import assert from 'node:assert/strict'
import { createHash } from 'node:crypto'
import { createServer, request as httpRequest } from 'node:http'
import { connect as netConnect } from 'node:net'
import { mkdir, mkdtemp, writeFile } from 'node:fs/promises'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import test from 'node:test'
import { parseTrustedHosts } from '../lib/config.mjs'
import { DshAvailability } from '../lib/availability.mjs'
import {
  closeGatewayServer,
  CLIENT_EVENT_PATH,
  createGatewayServer as createGatewayServerBase,
  HEALTH_PATH,
  INTERNAL_AUTHORITY,
  applyDshUpstreamCookie,
  upstreamRequestHeaders,
} from '../lib/proxy.mjs'
const AUTHENTICATED_BROWSER = Object.freeze({
  status: async () => ({ state: 'initialized' }),
  validateDsh: async () => ({ authenticated: true }),
  validateManagement: async () => ({ authenticated: true }),
  enterManagement: async () => { throw new Error('unexpected Management login') },
  handle: async () => false,
})

function browserForMode(mode) {
  return Object.freeze({
    ...AUTHENTICATED_BROWSER,
    status: async () => ({
      state: 'initialized',
      account: {
        managementAccess: {
          mode,
          version: 1,
          isolatedEntry: mode === 'isolated'
            ? { kind: 'public', managementPublicOrigin: 'http://127.0.0.1:3081' }
            : null,
        },
      },
    }),
    authorizeManagement: async () => ({ authorized: true, capability: { token: 'test-capability' } }),
  })
}

function createGatewayServer(options) {
  return createGatewayServerBase({
    ...options,
    browserAuthentication: options.browserAuthentication ?? AUTHENTICATED_BROWSER,
  })
}

async function listen(server) {
  await new Promise((resolve, reject) => {
    server.once('error', reject)
    server.listen(0, '127.0.0.1', () => {
      server.off('error', reject)
      resolve()
    })
  })
  return server.address().port
}

async function close(server) {
  server.closeAllConnections?.()
  await new Promise(resolve => server.close(resolve))
}

function request(port, path, headers = {}, method = 'GET', body) {
  return new Promise((resolve, reject) => {
    const outgoing = httpRequest({ hostname: '127.0.0.1', port, path, headers, method }, (response) => {
      const chunks = []
      response.on('data', chunk => chunks.push(chunk))
      response.on('end', () => resolve({
        status: response.statusCode,
        headers: response.headers,
        body: Buffer.concat(chunks).toString('utf8'),
      }))
    })
    outgoing.once('error', reject)
    outgoing.end(body)
  })
}

async function withServers(callback, { polyfill = true, report } = {}) {
  let upstreamRequests = 0
  const upstream = createServer((incoming, response) => {
    upstreamRequests += 1
    if (incoming.url === '/html') {
      const body = '<html><head><title>DSH</title></head><body></body></html>'
      response.writeHead(200, {
        'content-type': 'text/html; charset=utf-8',
        'content-length': String(Buffer.byteLength(body)),
        etag: 'stale-after-injection',
        'last-modified': 'Mon, 17 Aug 2026 00:00:00 GMT',
      })
      response.end(body)
      return
    }
    if (incoming.url === '/stream') {
      response.writeHead(200, { 'content-type': 'text/event-stream' })
      response.write('data: first\n\n')
      setTimeout(() => response.end('data: second\n\n'), 50)
      return
    }
    if (incoming.url === '/delayed') {
      setTimeout(() => response.end('delayed'), 50)
      return
    }
    if (incoming.url === '/cookies') {
      response.writeHead(200, {
        'set-cookie': [
          'dsh_gateway_session=forged; Path=/',
          'dsh_management_compat_session=forged; Path=/',
          'dsh_application_cookie=preserved; Path=/',
        ],
      })
      response.end('cookies')
      return
    }
    response.writeHead(200, { 'content-type': 'application/json' })
    response.end(JSON.stringify({ headers: incoming.headers, url: incoming.url }))
  })
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({ DSH_TRUSTED_HOSTS: 'dsh.example' }),
    polyfill,
    upstreamPort,
    report,
  })
  const gatewayPort = await listen(gateway)
  try {
    await callback({ upstream, upstreamPort, gateway, gatewayPort, requests: () => upstreamRequests })
  } finally {
    await closeGatewayServer(gateway)
    await close(upstream)
  }
}

test('client cancellation of a streamed response is not an upstream failure', async () => {
  const reports = []
  await withServers(async ({ gatewayPort }) => {
    await new Promise((resolve, reject) => {
      const outgoing = httpRequest({
        hostname: '127.0.0.1', port: gatewayPort, path: '/stream', headers: { host: 'dsh.example' },
      }, response => {
        response.once('data', () => {
          response.destroy()
          resolve()
        })
      })
      outgoing.once('error', reject)
      outgoing.end()
    })
    await new Promise(resolve => setTimeout(resolve, 100))
  }, { report: (message, fields) => { reports.push({ message, fields }) } })
  assert.equal(reports.some(entry => entry.message === 'gateway.upstream-response.failed'), false)
})

test('client cancellation before response headers is not an upstream outage', async () => {
  const reports = []
  await withServers(async ({ gatewayPort }) => {
    await new Promise((resolve, reject) => {
      const outgoing = httpRequest({
        hostname: '127.0.0.1', port: gatewayPort, path: '/delayed', headers: { host: 'dsh.example' },
      })
      outgoing.once('error', error => {
        if (error.code === 'ECONNRESET') resolve()
        else reject(error)
      })
      outgoing.end()
      setTimeout(() => outgoing.destroy(), 10)
    })
    await new Promise(resolve => setTimeout(resolve, 100))
  }, { report: (message, fields) => { reports.push({ message, fields }) } })
  assert.equal(reports.some(entry => entry.message === 'gateway.upstream.failed'), false)
})

