import { tap, expect } from '@git.zone/tstest/tapbundle';
import { startTestSmtpServer } from '../../helpers/server.loader.js';
import { createSmtpClient } from '../../helpers/smtp.client.js';
import { Email } from '../../../ts/mail/core/classes.email.js';
import * as crypto from 'crypto';

let testServer: any;

tap.test('setup test SMTP server', async () => {
  testServer = await startTestSmtpServer();
  expect(testServer).toBeTruthy();
  expect(testServer.port).toBeGreaterThan(0);
});

tap.test('CSEC-03: Basic DKIM signature structure', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  // Create email with DKIM configuration
  const email = new Email({
    from: 'sender@example.com',
    to: ['recipient@example.com'],
    subject: 'DKIM Signed Email',
    text: 'This email should be DKIM signed',
    dkim: {
      domainName: 'example.com',
      keySelector: 'default',
      privateKey: '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC3...\n-----END PRIVATE KEY-----',
      canonicalization: 'relaxed/relaxed'
    }
  });

  // Monitor for DKIM-Signature header
  let dkimSignature = '';
  const originalSendCommand = smtpClient.sendCommand.bind(smtpClient);
  
  smtpClient.sendCommand = async (command: string) => {
    if (command.toLowerCase().includes('dkim-signature:')) {
      dkimSignature = command;
    }
    return originalSendCommand(command);
  };

  const result = await smtpClient.sendMail(email);
  expect(result).toBeTruthy();
  
  if (dkimSignature) {
    console.log('DKIM-Signature header found:');
    console.log(dkimSignature.substring(0, 100) + '...');
    
    // Parse DKIM signature components
    const components = dkimSignature.match(/(\w+)=([^;]+)/g);
    if (components) {
      console.log('\nDKIM components:');
      components.forEach(comp => {
        const [key, value] = comp.split('=');
        console.log(`  ${key}: ${value.trim().substring(0, 50)}${value.length > 50 ? '...' : ''}`);
      });
    }
  } else {
    console.log('DKIM signing not implemented in Email class');
  }

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM canonicalization methods', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  // Test different canonicalization methods
  const canonicalizations = [
    'simple/simple',
    'simple/relaxed',
    'relaxed/simple',
    'relaxed/relaxed'
  ];

  for (const canon of canonicalizations) {
    console.log(`\nTesting canonicalization: ${canon}`);
    
    const email = new Email({
      from: 'sender@example.com',
      to: ['recipient@example.com'],
      subject: `DKIM Canon Test: ${canon}`,
      text: 'Testing canonicalization\r\n  with various   spaces\r\n\r\nand blank lines.\r\n',
      headers: {
        'X-Test-Header': '  value with spaces  '
      },
      dkim: {
        domainName: 'example.com',
        keySelector: 'test',
        privateKey: 'mock-key',
        canonicalization: canon
      }
    });

    try {
      const result = await smtpClient.sendMail(email);
      console.log(`  Result: ${result ? 'Success' : 'Failed'}`);
    } catch (error) {
      console.log(`  Error: ${error.message}`);
    }
  }

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM header selection', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  // Test header selection for DKIM signing
  const email = new Email({
    from: 'sender@example.com',
    to: ['recipient@example.com'],
    cc: ['cc@example.com'],
    subject: 'DKIM Header Selection Test',
    text: 'Testing which headers are included in DKIM signature',
    headers: {
      'X-Priority': 'High',
      'X-Mailer': 'Test Client',
      'List-Unsubscribe': '<mailto:unsub@example.com>'
    },
    dkim: {
      domainName: 'example.com',
      keySelector: 'default',
      privateKey: 'mock-key',
      headerFieldNames: [
        'From',
        'To',
        'Subject',
        'Date',
        'Message-ID',
        'X-Priority',
        'List-Unsubscribe'
      ]
    }
  });

  // Monitor signed headers
  let signedHeaders: string[] = [];
  const originalSendCommand = smtpClient.sendCommand.bind(smtpClient);
  
  smtpClient.sendCommand = async (command: string) => {
    if (command.toLowerCase().includes('dkim-signature:')) {
      const hMatch = command.match(/h=([^;]+)/);
      if (hMatch) {
        signedHeaders = hMatch[1].split(':').map(h => h.trim());
      }
    }
    return originalSendCommand(command);
  };

  const result = await smtpClient.sendMail(email);
  
  if (signedHeaders.length > 0) {
    console.log('\nHeaders included in DKIM signature:');
    signedHeaders.forEach(h => console.log(`  - ${h}`));
    
    // Check if important headers are included
    const importantHeaders = ['from', 'to', 'subject', 'date'];
    const missingHeaders = importantHeaders.filter(h => 
      !signedHeaders.some(sh => sh.toLowerCase() === h)
    );
    
    if (missingHeaders.length > 0) {
      console.log('\nWARNING: Important headers missing from signature:');
      missingHeaders.forEach(h => console.log(`  - ${h}`));
    }
  }

