/**
 * Theme A end-to-end smoke.
 *
 * Exercises the primitives + service contracts that the 2FA flow
 * depends on, offline. The full browser-driven e2e (login form ->
 * 2FA modal -> /dashboard) requires the dev server and a seeded
 * 2FA-enabled user, so this smoke validates the layers below the
 * UI.
 *
 * Run: npx tsx scripts/smoke/a-2fa-flow.ts
 */
import './_lib';
import { ok, fail } from './_lib';
import {
    mintPendingLoginToken,
    verifyPendingLoginToken,
    mintPost2faToken,
    verifyPost2faToken,
} from '../../src/lib/auth/pending-login-token';
import { TwoFactorService } from '../../src/lib/services/two-factor.service';
import { TOTP } from 'otpauth';

function main(): void {
    // 1. generateSecret produces a base32-clean secret end-to-end (A.1)
    const { secret, uri } = TwoFactorService.generateSecret('smoke@local');
    if (!/^[A-Z2-7]+$/.test(secret)) {
        fail('A.1 generateSecret base32', `secret is not pure base32: ${secret}`);
    }
    ok('generateSecret emits base32 (A-Z + 2-7)');
    if (!uri.includes(secret)) {
        fail('A.1 URI consistency', 'URI does not embed the stored secret');
    }
    ok('TOTP URI embeds the same secret');

    // 2. Token kinds round-trip and reject substitution (A.3, A.4a)
    const pending = mintPendingLoginToken(99);
    if (verifyPendingLoginToken(pending)?.userId !== 99) {
        fail('A.3', 'pending token round-trip failed');
    }
    ok('pending-login token round-trip');

    const post = mintPost2faToken(99);
    if (verifyPost2faToken(post)?.userId !== 99) {
        fail('A.4a', 'post-2fa round-trip failed');
    }
    ok('post-2fa token round-trip');

    if (verifyPendingLoginToken(post) !== null) {
        fail('A.4a kind isolation', 'pending verifier accepted post-2fa token');
    }
    if (verifyPost2faToken(pending) !== null) {
        fail('A.4a kind isolation', 'post-2fa verifier accepted pending token');
    }
    ok('kind isolation enforced (pending != post-2fa)');

    // 3. isLegacyHexSecret predicate (A.2 migration safety)
    if (!TwoFactorService.isLegacyHexSecret('0123456789ABCDEF')) {
        fail('A.2 predicate', 'hex secret not flagged as legacy');
    }
    if (TwoFactorService.isLegacyHexSecret(secret)) {
        fail('A.2 predicate', 'fresh base32 secret WAS flagged as legacy');
    }
    ok('isLegacyHexSecret distinguishes hex from base32');

    // 4. TOTP verify accepts the secret we just generated (A.1 round-trip)
    const code = new TOTP({ secret, period: 30, digits: 6 }).generate();
    if (!TwoFactorService.verifyCode(secret, code)) {
        fail('A.1 round-trip', 'verifyCode rejected its own freshly-generated code');
    }
    ok('verifyCode accepts code generated from generateSecret output');

    ok('Theme A 2FA smoke', 'all primitives + service contracts pass offline checks');
}

main();