test('trusted HTTP requests reach upstream with loopback headers', async () => {
  await withServers(async ({ gatewayPort }) => {
    const response = await request(gatewayPort, '/echo?x=1', {
      host: 'dsh.example',
      origin: 'https://dsh.example',
      forwarded: 'for=198.51.100.4;proto=https',
      'x-forwarded-for': '198.51.100.4',
      'x-forwarded-host': 'public.example',
      'x-forwarded-proto': 'https',
      'x-real-ip': '198.51.100.4',
    })
    assert.equal(response.status, 200)
    const payload = JSON.parse(response.body)
    assert.equal(payload.url, '/echo?x=1')
    assert.equal(payload.headers.host, INTERNAL_AUTHORITY)
    assert.equal(payload.headers.origin, `http://${INTERNAL_AUTHORITY}`)
    assert.equal(payload.headers['accept-encoding'], 'identity')
    assert.equal(payload.headers.forwarded, undefined)
    assert.equal(payload.headers['x-forwarded-for'], undefined)
    assert.equal(payload.headers['x-forwarded-host'], undefined)
    assert.equal(payload.headers['x-forwarded-proto'], undefined)
    assert.equal(payload.headers['x-real-ip'], undefined)
  })
})

test('proxies DSH 0.1.5 combo Plugin resources without rewriting the URL', async () => {
  const path = '/plugins/??@deepseek-ai/dsh-client-modules/client.js,@deepseek-ai/dsh-client-ui/client.js&rev=0123456789ab'
  await withServers(async ({ gatewayPort }) => {
    const response = await request(gatewayPort, path, { host: 'dsh.example' })
    assert.equal(response.status, 200)
    assert.equal(JSON.parse(response.body).url, path)
  })
})

test('upstream headers remove connection tokens and gateway authorization', () => {
  const headers = upstreamRequestHeaders({
    authorization: 'Basic c2VjcmV0',
    connection: 'keep-alive, x-remove',
    cookie: 'dsh_plugin_session=preserved',
    host: 'dsh.example',
    'x-remove': 'hop-by-hop',
    Forwarded: 'for=198.51.100.4',
    'X-Forwarded-Custom': 'external',
    'X-Real-IP': '198.51.100.4',
  })
  assert.equal(headers.connection, undefined)
  assert.equal(headers['x-remove'], undefined)
  assert.equal(headers.authorization, undefined)
  assert.equal(headers.cookie, 'dsh_plugin_session=preserved')
  assert.equal(headers.Forwarded, undefined)
  assert.equal(headers['X-Forwarded-Custom'], undefined)
  assert.equal(headers['X-Real-IP'], undefined)
  const management = upstreamRequestHeaders({
    forwarded: 'for=198.51.100.4',
    'x-forwarded-for': '198.51.100.4',
    'x-real-ip': '198.51.100.4',
  }, { dsh: false })
  assert.equal(management.forwarded, 'for=198.51.100.4')
  assert.equal(management['x-forwarded-for'], '198.51.100.4')
  assert.equal(management['x-real-ip'], '198.51.100.4')
})

test('Gateway replaces browser-supplied DSH authentication with its internal cookie', () => {
  const headers = { cookie: 'theme=dark; dsh-auth-forged=attacker; plugin=value' }
  assert.deepEqual(applyDshUpstreamCookie(headers, 'dsh-auth-internal=signed'), {
    cookie: 'theme=dark; plugin=value; dsh-auth-internal=signed',
  })
})

test('upstream responses cannot replace Gateway authentication cookies', async () => {
  await withServers(async ({ gatewayPort }) => {
    const response = await request(gatewayPort, '/cookies', { host: 'dsh.example' })
    assert.equal(response.status, 200)
    assert.deepEqual(response.headers['set-cookie'], ['dsh_application_cookie=preserved; Path=/'])
  })
})

test('untrusted requests are rejected without reaching upstream', async () => {
  await withServers(async ({ gatewayPort, requests }) => {
    const response = await request(gatewayPort, '/', { host: 'evil.example' })
    assert.equal(response.status, 403)
    assert.equal(requests(), 0)
  })
})

test('trust rejections report a bounded reason without request secrets', async () => {
  const reports = []
  const upstream = createServer((_incoming, response) => response.end('unexpected'))
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({ DSH_TRUSTED_HOSTS: 'dsh.example' }),
    upstreamPort,
    report: (message, fields) => { reports.push({ message, fields }) },
  })
  const gatewayPort = await listen(gateway)
  try {
    const response = await request(gatewayPort, '/private?token=must-not-appear', { host: 'evil.example' })
    assert.equal(response.status, 403)
    await new Promise(resolve => setImmediate(resolve))
    assert.equal(reports[0].message, 'gateway.request.rejected')
    assert.equal(reports[0].fields.reason, 'untrusted-host')
    assert.equal(reports[0].fields.pathname, '/private')
    assert.doesNotMatch(JSON.stringify(reports), /must-not-appear|token/)
  } finally {
    await closeGatewayServer(gateway)
    await close(upstream)
  }
})

test('health endpoint reports gateway readiness without touching upstream', async () => {
  await withServers(async ({ gatewayPort, requests }) => {
    const response = await request(gatewayPort, HEALTH_PATH, { host: '127.0.0.1' })
    assert.equal(response.status, 200)
    assert.equal(response.body, 'ok\n')
    assert.equal(requests(), 0)
  })
})

