import { assert, assertEquals } from "@std/assert";
import { DatabaseSync } from "node:sqlite";
import { Auth, type Session } from "./auth.ts";
import { type Actor, Hydrant } from "./hydrant.ts";
import { handler } from "./main.ts";
import { Star } from "./records.ts";
import { Index } from "./sync.ts";
import { TitleLookup } from "./title.ts";

Deno.test("public profile escapes comments and shows handle rather than display name", async () => {
  const db = new DatabaseSync(":memory:");
  try {
    const auth = new Auth(db, new URL("http://127.0.0.1:8000"));
    const hydrant = new class extends Hydrant {
      override actor(_identifier: string): Promise<Actor> {
        return Promise.resolve({
          did: "did:plc:abcdefgh",
          handle: "char.lt",
          pds: "https://pds.example.org/",
          avatar: "https://pds.example.org/avatar",
        });
      }
      override stars(_did: string, _cursor?: string) {
        return Promise.resolve({
          stars: [{
            uri: "at://did:plc:abcdefgh/site.hackery.stars.star/3mgabcdefghij",
            link: "https://example.com/",
            star: Star.build({
              url: "https://example.com/",
              title: "A useful project",
              comment: "<script>alert(1)</script>",
              createdAt: "2026-09-24T10:00:00Z",
            }),
          }],
          cursor: undefined,
        });
      }
    }(new URL("http://127.0.0.1:3000"));
    const index = new Index(db, hydrant);
    const res = await handler(new Request("http://127.0.0.1:8000/char.lt"), {
      auth,
      hydrant,
      index,
      titles: new TitleLookup(db),
    });
    assertEquals(res.status, 200);
    const body = await res.text();
    assert(body.includes("char.lt"));
    assert(body.includes(">A useful project</a>"));
    assert(body.includes(">example.com</small>"));
    assert(body.includes("Starred: 24 September 2026 at 10:00"));
    assert(body.includes("&lt;script&gt;alert(1)&lt;/script&gt;"));
    assert(!body.includes("<script>"));
    assert(!body.includes("displayName"));
  } finally {
    db.close();
  }
});

Deno.test("unverified handle is shown with a readable DID profile URL", async () => {
  const db = new DatabaseSync(":memory:");
  try {
    const auth = new Auth(db, new URL("http://127.0.0.1:8000"));
    const hydrant = new class extends Hydrant {
      override actor(_identifier: string): Promise<Actor> {
        return Promise.resolve({
          did: "did:plc:abcdefgh",
          handle: "claimed.example.com",
          handleVerified: false,
          pds: "https://pds.example.org/",
        });
      }
      override stars(_did: string, _cursor?: string) {
        return Promise.resolve({ stars: [], cursor: undefined });
      }
    }(new URL("http://127.0.0.1:3000"));
    auth.session = () =>
      Promise.resolve({
        id: "test-session",
        did: "did:plc:abcdefgh",
        csrf: "test-csrf",
        oauth: {},
      } as unknown as Session);
    const app = {
      auth,
      hydrant,
      index: new Index(db, hydrant),
      titles: new TitleLookup(db),
    };
    const profile = await handler(
      new Request("http://127.0.0.1:8000/did:plc:abcdefgh"),
      app,
    );
    assertEquals(profile.status, 200);
    const body = await profile.text();
    assert(body.includes("claimed.example.com"));
    assert(body.includes("(unverified)"));
    assert(
      body.includes(
        '<nav><a href="/share">Add Star</a><a href="/did:plc:abcdefgh">claimed.example.com</a></nav>',
      ),
    );
    assert(!body.includes('href="/login">Sign in</a>'));
    const signIn = await handler(
      new Request("http://127.0.0.1:8000/login"),
      app,
    );
    assertEquals(signIn.headers.get("location"), "/");
    const browse = await handler(
      new Request("http://127.0.0.1:8000/go?handle=did%3Aplc%3Aabcdefgh"),
      app,
    );
    assertEquals(browse.headers.get("location"), "/did:plc:abcdefgh");
  } finally {
    db.close();
  }
});