const fs = require("node:fs/promises");
const os = require("node:os");
const path = require("node:path");

const Fastify = require("fastify");

const { AppError } = require("../../../src/utils/AppError");
const { registerInvoicePoolReadRoutes } = require("../../../src/routes/invoicePool/read");
const { signPayload } = require("../../../src/utils/signedUrl");

const INVOICE_ID = "11111111-1111-4111-8111-111111111111";
const ACTOR_ID = "22222222-2222-4222-8222-222222222222";
const JWT_SECRET = "synthetic-test-secret";

async function buildApp() {
  const storageDir = await fs.mkdtemp(path.join(os.tmpdir(), "hyb-oa-invoice-file-"));
  await fs.writeFile(path.join(storageDir, "invoice.pdf"), "%PDF synthetic\n%%EOF\n");

  const prisma = {
    invoicePool: {
      findUnique: vi.fn().mockResolvedValue({
        storage_path: "invoice.pdf",
        mime_type: "application/pdf",
        original_name: "住宿电子普通发票.pdf",
      }),
    },
    auditLog: {
      create: vi.fn().mockResolvedValue({ id: "audit-1" }),
    },
  };

  const app = Fastify();
  app.decorate("prisma", prisma);
  app.decorate("config", { jwtSecret: JWT_SECRET, storageDir });
  app.decorate("authenticate", async () => {});
  app.decorate("hasPermission", () => false);
  app.decorate("requirePermission", () => async () => {});
  app.setErrorHandler((error, request, reply) => {
    if (error instanceof AppError) {
      return reply.status(error.statusCode).send({
        requestId: request.id,
        error: { code: error.code, message: error.message, details: error.details ?? {} },
      });
    }
    return reply.status(500).send({
      requestId: request.id,
      error: { code: "SYS_001", message: "服务器内部错误", details: {} },
    });
  });
  await app.register(registerInvoicePoolReadRoutes, { prefix: "/api" });
  return { app, prisma, storageDir };
}

describe("GET /api/invoice-pool/:id/file", () => {
  it("returns a Chinese PDF name through a safe inline Content-Disposition", async () => {
    const { app, prisma, storageDir } = await buildApp();
    const exp = Date.now() + 60_000;
    const token = signPayload({ invoiceId: INVOICE_ID, actorId: ACTOR_ID, exp }, JWT_SECRET);

    try {
      const response = await app.inject({
        method: "GET",
        url: `/api/invoice-pool/${INVOICE_ID}/file?token=${encodeURIComponent(token)}`,
      });

      expect(response.statusCode).toBe(200);
      expect(response.headers["content-type"]).toContain("application/pdf");
      expect(response.headers["content-disposition"]).toBe(
        "inline; filename=\"attachment.pdf\"; filename*=UTF-8''%E4%BD%8F%E5%AE%BF%E7%94%B5%E5%AD%90%E6%99%AE%E9%80%9A%E5%8F%91%E7%A5%A8.pdf",
      );
      expect(response.headers["content-disposition"]).not.toContain("住宿电子普通发票");
      expect(prisma.auditLog.create).toHaveBeenCalledWith(
        expect.objectContaining({ data: expect.objectContaining({ action: "INVOICE_FILE_DOWNLOADED" }) }),
      );
    } finally {
      await app.close();
      await fs.rm(storageDir, { recursive: true, force: true });
    }
  });
});