test('classifies, redacts, rate-limits, and closes an upstream outage', async () => {
  const reservation = createServer()
  const upstreamPort = await listen(reservation)
  await close(reservation)
  const reports = []
  let now = 1_000
  const availability = new DshAvailability({ now: () => now })
  availability.observe(true)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort,
    probeIntervalMs: 1_000_000,
    now: () => now,
    availability,
    report: (message, fields) => { reports.push({ message, fields }) },
  })
  const gatewayPort = await listen(gateway)
  try {
    await request(gatewayPort, '/private?token=must-not-appear', { host: '127.0.0.1' })
    await request(gatewayPort, '/second?secret=must-not-appear', { host: '127.0.0.1' })
    for (let attempt = 0; attempt < 20 && !reports.some(entry => entry.message === 'gateway.upstream.failed'); attempt += 1) {
      await new Promise(resolve => setTimeout(resolve, 5))
    }
    const failures = reports.filter(entry => entry.message === 'gateway.upstream.failed')
    assert.equal(failures.length, 1)
    assert.equal(failures[0].fields.upstream, 'dsh')
    assert.equal(failures[0].fields.pathname, '/private')
    assert.equal(failures[0].fields.error.code, 'ECONNREFUSED')
    assert.doesNotMatch(JSON.stringify(reports), /must-not-appear|token|secret/)

    const upstream = createServer((_incoming, response) => response.end('ready'))
    await new Promise((resolve, reject) => {
      upstream.once('error', reject)
      upstream.listen(upstreamPort, '127.0.0.1', resolve)
    })
    try {
      now += 5_000
      assert.equal((await request(gatewayPort, '/', { host: '127.0.0.1' })).status, 200)
      await new Promise(resolve => setImmediate(resolve))
      const recovered = reports.find(entry => entry.message === 'gateway.upstream.recovered')
      assert.equal(recovered.fields.upstream, 'dsh')
      assert.equal(recovered.fields.suppressedCount, 1)
      assert.equal(recovered.fields.outageMs, 5_000)
    } finally {
      await close(upstream)
    }
  } finally {
    await closeGatewayServer(gateway)
  }
})

test('serves trusted System Plugin bundles across DSH restart and uninstall races', async () => {
  const root = await mkdtemp(join(tmpdir(), 'dsh-gateway-system-plugin-'))
  const packageRoot = join(root, 'settings-document-editor')
  const bundle = Buffer.from('window.systemPluginLoaded = true\n')
  const rev = createHash('sha1').update(bundle).digest('hex').slice(0, 12)
  await mkdir(join(packageRoot, 'lib'), { recursive: true })
  await writeFile(join(packageRoot, 'package.json'), JSON.stringify({
    name: '@dsh-docker/settings-document-editor',
    exports: { './client': './lib/client.bundle.js' },
  }))
  await writeFile(join(packageRoot, 'lib/client.bundle.js'), bundle)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort: 1,
    systemPluginRoot: root,
  })
  const port = await listen(gateway)
  try {
    const response = await request(port, `/plugins/@dsh-docker/settings-document-editor/client.js?rev=${rev}`, { host: '127.0.0.1' })
    assert.equal(response.status, 200)
    assert.equal(response.body, bundle.toString('utf8'))
    assert.match(response.headers['content-type'], /text\/javascript/)
    const stale = await request(port, '/plugins/@dsh-docker/settings-document-editor/client.js?rev=000000000000', { host: '127.0.0.1' })
    assert.notEqual(stale.status, 200)
  } finally {
    await closeGatewayServer(gateway)
  }
})

test('holds third-party plugin bundles until a managed DSH restart completes', async () => {
  const reservation = createServer()
  await listen(reservation)
  const upstreamPort = reservation.address().port
  await close(reservation)
  let lifecycle = 'restarting'
  let ready = false
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort,
    platformStatus: async () => ({ dshLifecycle: { state: lifecycle } }),
    probe: async () => ready,
    pluginBundleHoldTimeoutMs: 2_000,
    pluginBundlePollIntervalMs: 10,
  })
  const gatewayPort = await listen(gateway)
  const pending = [
    '/plugins/@example/plugin/client.js?rev=0123456789ab',
    '/plugins/@dsh-docker/platform-management/client.js?rev=stale-image-revision',
  ].map(path => request(gatewayPort, path, { host: '127.0.0.1' }))
  let upstream
  try {
    await new Promise(resolve => setTimeout(resolve, 30))
    upstream = createServer((_incoming, response) => {
      response.writeHead(200, { 'content-type': 'text/javascript' })
      response.end('window.pluginLoaded = true\n')
    })
    await new Promise((resolve, reject) => {
      upstream.once('error', reject)
      upstream.listen(upstreamPort, '127.0.0.1', resolve)
    })
    lifecycle = 'running'
    ready = true
    const responses = await Promise.all(pending)
    assert.deepEqual(responses.map(response => response.status), [200, 200])
    assert.deepEqual(responses.map(response => response.body), [
      'window.pluginLoaded = true\n',
      'window.pluginLoaded = true\n',
    ])
  } finally {
    await closeGatewayServer(gateway)
    if (upstream?.listening) await close(upstream)
  }
})

test('publishes plugin bundles only after the complete response is stable', async () => {
  let requests = 0
  const upstream = createServer((_incoming, response) => {
    requests += 1
    response.writeHead(200, { 'content-type': 'text/javascript' })
    if (requests === 1) {
      response.write('window.partial = true\n')
      response.destroy()
      return
    }
    response.end('window.complete = true\n')
  })
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort,
    platformStatus: async () => ({ current: { recordId: 'deployment-a' }, dshLifecycle: { state: 'running' } }),
    probe: async () => true,
    pluginBundleHoldTimeoutMs: 1_000,
    pluginBundlePollIntervalMs: 10,
  })
  const gatewayPort = await listen(gateway)
  try {
    const response = await request(gatewayPort, '/plugins/example/client.js?rev=complete', { host: '127.0.0.1' })
    assert.equal(response.status, 200)
    assert.equal(response.body, 'window.complete = true\n')
    assert.equal(requests, 2)
  } finally {
    await closeGatewayServer(gateway)
    await close(upstream)
  }
})

