import { readFileSync, readdirSync } from 'node:fs';
import { dirname, join } from 'node:path';
import { fileURLToPath } from 'node:url';
import { describe, expect, test } from 'vitest';

// A deployed instance has no outbound network, so every asset the app draws
// itself with has to come from our own origin. This regressed once already
// (the font stylesheet was linked straight from Google), and the failure is
// invisible in development — the dev machine HAS internet, so the fonts load
// fine and only a real deployment renders in fallback faces.
//
// The assertion is on the PROPERTY, not on a vendor: any absolute URL in a
// resource-loading attribute fails, whoever is hosting it. Naming
// `fonts.googleapis.com` would pass the day someone reached for a different
// CDN, which is the same bug.

// fileURLToPath rather than import.meta.dirname: the latter needs Node 20.11+
// and this repo's toolchain is still on 18, where it is silently undefined.
const WEB = join(dirname(fileURLToPath(import.meta.url)), '../..');

/** Strip comments before asserting an ABSENCE — otherwise prose describing
 *  the forbidden thing satisfies the check that forbids it. */
const stripComments = (html: string) => html.replace(/<!--[\s\S]*?-->/g, '');

/** href/src on anything that makes the browser fetch a subresource. */
const RESOURCE_URL = /<(?:link|script|img|source|iframe)\b[^>]*?\b(?:href|src)\s*=\s*["']([^"']+)["']/gi;

const externalUrlsIn = (html: string) =>
  [...stripComments(html).matchAll(RESOURCE_URL)]
    .map((m) => m[1])
    .filter((u) => /^(?:https?:)?\/\//i.test(u));

describe('the app ships every asset it draws itself with', () => {
  test('app.html loads no subresource from a third-party origin', () => {
    const html = readFileSync(join(WEB, 'src/app.html'), 'utf8');
    expect(externalUrlsIn(html)).toEqual([]);
  });

  test('app.html does not preconnect or dns-prefetch to any host', () => {
    // preconnect carries no href-fetch of its own, so the check above misses
    // it — but it is the fingerprint of a third-party asset about to be added.
    const html = stripComments(readFileSync(join(WEB, 'src/app.html'), 'utf8'));
    const hints = [...html.matchAll(/<link\b[^>]*\brel\s*=\s*["']([^"']+)["'][^>]*>/gi)]
      .filter((m) => /\b(?:preconnect|dns-prefetch)\b/i.test(m[1]));
    expect(hints.map((m) => m[0])).toEqual([]);
  });

  test('the vendored font stylesheet exists and points only at local files', () => {
    const dir = join(WEB, 'static/fonts');
    const css = readFileSync(join(dir, 'fonts.css'), 'utf8');

    const urls = [...css.matchAll(/url\(\s*['"]?([^'")]+)['"]?\s*\)/gi)].map((m) => m[1]);
    expect(urls.length).toBeGreaterThan(0);
    expect(urls.filter((u) => /^(?:https?:)?\/\//i.test(u))).toEqual([]);

    // Every referenced file is actually present — a stylesheet pointing at a
    // woff2 nobody committed fails exactly like a CDN link would, offline.
    const present = new Set(readdirSync(dir));
    const missing = urls
      .map((u) => u.replace(/^\.\//, ''))
      .filter((f) => !present.has(f));
    expect(missing).toEqual([]);
  });

  test('every font family the tokens name is actually vendored', () => {
    // Pins the families to the TOKENS rather than to a hardcoded list, so
    // swapping a typeface in tokens.json fails here until it is vendored.
    const tokens = JSON.parse(
      readFileSync(join(WEB, 'src/lib/styles/tokens.json'), 'utf8')
    ) as { fonts: Record<string, string> };
    const files = readdirSync(join(WEB, 'static/fonts'));
    for (const family of Object.values(tokens.fonts)) {
      const prefix = `${family.replace(/\s+/g, '')}-`;
      expect(
        files.some((f) => f.startsWith(prefix) && f.endsWith('.woff2')),
        `no vendored woff2 for "${family}"`
      ).toBe(true);
    }
  });
});