const crypto = require("crypto");
const bcrypt = require("bcryptjs");
const { authenticator } = require("otplib");
const QRCode = require("qrcode");

// Mock dependencies
jest.mock("otplib", () => ({
  authenticator: {
    generateSecret: jest.fn(),
    keyuri: jest.fn(),
    verify: jest.fn(),
  },
}));

jest.mock("qrcode", () => ({
  toDataURL: jest.fn(),
}));

jest.mock("bcryptjs", () => ({
  hash: jest.fn(),
  compare: jest.fn(),
}));

jest.mock("../../../utils/logger", () => ({
  info: jest.fn(),
  error: jest.fn(),
  warn: jest.fn(),
}));

const TwoFactorService = require("../../../services/TwoFactorService");

describe("TwoFactorService", () => {
  const originalEnv = process.env;

  beforeEach(() => {
    jest.clearAllMocks();
    process.env = {
      ...originalEnv,
      TOTP_ENCRYPTION_KEY: "a".repeat(64),
      TOTP_ISSUER: "TestApp",
      TWO_FACTOR_EMAIL_OTP_EXPIRY_MINUTES: "10",
      TWO_FACTOR_STEP_UP_VALIDITY_MINUTES: "5",
    };
  });

  afterEach(() => {
    process.env = originalEnv;
  });

  describe("generateTotpSecret", () => {
    it("should generate TOTP secret with QR code", async () => {
      authenticator.generateSecret.mockReturnValue("test-secret");
      authenticator.keyuri.mockReturnValue(
        "otpauth://totp/VillageShare:test@example.com?secret=test-secret",
      );
      QRCode.toDataURL.mockResolvedValue("data:image/png;base64,qrcode");

      const result =
        await TwoFactorService.generateTotpSecret("test@example.com");

      expect(result.qrCodeDataUrl).toBe("data:image/png;base64,qrcode");
      expect(result.encryptedSecret).toBeDefined();
      expect(result.encryptedSecretIv).toBeDefined();
      // The issuer is loaded at module load time, so it uses the default 'VillageShare'
      expect(authenticator.keyuri).toHaveBeenCalledWith(
        "test@example.com",
        "VillageShare",
        "test-secret",
      );
    });

    it("should use issuer from environment", async () => {
      authenticator.generateSecret.mockReturnValue("test-secret");
      authenticator.keyuri.mockReturnValue(
        "otpauth://totp/VillageShare:test@example.com",
      );
      QRCode.toDataURL.mockResolvedValue("data:image/png;base64,qrcode");

      const result =
        await TwoFactorService.generateTotpSecret("test@example.com");

      expect(result.qrCodeDataUrl).toBeDefined();
      expect(authenticator.keyuri).toHaveBeenCalled();
    });
  });

  describe("verifyTotpCode", () => {
    it("should return true for valid code", () => {
      authenticator.verify.mockReturnValue(true);

      // Use actual encryption
      const { encrypted, iv } = TwoFactorService._encryptSecret("test-secret");
      const result = TwoFactorService.verifyTotpCode(encrypted, iv, "123456");

      expect(result).toBe(true);
    });

    it("should return false for invalid code", () => {
      authenticator.verify.mockReturnValue(false);

      const { encrypted, iv } = TwoFactorService._encryptSecret("test-secret");
      const result = TwoFactorService.verifyTotpCode(encrypted, iv, "654321");

      expect(result).toBe(false);
    });

    it("should return false for non-6-digit code", () => {
      const result = TwoFactorService.verifyTotpCode(
        "encrypted",
        "iv",
        "12345",
      );
      expect(result).toBe(false);

      const result2 = TwoFactorService.verifyTotpCode(
        "encrypted",
        "iv",
        "1234567",
      );
      expect(result2).toBe(false);

      const result3 = TwoFactorService.verifyTotpCode(
        "encrypted",
        "iv",
        "abcdef",
      );
      expect(result3).toBe(false);
    });

    it("should return false when decryption fails", () => {
      const result = TwoFactorService.verifyTotpCode(
        "invalid-encrypted",
        "invalid-iv",
        "123456",
      );
      expect(result).toBe(false);
    });
  });

  describe("generateEmailOtp", () => {
    it("should generate 6-digit code", () => {
      const result = TwoFactorService.generateEmailOtp();

      expect(result.code).toMatch(/^\d{6}$/);
    });

    it("should return hashed code", () => {
      const result = TwoFactorService.generateEmailOtp();

      expect(result.hashedCode).toHaveLength(64); // SHA-256 hex
    });

    it("should set expiry in the future", () => {
      const result = TwoFactorService.generateEmailOtp();
      const now = new Date();

      expect(result.expiry.getTime()).toBeGreaterThan(now.getTime());
    });

    it("should generate different codes each time", () => {
      const result1 = TwoFactorService.generateEmailOtp();
      const result2 = TwoFactorService.generateEmailOtp();