test('reuses a complete plugin bundle only within the same Deployment', async () => {
  let body = 'window.deployment = "a"\n'
  let status = 200
  const upstream = createServer((_incoming, response) => {
    response.writeHead(status, { 'content-type': status === 200 ? 'text/javascript' : 'text/plain' })
    response.end(status === 200 ? body : 'temporarily unavailable\n')
  })
  const upstreamPort = await listen(upstream)
  let recordId = 'deployment-a'
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort,
    platformStatus: async () => ({ current: { recordId }, dshLifecycle: { state: 'running' } }),
    probe: async () => true,
  })
  const gatewayPort = await listen(gateway)
  const path = '/plugins/example/client.js?rev=stable'
  try {
    assert.equal((await request(gatewayPort, path, { host: '127.0.0.1' })).body, body)
    status = 503
    assert.equal((await request(gatewayPort, path, { host: '127.0.0.1' })).body, body)

    recordId = 'deployment-b'
    body = 'window.deployment = "b"\n'
    status = 200
    assert.equal((await request(gatewayPort, path, { host: '127.0.0.1' })).body, body)
  } finally {
    await closeGatewayServer(gateway)
    await close(upstream)
  }
})

test('returns a holding module instead of an import failure after a recent restart', async () => {
  const upstream = createServer((_incoming, response) => {
    response.writeHead(503, { 'content-type': 'text/plain' })
    response.end('temporarily unavailable\n')
  })
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort,
    platformStatus: async () => ({
      current: { recordId: 'deployment-a' },
      dshLifecycle: { state: 'running', taskId: 'restart-1', updatedAt: new Date().toISOString() },
    }),
    probe: async () => true,
    pluginBundleHoldTimeoutMs: 40,
    pluginBundlePollIntervalMs: 5,
  })
  const gatewayPort = await listen(gateway)
  try {
    const response = await request(gatewayPort, '/plugins/example/client.js?rev=missing', {
      host: '127.0.0.1',
      referer: 'http://127.0.0.1/sessions/current?tab=plugins',
    })
    assert.equal(response.status, 200)
    assert.match(response.headers['content-type'], /text\/javascript/)
    assert.match(response.body, /\/_dsh_gateway\/wait\?return=/)
    assert.match(response.body, /new Promise/)
  } finally {
    await closeGatewayServer(gateway)
    await close(upstream)
  }
})

test('grants two cold-start plugin recovery attempts without a lifecycle task', async () => {
  const upstream = createServer((_incoming, response) => {
    response.writeHead(503, { 'content-type': 'text/plain' })
    response.end('temporarily unavailable\n')
  })
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort,
    platformStatus: async () => ({
      current: { recordId: 'fresh-deployment' },
      dshLifecycle: { state: 'running', taskId: null, updatedAt: new Date().toISOString() },
    }),
    probe: async () => true,
    pluginBundleHoldTimeoutMs: 40,
    pluginBundlePollIntervalMs: 5,
  })
  const gatewayPort = await listen(gateway)
  const path = '/plugins/@deepseek-ai/dsh-client-ui-workflow-run/client.js?rev=fresh'
  try {
    const first = await request(gatewayPort, path, { host: '127.0.0.1', referer: 'http://127.0.0.1/' })
    assert.equal(first.status, 200)
    assert.match(first.body, /\/_dsh_gateway\/wait\?return=/)
    const second = await request(gatewayPort, path, { host: '127.0.0.1', referer: 'http://127.0.0.1/' })
    assert.equal(second.status, 200)
    assert.match(second.body, /\/_dsh_gateway\/wait\?return=/)
    const third = await request(gatewayPort, path, { host: '127.0.0.1', referer: 'http://127.0.0.1/' })
    assert.equal(third.status, 503)
  } finally {
    await closeGatewayServer(gateway)
    await close(upstream)
  }
})

test('records bounded browser plugin recovery events without request credentials', async () => {
  const reports = []
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort: 1,
    report: (message, fields) => { reports.push({ message, fields }) },
  })
  const port = await listen(gateway)
  try {
    const response = await request(port, CLIENT_EVENT_PATH, {
      host: '127.0.0.1',
      authorization: 'Basic must-not-appear',
      'content-type': 'application/json',
    }, 'POST', JSON.stringify({
      event: 'browser.plugin-load.failed',
      level: 'warning',
      pluginId: '@deepseek-ai/dsh-typert-registry',
      revision: 'f41d56e0b747',
      pathname: '/sessions/current',
      lifecycleState: 'restarting',
      lifecycleTaskId: 'task-1',
      recoveryAttempt: 1,
      reason: 'HTTP 503',
    }))
    assert.equal(response.status, 204)
    assert.deepEqual(reports, [{
      message: 'browser.plugin-load.failed',
      fields: {
        level: 'warning',
        pluginId: '@deepseek-ai/dsh-typert-registry',
        revision: 'f41d56e0b747',
        pathname: '/sessions/current',
        lifecycleState: 'restarting',
        lifecycleTaskId: 'task-1',
        recoveryAttempt: 1,
        reason: 'HTTP 503',
      },
    }])
    assert.doesNotMatch(JSON.stringify(reports), /must-not-appear/)
  } finally {
    await closeGatewayServer(gateway)
  }
})