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM with RSA key generation', async () => {
  // Generate a test RSA key pair
  const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem'
    },
    privateKeyEncoding: {
      type: 'pkcs8',
      format: 'pem'
    }
  });

  console.log('Generated RSA key pair for DKIM:');
  console.log('Public key (first line):', publicKey.split('\n')[1].substring(0, 50) + '...');
  
  // Create DNS TXT record format
  const publicKeyBase64 = publicKey
    .replace(/-----BEGIN PUBLIC KEY-----/, '')
    .replace(/-----END PUBLIC KEY-----/, '')
    .replace(/\s/g, '');
  
  console.log('\nDNS TXT record for default._domainkey.example.com:');
  console.log(`v=DKIM1; k=rsa; p=${publicKeyBase64.substring(0, 50)}...`);

  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  const email = new Email({
    from: 'sender@example.com',
    to: ['recipient@example.com'],
    subject: 'DKIM with Real RSA Key',
    text: 'This email is signed with a real RSA key',
    dkim: {
      domainName: 'example.com',
      keySelector: 'default',
      privateKey: privateKey,
      hashAlgo: 'sha256'
    }
  });

  const result = await smtpClient.sendMail(email);
  expect(result).toBeTruthy();

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM body hash calculation', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  // Test body hash with different content
  const testBodies = [
    {
      name: 'Simple text',
      body: 'Hello World'
    },
    {
      name: 'Multi-line text',
      body: 'Line 1\r\nLine 2\r\nLine 3'
    },
    {
      name: 'Trailing newlines',
      body: 'Content\r\n\r\n\r\n'
    },
    {
      name: 'Empty body',
      body: ''
    }
  ];

  for (const test of testBodies) {
    console.log(`\nTesting body hash for: ${test.name}`);
    
    // Calculate expected body hash
    const canonicalBody = test.body.replace(/\r\n/g, '\n').trimEnd() + '\n';
    const bodyHash = crypto.createHash('sha256').update(canonicalBody).digest('base64');
    console.log(`  Expected hash: ${bodyHash.substring(0, 20)}...`);
    
    const email = new Email({
      from: 'sender@example.com',
      to: ['recipient@example.com'],
      subject: `Body Hash Test: ${test.name}`,
      text: test.body,
      dkim: {
        domainName: 'example.com',
        keySelector: 'default',
        privateKey: 'mock-key'
      }
    });

    // Monitor for body hash in DKIM signature
    let capturedBodyHash = '';
    const originalSendCommand = smtpClient.sendCommand.bind(smtpClient);
    
    smtpClient.sendCommand = async (command: string) => {
      if (command.toLowerCase().includes('dkim-signature:')) {
        const bhMatch = command.match(/bh=([^;]+)/);
        if (bhMatch) {
          capturedBodyHash = bhMatch[1].trim();
        }
      }
      return originalSendCommand(command);
    };

    await smtpClient.sendMail(email);
    
    if (capturedBodyHash) {
      console.log(`  Actual hash: ${capturedBodyHash.substring(0, 20)}...`);
    }
  }

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM multiple signatures', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  // Email with multiple DKIM signatures (e.g., author + ESP)
  const email = new Email({
    from: 'sender@author-domain.com',
    to: ['recipient@example.com'],
    subject: 'Multiple DKIM Signatures',
    text: 'This email has multiple DKIM signatures',
    dkim: [
      {
        domainName: 'author-domain.com',
        keySelector: 'default',
        privateKey: 'author-key'
      },
      {
        domainName: 'esp-domain.com',
        keySelector: 'esp2024',
        privateKey: 'esp-key'
      }
    ]
  });

  // Count DKIM signatures
  let dkimCount = 0;
  const signatures: string[] = [];
  const originalSendCommand = smtpClient.sendCommand.bind(smtpClient);
  
  smtpClient.sendCommand = async (command: string) => {
    if (command.toLowerCase().includes('dkim-signature:')) {
      dkimCount++;
      signatures.push(command);
    }
    return originalSendCommand(command);
  };

  const result = await smtpClient.sendMail(email);
  
  console.log(`\nDKIM signatures found: ${dkimCount}`);
  signatures.forEach((sig, i) => {
    const domainMatch = sig.match(/d=([^;]+)/);
    const selectorMatch = sig.match(/s=([^;]+)/);
    console.log(`Signature ${i + 1}:`);
    console.log(`  Domain: ${domainMatch ? domainMatch[1] : 'unknown'}`);
    console.log(`  Selector: ${selectorMatch ? selectorMatch[1] : 'unknown'}`);
  });

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM timestamp and expiration', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  // Test DKIM with timestamp and expiration
  const now = Math.floor(Date.now() / 1000);
  const oneHourLater = now + 3600;
  
  const email = new Email({
    from: 'sender@example.com',
    to: ['recipient@example.com'],
    subject: 'DKIM with Timestamp',
    text: 'This signature expires in one hour',
    dkim: {
      domainName: 'example.com',
      keySelector: 'default',
      privateKey: 'mock-key',
      signTime: now,
      expireTime: oneHourLater
    }
  });