      // Codes should likely be different (very small chance of collision)
      expect(result1.code).not.toBe(result2.code);
    });
  });

  describe("verifyEmailOtp", () => {
    it("should return true for valid code", () => {
      const code = "123456";
      const hashedCode = crypto.createHash("sha256").update(code).digest("hex");
      const expiry = new Date(Date.now() + 600000); // 10 minutes from now

      const result = TwoFactorService.verifyEmailOtp(code, hashedCode, expiry);

      expect(result).toBe(true);
    });

    it("should return false for invalid code", () => {
      const correctHash = crypto
        .createHash("sha256")
        .update("123456")
        .digest("hex");
      const expiry = new Date(Date.now() + 600000);

      const result = TwoFactorService.verifyEmailOtp(
        "654321",
        correctHash,
        expiry,
      );

      expect(result).toBe(false);
    });

    it("should return false for expired code", () => {
      const code = "123456";
      const hashedCode = crypto.createHash("sha256").update(code).digest("hex");
      const expiry = new Date(Date.now() - 60000); // 1 minute ago

      const result = TwoFactorService.verifyEmailOtp(code, hashedCode, expiry);

      expect(result).toBe(false);
    });

    it("should return false for non-6-digit code", () => {
      const hashedCode = crypto
        .createHash("sha256")
        .update("123456")
        .digest("hex");
      const expiry = new Date(Date.now() + 600000);

      expect(TwoFactorService.verifyEmailOtp("12345", hashedCode, expiry)).toBe(
        false,
      );
      expect(
        TwoFactorService.verifyEmailOtp("1234567", hashedCode, expiry),
      ).toBe(false);
      expect(
        TwoFactorService.verifyEmailOtp("abcdef", hashedCode, expiry),
      ).toBe(false);
    });

    it("should return false when no expiry provided", () => {
      const code = "123456";
      const hashedCode = crypto.createHash("sha256").update(code).digest("hex");

      const result = TwoFactorService.verifyEmailOtp(code, hashedCode, null);

      expect(result).toBe(false);
    });
  });

  describe("generateRecoveryCodes", () => {
    it("should generate 10 recovery codes", async () => {
      bcrypt.hash.mockResolvedValue("hashed-code");

      const result = await TwoFactorService.generateRecoveryCodes();

      expect(result.codes).toHaveLength(10);
      expect(result.hashedCodes).toHaveLength(10);
    });

    it("should generate codes in XXXX-XXXX format", async () => {
      bcrypt.hash.mockResolvedValue("hashed-code");

      const result = await TwoFactorService.generateRecoveryCodes();

      result.codes.forEach((code) => {
        expect(code).toMatch(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/);
      });
    });

    it("should exclude confusing characters", async () => {
      bcrypt.hash.mockResolvedValue("hashed-code");

      const result = await TwoFactorService.generateRecoveryCodes();

      const confusingChars = ["0", "O", "1", "I", "L"];
      result.codes.forEach((code) => {
        confusingChars.forEach((char) => {
          expect(code).not.toContain(char);
        });
      });
    });

    it("should hash each code with bcrypt", async () => {
      bcrypt.hash.mockResolvedValue("hashed-code");

      await TwoFactorService.generateRecoveryCodes();

      expect(bcrypt.hash).toHaveBeenCalledTimes(10);
    });
  });

  describe("verifyRecoveryCode", () => {
    it("should return valid for correct code (new format)", async () => {
      bcrypt.compare.mockResolvedValueOnce(false).mockResolvedValueOnce(true);

      const recoveryData = {
        version: 1,
        codes: [
          { hash: "hash1", used: false, index: 0 },
          { hash: "hash2", used: false, index: 1 },
        ],
      };

      const result = await TwoFactorService.verifyRecoveryCode(
        "XXXX-YYYY",
        recoveryData,
      );

      expect(result.valid).toBe(true);
      expect(result.index).toBe(1);
    });

    it("should return invalid for incorrect code", async () => {
      bcrypt.compare.mockResolvedValue(false);

      const recoveryData = {
        version: 1,
        codes: [{ hash: "hash1", used: false, index: 0 }],
      };

      const result = await TwoFactorService.verifyRecoveryCode(
        "XXXX-YYYY",
        recoveryData,
      );

      expect(result.valid).toBe(false);
      expect(result.index).toBe(-1);
    });

    it("should skip used codes", async () => {
      bcrypt.compare.mockResolvedValue(true);

      const recoveryData = {
        version: 1,
        codes: [
          { hash: "hash1", used: true, index: 0 },
          { hash: "hash2", used: false, index: 1 },
        ],
      };

      await TwoFactorService.verifyRecoveryCode("XXXX-YYYY", recoveryData);