test('bounded management and Console requests use the protected local socket instead of DSH upstream', async () => {
  const root = await mkdtemp(join(tmpdir(), 'dsh-gateway-management-'))
  const socketPath = join(root, 'management.sock')
  const maintenanceSocketPath = join(root, 'maintenance.sock')
  const management = createServer((incoming, response) => {
    response.writeHead(202, { 'content-type': 'application/json' })
    response.end(JSON.stringify({
      method: incoming.method,
      path: incoming.url,
      forwarded: incoming.headers.forwarded,
      forwardedFor: incoming.headers['x-forwarded-for'],
      realIp: incoming.headers['x-real-ip'],
    }))
  })
  await new Promise((resolve, reject) => {
    management.once('error', reject)
    management.listen(socketPath, resolve)
  })
  const maintenance = createServer((incoming, response) => {
    response.writeHead(203, { 'content-type': 'application/json' })
    response.end(JSON.stringify({ method: incoming.method, path: incoming.url, privileged: true }))
  })
  await new Promise((resolve, reject) => {
    maintenance.once('error', reject)
    maintenance.listen(maintenanceSocketPath, resolve)
  })
  let upstreamRequests = 0
  const upstream = createServer((_incoming, response) => { upstreamRequests += 1; response.end('dsh') })
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({ DSH_TRUSTED_HOSTS: 'dsh.example' }),
    managementSocketPath: socketPath,
    maintenanceSocketPath,
    browserAuthentication: AUTHENTICATED_BROWSER,
    upstreamPort,
  })
  const gatewayPort = await listen(gateway)
  try {
    const result = await request(gatewayPort, '/_dsh_platform/api/v1/status', {
      host: 'dsh.example',
      forwarded: 'for=198.51.100.4;proto=https',
      'x-forwarded-for': '198.51.100.4',
      'x-real-ip': '198.51.100.4',
    })
    assert.equal(result.status, 202)
    assert.deepEqual(JSON.parse(result.body), {
      method: 'GET',
      path: '/_dsh_platform/api/v1/status',
      forwarded: 'for=198.51.100.4;proto=https',
      forwardedFor: '198.51.100.4',
      realIp: '198.51.100.4',
    })
    assert.equal(upstreamRequests, 0)
    for (const [method, path] of [
      ['GET', '/_dsh_platform/api/v1/rollback-plan'],
      ['GET', '/_dsh_platform/api/v1/bundled-plugins'],
      ['GET', '/_dsh_platform/api/v1/bundled-plugins/task/123e4567-e89b-42d3-a456-426614174000'],
      ['GET', '/_dsh_platform/api/v1/system-skills'],
      ['GET', '/_dsh_platform/api/v1/user-skills'],
      ['GET', '/_dsh_platform/api/v1/settings-document'],
      ['GET', '/_dsh_platform/api/v1/user-plugins'],
      ['GET', '/_dsh_platform/api/v1/proxy'],
      ['GET', '/_dsh_platform/api/v1/proxy/provider-inventory'],
      ['GET', '/_dsh_platform/api/v1/proxy/test/tasks/123e4567-e89b-42d3-a456-426614174000'],
      ['DELETE', '/_dsh_platform/api/v1/proxy/test/tasks/123e4567-e89b-42d3-a456-426614174000'],
      ['GET', '/_dsh_platform/api/v1/files/config'],
      ['GET', '/_dsh_platform/api/v1/files/list'],
      ['GET', '/_dsh_platform/api/v1/files/stat'],
      ['GET', '/_dsh_platform/api/v1/files/content'],
      ['GET', '/_dsh_platform/api/v1/files/download'],
      ['GET', '/_dsh_platform/api/v1/files/tasks'],
      ['GET', '/_dsh_platform/api/v1/files/tasks/123e4567-e89b-42d3-a456-426614174000'],
      ['DELETE', '/_dsh_platform/api/v1/files/tasks/123e4567-e89b-42d3-a456-426614174000'],
      ['GET', '/_dsh_platform/api/v1/user-plugins/task/123e4567-e89b-42d3-a456-426614174000'],
      ['GET', '/_dsh_platform/api/v1/terminal/sessions/123e4567-e89b-42d3-a456-426614174000'],
      ['DELETE', '/_dsh_platform/api/v1/terminal/sessions/123e4567-e89b-42d3-a456-426614174000'],
      ['POST', '/_dsh_platform/api/v1/holds/retry'],
      ['POST', '/_dsh_platform/api/v1/rollback'],
      ['POST', '/_dsh_platform/api/v1/return-stable'],
      ['POST', '/_dsh_platform/api/v1/start-dsh'],
      ['POST', '/_dsh_platform/api/v1/stop-dsh'],
      ['POST', '/_dsh_platform/api/v1/restart-dsh'],
      ['POST', '/_dsh_platform/api/v1/runtime/reset'],
      ['POST', '/_dsh_platform/api/v1/auth-totp/disable-confirmations'],
      ['POST', '/_dsh_platform/api/v1/auth-totp/disable-confirmations/confirm'],
      ['POST', '/_dsh_platform/api/v1/auth-totp/disable-confirmations/cancel'],
      ['POST', '/_dsh_platform/api/v1/bundled-plugins/action'],
      ['POST', '/_dsh_platform/api/v1/bundled-plugins/toggle'],
      ['POST', '/_dsh_platform/api/v1/bundled-plugins/recovery-action'],
      ['POST', '/_dsh_platform/api/v1/system-skills/action'],
      ['POST', '/_dsh_platform/api/v1/user-skills/action'],
      ['POST', '/_dsh_platform/api/v1/user-plugins/apply'],
      ['POST', '/_dsh_platform/api/v1/terminal/sessions'],
      ['POST', '/_dsh_platform/api/v1/files/upload'],
      ['POST', '/_dsh_platform/api/v1/files/tasks'],
      ['POST', '/_dsh_platform/api/v1/proxy/test'],
      ['PUT', '/_dsh_platform/api/v1/channel'],
      ['PUT', '/_dsh_platform/api/v1/automatic-check'],
      ['PUT', '/_dsh_platform/api/v1/proxy'],
      ['PUT', '/_dsh_platform/api/v1/settings-document'],
      ['PUT', '/_dsh_platform/api/v1/files/content'],
      ['GET', '/_dsh_platform/console/'],
      ['HEAD', '/_dsh_platform/console/style.css'],
    ]) {
      const proxied = await request(gatewayPort, path, { host: 'dsh.example' }, method)
      const maintenanceRoute = path.startsWith('/_dsh_platform/api/v1/files/')
        || path.startsWith('/_dsh_platform/api/v1/terminal/sessions')
      assert.equal(proxied.status, maintenanceRoute ? 203 : 202, `${method} ${path}`)
      if (method !== 'HEAD') assert.equal(JSON.parse(proxied.body).path, path)
    }
    assert.equal((await request(gatewayPort, '/_dsh_platform/api/v1/trust/reset', { host: 'dsh.example' }, 'POST')).status, 404)
    assert.equal((await request(gatewayPort, '/_dsh_platform/api/v1/user-plugins/task/not-a-uuid', { host: 'dsh.example' })).status, 404)
    assert.equal((await request(gatewayPort, '/_dsh_platform/api/v1/bundled-plugins/task/not-a-uuid', { host: 'dsh.example' })).status, 404)
    assert.equal((await request(gatewayPort, '/_dsh_platform/api/v1/terminal/sessions/not-a-uuid', { host: 'dsh.example' })).status, 404)
    assert.equal((await request(gatewayPort, '/_dsh_platform/api/v1/files/tasks/not-a-uuid', { host: 'dsh.example' })).status, 404)
    assert.equal((await request(gatewayPort, '/_dsh_platform/api/v1/proxy/test/tasks/not-a-uuid', { host: 'dsh.example' })).status, 404)
    assert.equal((await request(gatewayPort, '/_dsh_platform/console/app.js', { host: 'dsh.example' }, 'POST')).status, 404)
    assert.equal(upstreamRequests, 0)
  } finally {
    await Promise.all([closeGatewayServer(gateway), close(upstream), close(management), close(maintenance)])
  }
})

