', [
                'email'    => 'pengguna@test.com',
                'password' => 'kata-laluan-salah',
            ]);
        }

        $this->post('/login', [
            'email'    => 'pengguna@test.com',
            'password' => 'kata-laluan-salah',
        ])->assertStatus(429);
    }

    public function test_login_allows_successful_login_within_limit(): void
    {
        $user = User::factory()->create([
            'email'    => 'sah@test.com',
            'password' => bcrypt('kata-laluan-betul'),
        ]);

        // 2 failed attempts
        $this->post('/login', ['email' => 'sah@test.com', 'password' => 'salah']);
        $this->post('/login', ['email' => 'sah@test.com', 'password' => 'salah']);

        // Successful login still works under limit
        $this->post('/login', [
            'email'    => 'sah@test.com',
            'password' => 'kata-laluan-betul',
        ])->assertRedirect();
    }

    // -------------------------------------------------------
    // Rate Limiting — Upload (10 per hour)
    // -------------------------------------------------------

    public function test_upload_throttled_after_10_requests(): void
    {
        Storage::fake('private');
        Queue::fake();

        $user = User::factory()->create();

        // 10 requests — will fail validation (no valid magic bytes) but throttle still counts
        for ($i = 0; $i < 10; $i++) {
            $this->actingAs($user)->post(route('user.projects.store'), [
                'title' => "Projek {$i}",
                'audio' => UploadedFile::fake()->create("audio-{$i}.mp3", 1, 'audio/mpeg'),
            ]);
        }

        // 11th request must be throttled regardless of payload
        $this->actingAs($user)->post(route('user.projects.store'), [
            'title' => 'Projek 11',
            'audio' => UploadedFile::fake()->create('audio.mp3', 1, 'audio/mpeg'),
        ])->assertStatus(429);
    }

    public function test_upload_throttle_is_per_user(): void
    {
        Storage::fake('private');
        Queue::fake();

        $userA = User::factory()->create();
        $userB = User::factory()->create();

        // Exhaust userA's quota
        for ($i = 0; $i < 10; $i++) {
            $this->actingAs($userA)->post(route('user.projects.store'), [
                'title' => "A-{$i}",
                'audio' => UploadedFile::fake()->create("a-{$i}.mp3", 1, 'audio/mpeg'),
            ]);
        }

        $this->actingAs($userA)->post(route('user.projects.store'), [
            'title' => 'A-11',
            'audio' => UploadedFile::fake()->create('a.mp3', 1, 'audio/mpeg'),
        ])->assertStatus(429);

        // userB's quota is independent — not throttled
        [$tmpPath, $file] = $this->makeMp3File('b.mp3');
        $this->actingAs($userB)->post(route('user.projects.store'), [
            'title' => 'B-1',
            'audio' => $file,
        ])->assertRedirect();

        @unlink($tmpPath);
    }
}