import { afterEach, beforeEach, describe, expect, it } from 'vitest'
import {
  buildS3ObjectKey,
  canonicalS3Url,
  contentTypeForUpload,
  detectedContentType,
  isWorkspaceS3Key,
  S3_PREFIX,
  s3KeyFromCanonicalUrl,
} from '@/lib/storage/s3'

const prior = {
  bucket: process.env.S3_BUCKET_NAME,
  region: process.env.AWS_DEFAULT_REGION,
  access: process.env.AWS_ACCESS_KEY_ID,
  secret: process.env.AWS_SECRET_ACCESS_KEY,
}

function restore(name: string, value: string | undefined) {
  if (value === undefined) delete process.env[name]
  else process.env[name] = value
}

describe('Workspace S3 storage rules', () => {
  beforeEach(() => {
    process.env.S3_BUCKET_NAME = 'heavy-haul-agent'
    process.env.AWS_DEFAULT_REGION = 'us-east-1'
    process.env.AWS_ACCESS_KEY_ID = 'test-only'
    process.env.AWS_SECRET_ACCESS_KEY = 'test-only'
  })

  afterEach(() => {
    restore('S3_BUCKET_NAME', prior.bucket)
    restore('AWS_DEFAULT_REGION', prior.region)
    restore('AWS_ACCESS_KEY_ID', prior.access)
    restore('AWS_SECRET_ACCESS_KEY', prior.secret)
  })

  it('keeps the original extension and approved prefix in collision-safe keys', () => {
    const key = buildS3ObjectKey(S3_PREFIX.permit, '../My Permit 01.PNG')
    expect(key).toMatch(/^permits\/orderSteptwo\/[0-9a-f-]+-My_Permit_01\.PNG$/)
    expect(isWorkspaceS3Key(key)).toBe(true)
  })

  it('uses the actual image and PDF content types', () => {
    expect(contentTypeForUpload('permit.png', 'image/png')).toBe('image/png')
    expect(contentTypeForUpload('ratecon.JPG', '')).toBe('image/jpeg')
    expect(contentTypeForUpload('ratecon.pdf', 'application/pdf')).toBe('application/pdf')
    expect(detectedContentType(new Uint8Array([0x25, 0x50, 0x44, 0x46, 0x2d]))).toBe('application/pdf')
    expect(detectedContentType(new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))).toBe('image/png')
    expect(detectedContentType(new Uint8Array([0xff, 0xd8, 0xff, 0xe0]))).toBe('image/jpeg')
  })

  it('builds and parses only the approved bucket URL', () => {
    const key = 'permits/rate_confirmations/id-rate con.pdf'
    const url = canonicalS3Url(key)
    expect(url).toBe(
      'https://heavy-haul-agent.s3.us-east-1.amazonaws.com/permits/rate_confirmations/id-rate%20con.pdf',
    )
    expect(s3KeyFromCanonicalUrl(url)).toBe(key)
    expect(s3KeyFromCanonicalUrl('https://another-bucket.s3.us-east-1.amazonaws.com/file.pdf')).toBeNull()
  })

  it('rejects keys outside the approved Workspace prefixes', () => {
    expect(isWorkspaceS3Key('other-bucket/file.pdf')).toBe(false)
    expect(isWorkspaceS3Key('permits/orderSteptwo-evil/file.pdf')).toBe(false)
  })
})