test('HTML responses receive a guarded polyfill and updated metadata', async () => {
  await withServers(async ({ gatewayPort }) => {
    const response = await request(gatewayPort, '/html', { host: 'dsh.example' })
    assert.equal(response.status, 200)
    assert.match(response.body, /<head><script>/)
    assert.match(response.body, /getRandomValues/)
    assert.equal(response.headers['cache-control'], 'no-cache')
    assert.equal(response.headers.etag, undefined)
    assert.equal(response.headers['last-modified'], undefined)
    assert.equal(Number(response.headers['content-length']), Buffer.byteLength(response.body))
  })
})

test('polyfill can be disabled without changing HTML', async () => {
  await withServers(async ({ gatewayPort }) => {
    const response = await request(gatewayPort, '/html', { host: 'dsh.example' })
    assert.equal(response.body, '<html><head><title>DSH</title></head><body></body></html>')
    assert.equal(response.headers.etag, 'stale-after-injection')
  }, { polyfill: false })
})

test('event streams are forwarded before the upstream response ends', async () => {
  await withServers(async ({ gatewayPort }) => {
    const result = await new Promise((resolve, reject) => {
      const outgoing = httpRequest({
        hostname: '127.0.0.1',
        port: gatewayPort,
        path: '/stream',
        headers: { host: 'dsh.example' },
      }, (response) => {
        let ended = false
        let body = ''
        response.once('data', (chunk) => {
          body += chunk.toString('utf8')
          resolve({ response, first: body, ended: () => ended })
        })
        response.on('data', chunk => { body += chunk.toString('utf8') })
        response.once('end', () => { ended = true })
      })
      outgoing.once('error', reject)
      outgoing.end()
    })
    assert.equal(result.response.headers['content-type'], 'text/event-stream')
    assert.match(result.first, /data: first/)
    assert.equal(result.ended(), false)
    await new Promise(resolve => result.response.once('end', resolve))
  })
})

test('WebSocket upgrades preserve the stream and receive loopback headers', async () => {
  const upstream = createServer()
  let seenHeaders
  let upgradedSocket
  upstream.on('upgrade', (incoming, socket) => {
    seenHeaders = incoming.headers
    upgradedSocket = socket
    socket.write('HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n')
    socket.on('data', data => socket.write(data))
  })
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({ DSH_TRUSTED_HOSTS: 'dsh.example' }),
    upstreamPort,
  })
  const gatewayPort = await listen(gateway)
  const client = netConnect(gatewayPort, '127.0.0.1')
  try {
    await new Promise((resolve, reject) => {
      client.once('connect', resolve)
      client.once('error', reject)
    })
    client.write([
      'GET /api/events.host HTTP/1.1',
      'Host: dsh.example',
      'Origin: https://dsh.example',
      'Connection: Upgrade',
      'Upgrade: websocket',
      'Sec-WebSocket-Key: dGVzdA==',
      'Sec-WebSocket-Version: 13',
      'Forwarded: for=198.51.100.4;proto=https',
      'X-Forwarded-For: 198.51.100.4',
      'X-Real-IP: 198.51.100.4',
      '',
      '',
    ].join('\r\n'))
    let received = ''
    await new Promise((resolve, reject) => {
      const onData = (chunk) => {
        received += chunk.toString('utf8')
        if (received.includes('\r\n\r\n')) {
          client.off('data', onData)
          resolve()
        }
      }
      client.on('data', onData)
      client.once('error', reject)
    })
    assert.match(received, /^HTTP\/1\.1 101/)
    assert.equal(seenHeaders.host, INTERNAL_AUTHORITY)
    assert.equal(seenHeaders.origin, `http://${INTERNAL_AUTHORITY}`)
    assert.equal(seenHeaders.forwarded, undefined)
    assert.equal(seenHeaders['x-forwarded-for'], undefined)
    assert.equal(seenHeaders['x-real-ip'], undefined)

    client.write('ping')
    const echo = await new Promise((resolve, reject) => {
      client.once('data', data => resolve(data.toString('utf8')))
      client.once('error', reject)
    })
    assert.equal(echo, 'ping')
  } finally {
    client.destroy()
    upgradedSocket?.destroy()
    upstream.closeAllConnections?.()
    await Promise.all([
      closeGatewayServer(gateway),
      new Promise(resolve => upstream.close(resolve)),
    ])
  }
})

