const { test, expect } = require('@playwright/test');
require('dotenv').config();
const { BASE_URL, absoluteUrl } = require('../fixtures/url');
const { login } = require('../fixtures/auth');
const { expectNoBackendError, readBody, blockedOrNotFound } = require('../fixtures/v204-helpers');
const { expectBlockedOrSafe } = require('../fixtures/assertions');

async function safeGoto(page, route) {
  const resp = await page.goto(route).catch(() => null);
  await page.waitForLoadState('domcontentloaded').catch(() => {});
  return resp;
}

async function expectRouteAvailable(page, resp) {
  await expectNoBackendError(page);
  if (resp) {
    expect(resp.status(), `Expected route to exist but got ${resp.status()} at ${page.url()}`).not.toBe(404);
    expect(resp.status()).toBeLessThan(500);
  }
}

async function expectNoSecrets(page) {
  const body = await readBody(page);
  expect(body).not.toMatch(/Password@123|Pass@123|smtp_password|IMAP_PASSWORD|SMTP_PASSWORD|otp\s*[:=]\s*\d{4,8}|reset_token|access_token|refresh_token/i);
}

async function expectPublicNoSensitive(page) {
  await expectNoBackendError(page);
  const body = await readBody(page);
  expect(body).not.toMatch(/tenant_id|branch_id|internal note|audit log|smtp|password|secret|token/i);
}

async function apiCall(request, method, route) {
  const url = absoluteUrl(route);
  const opts = { data: { csrf_token: '', test_payload: 'uat-vapt' }, headers: { 'Content-Type': 'application/json' } };
  if (method === 'GET') return await request.get(url).catch(() => null);
  if (method === 'POST') return await request.post(url, opts).catch(() => null);
  if (method === 'PUT') return await request.put(url, opts).catch(() => null);
  if (method === 'DELETE') return await request.delete(url).catch(() => null);
  if (method === 'OPTIONS') return await request.fetch(url, { method: 'OPTIONS' }).catch(() => null);
  return await request.fetch(url, { method }).catch(() => null);
}

async function expectApiSafe(resp) {
  expect(resp, 'API response should be available').toBeTruthy();
  expect(resp.status()).toBeLessThan(500);
  const text = await resp.text().catch(() => '');
  expect(text).not.toMatch(/Traceback|Exception in ASGI application|OperationalError|ProgrammingError|AttributeError|UndefinedError|Password@123|Pass@123/i);
}