      // Should only check the unused code
      expect(bcrypt.compare).toHaveBeenCalledTimes(1);
    });

    it("should normalize input code to uppercase", async () => {
      bcrypt.compare.mockResolvedValue(true);

      const recoveryData = {
        version: 1,
        codes: [{ hash: "hash1", used: false, index: 0 }],
      };

      await TwoFactorService.verifyRecoveryCode("xxxx-yyyy", recoveryData);

      expect(bcrypt.compare).toHaveBeenCalledWith("XXXX-YYYY", "hash1");
    });

    it("should return invalid for wrong format", async () => {
      const recoveryData = {
        version: 1,
        codes: [{ hash: "hash1", used: false, index: 0 }],
      };

      const result = await TwoFactorService.verifyRecoveryCode(
        "INVALID",
        recoveryData,
      );

      expect(result.valid).toBe(false);
    });

    it("should handle legacy array format", async () => {
      bcrypt.compare.mockResolvedValueOnce(false).mockResolvedValueOnce(true);

      const recoveryData = ["hash1", "hash2", "hash3"];

      const result = await TwoFactorService.verifyRecoveryCode(
        "XXXX-YYYY",
        recoveryData,
      );

      expect(result.valid).toBe(true);
    });

    it("should skip null entries in legacy format", async () => {
      bcrypt.compare.mockResolvedValue(true);

      const recoveryData = [null, "hash2"];

      await TwoFactorService.verifyRecoveryCode("XXXX-YYYY", recoveryData);

      expect(bcrypt.compare).toHaveBeenCalledTimes(1);
    });
  });

  describe("validateStepUpSession", () => {
    it("should return true for valid session", () => {
      const user = {
        twoFactorVerifiedAt: new Date(Date.now() - 60000), // 1 minute ago
      };

      const result = TwoFactorService.validateStepUpSession(user);

      expect(result).toBe(true);
    });

    it("should return false for expired session", () => {
      const user = {
        twoFactorVerifiedAt: new Date(Date.now() - 600000), // 10 minutes ago
      };

      const result = TwoFactorService.validateStepUpSession(user, 5); // 5 minute window

      expect(result).toBe(false);
    });

    it("should return false when no verification timestamp", () => {
      const user = {
        twoFactorVerifiedAt: null,
      };

      const result = TwoFactorService.validateStepUpSession(user);

      expect(result).toBe(false);
    });

    it("should use custom max age when provided", () => {
      const user = {
        twoFactorVerifiedAt: new Date(Date.now() - 1200000), // 20 minutes ago
      };

      const result = TwoFactorService.validateStepUpSession(user, 30); // 30 minute window

      expect(result).toBe(true);
    });
  });

  describe("getRemainingRecoveryCodesCount", () => {
    it("should return count for new format", () => {
      const recoveryData = {
        version: 1,
        codes: [
          { hash: "hash1", used: false },
          { hash: "hash2", used: true },
          { hash: "hash3", used: false },
        ],
      };

      const result =
        TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);

      expect(result).toBe(2);
    });

    it("should return count for legacy array format", () => {
      const recoveryData = ["hash1", null, "hash3", "hash4", null];

      const result =
        TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);

      expect(result).toBe(3);
    });

    it("should return 0 for null data", () => {
      const result = TwoFactorService.getRemainingRecoveryCodesCount(null);
      expect(result).toBe(0);
    });

    it("should return 0 for undefined data", () => {
      const result = TwoFactorService.getRemainingRecoveryCodesCount(undefined);
      expect(result).toBe(0);
    });

    it("should handle empty array", () => {
      const result = TwoFactorService.getRemainingRecoveryCodesCount([]);
      expect(result).toBe(0);
    });

    it("should handle all used codes", () => {
      const recoveryData = {
        version: 1,
        codes: [
          { hash: "hash1", used: true },
          { hash: "hash2", used: true },
        ],
      };

      const result =
        TwoFactorService.getRemainingRecoveryCodesCount(recoveryData);

      expect(result).toBe(0);
    });
  });

  describe("isEmailOtpLocked", () => {
    it("should return true when max attempts reached", () => {
      const result = TwoFactorService.isEmailOtpLocked(3);
      expect(result).toBe(true);
    });

    it("should return true when over max attempts", () => {
      const result = TwoFactorService.isEmailOtpLocked(5);
      expect(result).toBe(true);
    });

    it("should return false when under max attempts", () => {
      const result = TwoFactorService.isEmailOtpLocked(2);
      expect(result).toBe(false);
    });

    it("should return false for zero attempts", () => {
      const result = TwoFactorService.isEmailOtpLocked(0);
      expect(result).toBe(false);
    });
  });

  describe("_encryptSecret / _decryptSecret", () => {
    it("should encrypt and decrypt correctly", () => {
      const secret = "my-test-secret";

      const { encrypted, iv } = TwoFactorService._encryptSecret(secret);
      const decrypted = TwoFactorService._decryptSecret(encrypted, iv);

      expect(decrypted).toBe(secret);
    });

    it("should throw error when encryption key is missing", () => {
      delete process.env.TOTP_ENCRYPTION_KEY;

      expect(() => TwoFactorService._encryptSecret("test")).toThrow(
        "TOTP_ENCRYPTION_KEY",
      );
    });

    it("should throw error when encryption key is wrong length", () => {
      process.env.TOTP_ENCRYPTION_KEY = "short";

      expect(() => TwoFactorService._encryptSecret("test")).toThrow(
        "64-character hex string",
      );
    });
  });
});