try {
  process.loadEnvFile(".env.local");
} catch {}

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

const BASE_URL = process.env.TEST_BASE_URL || "https://localhost:3000";

async function testHttpEndpoints() {
  console.log("==================================================");
  console.log("TESTING ADMIN HTTP SECURITY ENDPOINTS");
  console.log("Target Base URL:", BASE_URL);
  console.log("==================================================");

  const email = process.env.MAIN_ADMIN_EMAIL || "admin@qutoai.com";
  const password = process.env.MAIN_ADMIN_PASSWORD || "Admin@12345678";

  // 1. TEST LOGIN UNDER VPN (Should be blocked with 403 and code NETWORK_BLOCKED)
  console.log("\n[TEST 1] POST /api/admin/auth/login with VPN simulation (x-simulate-vpn: true)...");
  const vpnLoginRes = await fetch(`${BASE_URL}/api/admin/auth/login`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-simulate-vpn": "true",
    },
    body: JSON.stringify({ email, password }),
  });

  const vpnLoginData = await vpnLoginRes.json();
  console.log("VPN Login Response Status:", vpnLoginRes.status);
  console.log("VPN Login Response Body:", vpnLoginData);

  if (vpnLoginRes.status !== 403 || vpnLoginData.code !== "NETWORK_BLOCKED") {
    throw new Error(`FAIL: Expected 403 NETWORK_BLOCKED, got status ${vpnLoginRes.status}`);
  }
  console.log("✓ TEST 1 PASSED: Login blocked under VPN with HTTP 403 and NETWORK_BLOCKED code.\n");

  // 2. TEST NORMAL LOGIN (VPN OFF)
  console.log("[TEST 2] POST /api/admin/auth/login with normal network...");
  const normalLoginRes = await fetch(`${BASE_URL}/api/admin/auth/login`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ email, password }),
  });

  const normalLoginData = await normalLoginRes.json();
  console.log("Normal Login Response Status:", normalLoginRes.status);
  console.log("Normal Login Response Body:", normalLoginData);

  if (!normalLoginRes.ok || !normalLoginData.ok) {
    throw new Error(`FAIL: Normal login failed with status ${normalLoginRes.status}`);
  }

  // Extract session cookie
  const setCookieHeader = normalLoginRes.headers.get("set-cookie");
  if (!setCookieHeader || !setCookieHeader.includes("quto_admin_session")) {
    throw new Error("FAIL: Expected quto_admin_session cookie on successful login");
  }
  const sessionCookieMatch = setCookieHeader.match(/(?:^|;|,)\s*quto_admin_session=([^;]+)/);
  const sessionCookie = sessionCookieMatch ? sessionCookieMatch[1] : "";
  const cookieHeader = `quto_admin_session=${sessionCookie}`;
  console.log("✓ TEST 2 PASSED: Normal login succeeded, session cookie issued.\n");

  // 3. TEST NETWORK-CHECK WITH NORMAL NETWORK
  console.log("[TEST 3] GET /api/admin/security/network-check with normal network...");
  const netCheckRes = await fetch(`${BASE_URL}/api/admin/security/network-check`, {
    headers: {
      Cookie: cookieHeader,
    },
  });
  const netCheckData = await netCheckRes.json();
  console.log("Network Check Status:", netCheckRes.status);
  console.log("Network Check Data:", netCheckData);
  if (!netCheckRes.ok || netCheckData.blocked !== false) {
    throw new Error("FAIL: Network check failed for normal connection");
  }
  console.log("✓ TEST 3 PASSED: Network check verified direct connection.\n");