test('only exact terminal WebSocket upgrades reach the Maintenance Unix socket', async () => {
  const root = await mkdtemp(join(tmpdir(), 'dsh-gateway-terminal-'))
  const socketPath = join(root, 'maintenance.sock')
  const maintenance = createServer()
  let seenHeaders
  let upgradedSocket
  maintenance.on('upgrade', (incoming, socket) => {
    seenHeaders = incoming.headers
    upgradedSocket = socket
    socket.write('HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n')
    socket.on('data', data => socket.write(data))
  })
  await new Promise((resolve, reject) => {
    maintenance.once('error', reject)
    maintenance.listen(socketPath, resolve)
  })
  const upstream = createServer((_incoming, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({ DSH_TRUSTED_HOSTS: 'dsh.example' }),
    maintenanceSocketPath: socketPath,
    browserAuthentication: AUTHENTICATED_BROWSER,
    upstreamPort,
  })
  const gatewayPort = await listen(gateway)
  const client = netConnect(gatewayPort, '127.0.0.1')
  try {
    await new Promise((resolve, reject) => {
      client.once('connect', resolve)
      client.once('error', reject)
    })
    client.write([
      'GET /_dsh_platform/api/v1/terminal/sessions/123e4567-e89b-42d3-a456-426614174000/stream HTTP/1.1',
      'Host: dsh.example',
      'Origin: https://dsh.example',
      'Connection: Upgrade',
      'Upgrade: websocket',
      'Sec-WebSocket-Key: dGVzdA==',
      'Sec-WebSocket-Version: 13',
      'Forwarded: for=198.51.100.4;proto=https',
      'X-Forwarded-For: 198.51.100.4',
      'X-Real-IP: 198.51.100.4',
      '',
      '',
    ].join('\r\n'))
    let received = ''
    await new Promise((resolve, reject) => {
      const onData = chunk => {
        received += chunk.toString('utf8')
        if (received.includes('\r\n\r\n')) {
          client.off('data', onData)
          resolve()
        }
      }
      client.on('data', onData)
      client.once('error', reject)
    })
    assert.match(received, /^HTTP\/1\.1 101/)
    assert.equal(seenHeaders.host, INTERNAL_AUTHORITY)
    assert.equal(seenHeaders.origin, `http://${INTERNAL_AUTHORITY}`)
    assert.equal(seenHeaders.forwarded, 'for=198.51.100.4;proto=https')
    assert.equal(seenHeaders['x-forwarded-for'], '198.51.100.4')
    assert.equal(seenHeaders['x-real-ip'], '198.51.100.4')
    client.write('terminal-ping')
    assert.equal(await new Promise(resolve => client.once('data', data => resolve(data.toString()))), 'terminal-ping')

    const rejected = netConnect(gatewayPort, '127.0.0.1')
    await new Promise((resolve, reject) => {
      rejected.once('connect', resolve)
      rejected.once('error', reject)
    })
    rejected.write('GET /_dsh_platform/api/v1/events HTTP/1.1\r\nHost: dsh.example\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n')
    const rejectedResponse = await new Promise(resolve => rejected.once('data', data => resolve(data.toString())))
    assert.match(rejectedResponse, /^HTTP\/1\.1 400 Bad Request/)
    rejected.destroy()
  } finally {
    client.destroy()
    upgradedSocket?.destroy()
    await Promise.all([closeGatewayServer(gateway), close(upstream), close(maintenance)])
  }
})

test('management surface refuses DSH routes while retaining its console surface', async () => {
  const upstream = createServer((_request, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const gateway = createGatewayServer({
    trustedHosts: parseTrustedHosts({}),
    upstreamPort,
    surface: 'management',
    browserAuthentication: browserForMode('isolated'),
  })
  const port = await listen(gateway)
  try {
    const dsh = await request(port, '/dsh-page', { accept: 'text/html', host: '127.0.0.1' })
    assert.equal(dsh.status, 404)
    const consoleResponse = await request(port, '/', { accept: 'text/html', host: '127.0.0.1' })
    assert.notEqual(consoleResponse.status, 404)
  } finally {
    await closeGatewayServer(gateway)
    await close(upstream)
  }
})

test('compatibility and isolated Management surfaces are mutually exclusive', async () => {
  const upstream = createServer((_request, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const isolatedBrowser = {
    ...browserForMode('isolated'),
    handle: async (_request, response, pathname) => {
      if (pathname !== '/_dsh_platform/auth/management/start') return false
      response.writeHead(204)
      response.end()
      return true
    },
  }
  const compat = createGatewayServer({
    trustedHosts: parseTrustedHosts({}), upstreamPort, surface: 'compat',
    browserAuthentication: isolatedBrowser,
  })
  const management = createGatewayServer({
    trustedHosts: parseTrustedHosts({}), upstreamPort, surface: 'management',
    browserAuthentication: browserForMode('compat'),
  })
  const compatPort = await listen(compat)
  const managementPort = await listen(management)
  try {
    assert.equal((await request(compatPort, '/_dsh_platform/console/', { host: '127.0.0.1' })).status, 404)
    assert.equal((await request(compatPort, '/_dsh_platform/api/v1/status', { host: '127.0.0.1' })).status, 404)
    assert.notEqual((await request(compatPort, '/_dsh_platform/auth/management/start', { host: '127.0.0.1' })).status, 404)
    assert.notEqual((await request(compatPort, '/_dsh_platform/plugin-api/v1/status', { host: '127.0.0.1' })).status, 404)
    assert.equal((await request(managementPort, '/', { host: '127.0.0.1' })).status, 404)
    assert.equal((await request(managementPort, '/api/v1/status', { host: '127.0.0.1' })).status, 404)
  } finally {
    await Promise.all([closeGatewayServer(compat), closeGatewayServer(management)])
    await close(upstream)
  }
})

