import { createHmac } from 'node:crypto';
import { readFileSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import type { Page } from '@playwright/test';

// The medewerker realm enforces MFA (S-15c), so a staff login is two steps: password, then a TOTP
// code. The realm export seeds every medewerker with this fixture secret — Keycloak HMACs the raw
// secret bytes — so the e2e can compute a valid code instead of enrolling an authenticator.
const OTP_SECRET = 'BIGMEDEWERKEROTPSEED';

export const OTP_PERIOD_MS = 30_000;

// RFC 6238 TOTP: HMAC-SHA1 over the 30-second counter, dynamically truncated to 6 digits.
export function totp(secret = OTP_SECRET, at = Date.now()): string {
  const counter = Buffer.alloc(8);
  counter.writeBigUInt64BE(BigInt(Math.floor(at / OTP_PERIOD_MS)));
  const mac = createHmac('sha1', secret).update(counter).digest();
  const offset = mac[mac.length - 1] & 0x0f;
  return String((mac.readUInt32BE(offset) & 0x7fffffff) % 1_000_000).padStart(6, '0');
}

// Keycloak refuses a TOTP code it has already accepted (its otpPolicyCodeReusable defaults to
// false), so two logins as the same medewerker inside one 30-second window would both submit the
// same code and the second is rejected. Spend the first counter this medewerker has left.
export function nextUnusedCounter(now: number, spent: number): number {
  return Math.max(Math.floor(now / OTP_PERIOD_MS), spent + 1);
}

// The spent counter lives on disk rather than in module state: Playwright starts a fresh worker
// process for a retry, which would otherwise forget it and resubmit the rejected code.
function spendCounter(username: string): number {
  const file = join(tmpdir(), `otp-counter-${username}`);
  let spent = -1;
  try {
    spent = Number(readFileSync(file, 'utf8')) || -1;
  } catch {
    // first login as this medewerker in this run
  }
  const counter = nextUnusedCounter(Date.now(), spent);
  writeFileSync(file, String(counter));
  return counter;
}

export async function loginMedewerker(page: Page, username: string): Promise<void> {
  await page.locator('#username').fill(username);
  await page.locator('#password').fill('test123');
  await page.locator('#kc-login').click();

  // Keycloak's conditional-OTP step. Wait out the rest of the window if the counter we may spend is
  // still in the future; its lookAheadWindow would accept the code a moment early, but only by one
  // counter — waiting keeps a third login in the same window valid too.
  const counter = spendCounter(username);
  await page.waitForTimeout(Math.max(0, counter * OTP_PERIOD_MS - Date.now()));
  await page.locator('#otp').fill(totp(OTP_SECRET, counter * OTP_PERIOD_MS));
  await page.locator('#kc-login').click();
}