  // 4. TEST NETWORK-CHECK TRIGGERING VPN (ALREADY LOGGED-IN ADMIN)
  console.log("[TEST 4] GET /api/admin/security/network-check with VPN simulation...");
  const vpnCheckRes = await fetch(`${BASE_URL}/api/admin/security/network-check`, {
    headers: {
      Cookie: cookieHeader,
      "x-simulate-vpn": "true",
    },
  });
  const vpnCheckData = await vpnCheckRes.json();
  console.log("VPN Network Check Status:", vpnCheckRes.status);
  console.log("VPN Network Check Data:", vpnCheckData);
  if (vpnCheckRes.status !== 403 || vpnCheckData.code !== "NETWORK_BLOCKED") {
    throw new Error("FAIL: Network check did not block VPN connection");
  }
  console.log("✓ TEST 4 PASSED: Existing session revoked immediately upon VPN detection.\n");

  // 5. TEST VERIFY PREVIOUS SESSION IS NOW REVOKED
  console.log("[TEST 5] GET /api/admin/auth/me with revoked session token...");
  const meRes = await fetch(`${BASE_URL}/api/admin/auth/me`, {
    headers: {
      Cookie: cookieHeader,
    },
  });
  console.log("/api/admin/auth/me Status with revoked session:", meRes.status);
  if (meRes.status !== 401) {
    throw new Error(`FAIL: Expected 401 for revoked session, got ${meRes.status}`);
  }
  // 6. TEST LOCATION SAVING & AUDIT LOG RETRIEVAL
  console.log("[TEST 6] Testing Location Saving & Audit Log Retrieval...");
  // Re-login to get fresh session
  const freshLogin = await fetch(`${BASE_URL}/api/admin/auth/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ email, password }),
  });
  const freshSetCookie = freshLogin.headers.get("set-cookie") || "";
  const freshSessionMatch = freshSetCookie.match(/(?:^|;|,)\s*quto_admin_session=([^;]+)/);
  const freshSessionCookie = freshSessionMatch ? freshSessionMatch[1] : "";
  const freshCookieHeader = `quto_admin_session=${freshSessionCookie}`;

  // Save location
  const locPayload = {
    status: "available",
    latitude: 26.88403,
    longitude: 75.74335,
    address: "Mansarovar, Jaipur, Rajasthan, India",
    locality: "Mansarovar",
    city: "Jaipur",
    region: "Rajasthan",
    country: "India",
    source: "browser-geolocation-reverse-geocode",
  };
  const locRes = await fetch(`${BASE_URL}/api/admin/security/location`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie: freshCookieHeader,
    },
    body: JSON.stringify(locPayload),
  });
  const locData = await locRes.json();
  console.log("Save Location Response:", locData);
  if (!locRes.ok || !locData.success || locData.location.city !== "Jaipur") {
    throw new Error("FAIL: Saving location failed");
  }

  // Fetch security audit logs
  const auditRes = await fetch(`${BASE_URL}/api/admin/security/audit?limit=5`, {
    headers: { Cookie: freshCookieHeader },
  });
  const auditData = await auditRes.json();
  console.log("Audit Logs Count:", auditData.logs?.length);
  const blockedLog = auditData.logs?.find((l: any) => l.action === "NETWORK_SECURITY_BLOCKED");
  console.log("Found NETWORK_SECURITY_BLOCKED Log:", {
    action: blockedLog?.action,
    networkSecurity: blockedLog?.networkSecurity ? {
      isVpn: blockedLog.networkSecurity.isVpn,
      provider: blockedLog.networkSecurity.provider,
    } : null,
    location: blockedLog?.location ? {
      status: blockedLog.location.status,
      address: blockedLog.location.address,
      city: blockedLog.location.city,
    } : null,
  });
  if (!blockedLog) {
    throw new Error("FAIL: NETWORK_SECURITY_BLOCKED audit log was not found in audit trail");
  }
  console.log("✓ TEST 6 PASSED: Location saved on session and audit log verified.\n");

  console.log("==================================================");
  console.log("ALL HTTP SECURITY ENDPOINT TESTS PASSED!");
  console.log("==================================================");
}

testHttpEndpoints()
  .then(() => process.exit(0))
  .catch((err) => {
    console.error("HTTP TEST ERROR:", err);
    process.exit(1);
  });