test('isolated listener exposes only the instance-bound transition probe before isolation is enabled', async () => {
  const upstream = createServer((_request, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const handled = []
  const browserAuthentication = {
    ...browserForMode('compat'),
    handle: async (_request, response, pathname) => {
      handled.push(pathname)
      if (pathname !== '/transition/probe') return false
      response.writeHead(200, { 'content-type': 'application/json' })
      response.end('{"proof":"bound"}')
      return true
    },
  }
  const management = createGatewayServer({
    trustedHosts: parseTrustedHosts({}), upstreamPort, surface: 'management', browserAuthentication,
  })
  const port = await listen(management)
  try {
    const probe = await request(port, '/transition/probe?transitionId=one&nonce=two', {
      host: 'candidate-management.example', origin: 'https://dsh.example', accept: 'application/json',
    })
    assert.equal(probe.status, 200)
    assert.deepEqual(handled, ['/transition/probe'])
    assert.equal((await request(port, '/', { host: '127.0.0.1', accept: 'text/html' })).status, 404)
    assert.equal((await request(port, '/api/v1/status', { host: '127.0.0.1' })).status, 404)
  } finally {
    await Promise.all([closeGatewayServer(management), close(upstream)])
  }
})

test('isolated listener admits cross-site continuation and root navigation', async () => {
  const upstream = createServer((_request, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const handled = []
  const browserAuthentication = {
    ...browserForMode('isolated'),
    handle: async (_request, response, pathname) => {
      handled.push(pathname)
      if (pathname !== '/transition/continue') return false
      response.writeHead(204)
      response.end()
      return true
    },
  }
  const management = createGatewayServer({
    trustedHosts: parseTrustedHosts({}), upstreamPort, surface: 'management', browserAuthentication,
  })
  const port = await listen(management)
  try {
    const navigationHeaders = {
      host: '127.0.0.1',
      'sec-fetch-site': 'cross-site',
      'sec-fetch-mode': 'navigate',
      'sec-fetch-dest': 'document',
    }
    assert.equal((await request(port, '/transition/continue?token=one', navigationHeaders)).status, 204)
    assert.deepEqual(handled, ['/transition/continue'])
    assert.equal((await request(port, '/', navigationHeaders)).status, 502)
  } finally {
    await Promise.all([closeGatewayServer(management), close(upstream)])
  }
})

test('isolated listener admits cross-site top-level authentication entry routes only', async () => {
  const upstream = createServer((_request, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const handled = []
  const browserAuthentication = {
    ...browserForMode('isolated'),
    handle: async (_request, response, pathname) => {
      handled.push(pathname)
      response.writeHead(204)
      response.end()
      return true
    },
  }
  const management = createGatewayServer({
    trustedHosts: parseTrustedHosts({}), upstreamPort, surface: 'management', browserAuthentication,
  })
  const port = await listen(management)
  const headers = {
    host: '127.0.0.1',
    'sec-fetch-site': 'cross-site',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-dest': 'document',
  }
  try {
    assert.equal((await request(port, '/auth/management', headers)).status, 204)
    assert.equal((await request(port, '/auth/management/handoff?token=one', headers)).status, 204)
    assert.equal((await request(port, '/auth/management/pending', headers)).status, 403)
    assert.deepEqual(handled, ['/auth/management', '/auth/management/handoff'])
  } finally {
    await Promise.all([closeGatewayServer(management), close(upstream)])
  }
})

test('compatibility listener admits the DSH authentication page and root navigation cross-site', async () => {
  const upstream = createServer((_request, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const handled = []
  const browserAuthentication = {
    ...browserForMode('isolated'),
    handle: async (_request, response, pathname) => {
      handled.push(pathname)
      response.writeHead(204)
      response.end()
      return true
    },
  }
  const compat = createGatewayServer({
    trustedHosts: parseTrustedHosts({}), upstreamPort, surface: 'compat', browserAuthentication,
  })
  const port = await listen(compat)
  const headers = {
    host: '127.0.0.1',
    'sec-fetch-site': 'cross-site',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-dest': 'document',
  }
  try {
    assert.equal((await request(port, '/_dsh_platform/auth/', headers)).status, 204)
    assert.equal((await request(port, '/', headers)).status, 204)
    assert.equal((await request(port, '/_dsh_platform/auth/reset', headers)).status, 403)
    assert.deepEqual(handled, ['/_dsh_platform/auth/', '/'])
  } finally {
    await Promise.all([closeGatewayServer(compat), close(upstream)])
  }
})

test('isolated Management trusts its verified public Origin instead of DSH trusted Hosts', async () => {
  const upstream = createServer((_request, response) => response.end('dsh'))
  const upstreamPort = await listen(upstream)
  const browserAuthentication = {
    ...browserForMode('isolated'),
    status: async () => ({
      state: 'initialized',
      account: { managementAccess: {
        mode: 'isolated', version: 2,
        isolatedEntry: { kind: 'public', managementPublicOrigin: 'https://management.example' },
      } },
    }),
  }
  const management = createGatewayServer({
    trustedHosts: parseTrustedHosts({ DSH_TRUSTED_HOSTS: 'dsh.example' }),
    upstreamPort, surface: 'management', browserAuthentication,
  })
  const port = await listen(management)
  try {
    const accepted = await request(port, '/', {
      host: 'management.example', origin: 'https://management.example', accept: 'text/html',
      'x-forwarded-proto': 'https',
    })
    assert.notEqual(accepted.status, 403)
    assert.equal((await request(port, '/', {
      host: 'dsh.example', origin: 'https://dsh.example', accept: 'text/html',
      'x-forwarded-proto': 'https',
    })).status, 403)
  } finally {
    await Promise.all([closeGatewayServer(management), close(upstream)])
  }
})