import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import { createServer, type Server } from "node:https";
import { after, before, test } from "node:test";
import { fetchWith } from "../src/lib/http";

const TLS_OPTIONS = {
  cert: readFileSync(new URL("./fixtures/selfsigned-cert.pem", import.meta.url)),
  key: readFileSync(new URL("./fixtures/selfsigned-key.pem", import.meta.url)),
};

let server: Server;
let base: string;

before(async () => {
  server = createServer(TLS_OPTIONS, (req, res) => {
    res.writeHead(200, { "content-type": "text/plain" });
    res.end("ok");
  });
  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
  base = `https://127.0.0.1:${(server.address() as { port: number }).port}`;
});

after(async () => new Promise((resolve) => server.close(() => resolve())));

test("fetchWith verifies certificates by default", async () => {
  await assert.rejects(fetchWith({ baseUrl: base }, `${base}/`));
});

test("fetchWith accepts self-signed certificates when insecure", async () => {
  const res = await fetchWith({ baseUrl: base, insecure: true }, `${base}/`);
  assert.equal(res.status, 200);
  assert.equal(await res.text(), "ok");
});

test("fetchWith honors init headers and signal when insecure", async () => {
  let seen: string | undefined;
  const spy = createServer(TLS_OPTIONS, (req, res) => {
    seen = req.headers.authorization;
    res.writeHead(200);
    res.end("ok");
  });
  await new Promise<void>((resolve) => spy.listen(0, "127.0.0.1", resolve));
  const spyBase = `https://127.0.0.1:${(spy.address() as { port: number }).port}`;
  try {
    const res = await fetchWith({ baseUrl: spyBase, insecure: true }, `${spyBase}/`, {
      headers: { Authorization: "Bearer tok" },
      signal: AbortSignal.timeout(3000),
    });
    assert.equal(res.status, 200);
    assert.equal(seen, "Bearer tok");
  } finally {
    await new Promise<void>((resolve) => spy.close(() => resolve()));
  }
});