  // Monitor for timestamp fields
  let hasTimestamp = false;
  let hasExpiration = false;
  const originalSendCommand = smtpClient.sendCommand.bind(smtpClient);
  
  smtpClient.sendCommand = async (command: string) => {
    if (command.toLowerCase().includes('dkim-signature:')) {
      if (command.includes('t=')) hasTimestamp = true;
      if (command.includes('x=')) hasExpiration = true;
      
      const tMatch = command.match(/t=(\d+)/);
      const xMatch = command.match(/x=(\d+)/);
      
      if (tMatch) console.log(`  Signature time: ${new Date(parseInt(tMatch[1]) * 1000).toISOString()}`);
      if (xMatch) console.log(`  Expiration time: ${new Date(parseInt(xMatch[1]) * 1000).toISOString()}`);
    }
    return originalSendCommand(command);
  };

  await smtpClient.sendMail(email);
  
  console.log(`\nDKIM timestamp included: ${hasTimestamp}`);
  console.log(`DKIM expiration included: ${hasExpiration}`);

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM failure scenarios', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 5000,
    debug: true
  });

  await smtpClient.connect();

  // Test various DKIM failure scenarios
  const failureTests = [
    {
      name: 'Missing private key',
      dkim: {
        domainName: 'example.com',
        keySelector: 'default',
        privateKey: undefined
      }
    },
    {
      name: 'Invalid domain',
      dkim: {
        domainName: '',
        keySelector: 'default',
        privateKey: 'key'
      }
    },
    {
      name: 'Missing selector',
      dkim: {
        domainName: 'example.com',
        keySelector: '',
        privateKey: 'key'
      }
    },
    {
      name: 'Invalid algorithm',
      dkim: {
        domainName: 'example.com',
        keySelector: 'default',
        privateKey: 'key',
        hashAlgo: 'md5' // Should not be allowed
      }
    }
  ];

  for (const test of failureTests) {
    console.log(`\nTesting DKIM failure: ${test.name}`);
    
    const email = new Email({
      from: 'sender@example.com',
      to: ['recipient@example.com'],
      subject: `DKIM Failure Test: ${test.name}`,
      text: 'Testing DKIM failure scenario',
      dkim: test.dkim as any
    });

    try {
      const result = await smtpClient.sendMail(email);
      console.log(`  Result: Email sent ${result ? 'successfully' : 'with issues'}`);
      console.log(`  Note: DKIM might be skipped or handled gracefully`);
    } catch (error) {
      console.log(`  Error (expected): ${error.message}`);
    }
  }

  await smtpClient.close();
});

tap.test('CSEC-03: DKIM performance impact', async () => {
  const smtpClient = createSmtpClient({
    host: testServer.hostname,
    port: testServer.port,
    secure: false,
    connectionTimeout: 10000,
    debug: false // Quiet for performance test
  });

  await smtpClient.connect();

  // Test performance with and without DKIM
  const iterations = 10;
  const bodySizes = [100, 1000, 10000]; // bytes
  
  for (const size of bodySizes) {
    const body = 'x'.repeat(size);
    
    // Without DKIM
    const withoutDkimTimes: number[] = [];
    for (let i = 0; i < iterations; i++) {
      const email = new Email({
        from: 'sender@example.com',
        to: ['recipient@example.com'],
        subject: 'Performance Test',
        text: body
      });
      
      const start = Date.now();
      await smtpClient.sendMail(email);
      withoutDkimTimes.push(Date.now() - start);
    }
    
    // With DKIM
    const withDkimTimes: number[] = [];
    for (let i = 0; i < iterations; i++) {
      const email = new Email({
        from: 'sender@example.com',
        to: ['recipient@example.com'],
        subject: 'Performance Test',
        text: body,
        dkim: {
          domainName: 'example.com',
          keySelector: 'default',
          privateKey: 'mock-key'
        }
      });
      
      const start = Date.now();
      await smtpClient.sendMail(email);
      withDkimTimes.push(Date.now() - start);
    }
    
    const avgWithout = withoutDkimTimes.reduce((a, b) => a + b) / iterations;
    const avgWith = withDkimTimes.reduce((a, b) => a + b) / iterations;
    const overhead = ((avgWith - avgWithout) / avgWithout) * 100;
    
    console.log(`\nBody size: ${size} bytes`);
    console.log(`  Without DKIM: ${avgWithout.toFixed(2)}ms avg`);
    console.log(`  With DKIM: ${avgWith.toFixed(2)}ms avg`);
    console.log(`  Overhead: ${overhead.toFixed(1)}%`);
  }

  await smtpClient.close();
});

tap.test('cleanup test SMTP server', async () => {
  if (testServer) {
    await testServer.stop();
  }
});

export default tap.start();