const cases = [
  {
    "variantId": "V251-PBILL-001",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Plans page loads",
    "type": "UAT",
    "route": "/platform-billing/plans",
    "_kind": "page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-002",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Accounts page loads",
    "type": "UAT",
    "route": "/platform-billing/accounts",
    "_kind": "page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-003",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Audit firm subscriptions page loads",
    "type": "UAT",
    "route": "/platform-billing/audit-firm-subscriptions",
    "_kind": "page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-004",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Client dashboard subscriptions page loads",
    "type": "UAT",
    "route": "/platform-billing/client-dashboard-subscriptions",
    "_kind": "page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-005",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Consultant subscriptions page loads",
    "type": "UAT",
    "route": "/platform-billing/consultant-subscriptions",
    "_kind": "page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-006",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Subscriptions page loads",
    "type": "UAT",
    "route": "/platform-billing/subscriptions",
    "_kind": "page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-007",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Invoices page loads",
    "type": "UAT",
    "route": "/platform-billing/invoices",
    "_kind": "page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-008",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Invalid invoice detail/post safe",
    "type": "UAT",
    "route": "/platform-billing/invoices/999999/post",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-009",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Invalid invoice payments safe",
    "type": "UAT",
    "route": "/platform-billing/invoices/999999/payments",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-010",
    "module": "Platform Billing",
    "role": "System Admin",
    "scenario": "Invalid plan detail safe",
    "type": "UAT",
    "route": "/platform-billing/plans/999999",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "System Admin"
  },
  {
    "variantId": "V251-PBILL-011",
    "module": "Platform Billing",
    "role": "Firm",
    "scenario": "Firm Admin cannot manage platform plans",
    "type": "VAPT",
    "route": "/platform-billing/plans",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "Firm Admin"
  },
  {
    "variantId": "V251-PBILL-012",
    "module": "Platform Billing",
    "role": "Staff",
    "scenario": "Staff cannot access platform accounts",
    "type": "VAPT",
    "route": "/platform-billing/accounts",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "Staff"
  },
  {
    "variantId": "V251-PBILL-013",
    "module": "Platform Billing",
    "role": "Client",
    "scenario": "Client cannot access platform invoices list",
    "type": "VAPT",
    "route": "/platform-billing/invoices",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "Client"
  },
  {
    "variantId": "V251-PBILL-014",
    "module": "Platform Billing",
    "role": "Consultant",
    "scenario": "Consultant cannot access platform invoice list",
    "type": "VAPT",
    "route": "/platform-billing/invoices",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "Consultant"
  },
  {
    "variantId": "V251-PBILL-015",
    "module": "Platform Billing",
    "role": "Partner",
    "scenario": "Partner cannot post platform invoice",
    "type": "VAPT",
    "route": "/platform-billing/invoices/999999/post",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": "Partner"
  },
  {
    "variantId": "V251-PBILL-016",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Plan create CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/plans",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-017",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Plan update invalid ID CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/plans/999999",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-018",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Account create CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/accounts",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-019",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Audit firm subscription create CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/audit-firm-subscriptions",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-020",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Client dashboard subscription create CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/client-dashboard-subscriptions",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-021",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Consultant subscription create CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/consultant-subscriptions",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-022",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Platform subscription create CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/subscriptions",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-023",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Invoice create CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/invoices",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-024",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Invoice post CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/invoices/999999/post",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-025",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Invoice payment CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/invoices/999999/payments",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-026",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Invoice cancel CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/invoices/999999/cancel",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-027",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Payment over-amount invalid POST safe",
    "type": "VAPT",
    "route": "/platform-billing/invoices/999999/payments",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-028",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Duplicate plan code invalid POST safe",
    "type": "VAPT",
    "route": "/platform-billing/plans",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-029",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Duplicate invoice number invalid POST safe",
    "type": "VAPT",
    "route": "/platform-billing/invoices",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-030",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Invoice export requires auth",
    "type": "VAPT",
    "route": "/platform-billing/invoices/export",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-031",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Invoice PDF invalid ID safe",
    "type": "VAPT",
    "route": "/platform-billing/invoices/999999/pdf",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-032",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Cross-account invoice IDOR blocked",
    "type": "VAPT",
    "route": "/platform-billing/invoices/999999?account_id=999999",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-033",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Payment receipt invalid ID safe",
    "type": "VAPT",
    "route": "/platform-billing/payments/999999/receipt",
    "_kind": "safe-page",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-034",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Billing account delete CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/accounts/999999/delete",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  },
  {
    "variantId": "V251-PBILL-035",
    "module": "Platform Billing",
    "role": "Anonymous/Attacker",
    "scenario": "Plan delete CSRF-less POST rejected",
    "type": "VAPT",
    "route": "/platform-billing/plans/999999/delete",
    "_kind": "post",
    "_method": "GET",
    "_file": "platform-billing.spec.js",
    "_login_role": null
  }
];

test.describe("v2.5.1 Additions - Platform Billing", () => {

  for (const c of cases) {
    test(`[${c.variantId}] ${c.scenario}`, async ({ page, request }) => {
      const role = c._login_role || c.role;
      const kind = c._kind;
      const method = c._method || 'GET';

      if (kind === 'api') {
        const resp = await apiCall(request, method, c.route);
        await expectApiSafe(resp);
        return;
      }

      if (kind === 'post') {
        // Some generated VAPT rows accidentally carry _method: 'GET' even when
        // the scenario is explicitly CSRF-less POST. Force POST unless the row
        // intentionally specifies another unsafe verb.
        const unsafeMethod = (!method || method === 'GET') ? 'POST' : method;
        const resp = await apiCall(request, unsafeMethod, c.route);
        await expectApiSafe(resp);
        const safe = [400, 401, 403, 404, 405, 409, 422, 429].includes(resp.status());
        expect(safe, `Unsafe ${unsafeMethod} status ${resp.status()} for ${c.route}`).toBeTruthy();
        return;
      }

      if (role && role !== 'Public' && !/Anonymous|Attacker|API/.test(role)) {
        await login(page, role);
      }

      const resp = await safeGoto(page, c.route);

      if (kind === 'page') {
        await expectRouteAvailable(page, resp);
        if (/password|secret|token|otp/i.test(c.scenario)) await expectNoSecrets(page);
        return;
      }

      if (kind === 'public') {
        await expectRouteAvailable(page, resp);
        return;
      }

      if (kind === 'public-no-sensitive') {
        await expectPublicNoSensitive(page);
        return;
      }

      if (kind === 'no-secret') {
        await expectRouteAvailable(page, resp);
        await expectNoSecrets(page);
        return;
      }

      await expectNoBackendError(page);
      await expectBlockedOrSafe(page, resp);
    });
  }
});