import assert from 'node:assert/strict'
import { createServer, request as httpRequest } from 'node:http'
import test from 'node:test'
import {
  createBrowserAuthentication,
  AUTH_CSRF_COOKIE,
  AUTH_RETRY_COOKIE,
  DSH_SESSION_COOKIE,
  MANAGEMENT_CSRF_COOKIE,
  MANAGEMENT_SESSION_COOKIE,
  TOTP_LOGIN_COOKIE,
} from '../lib/browser-auth.mjs'
import { safeReturnPath } from '../lib/proxy.mjs'

async function listen(server) {
  await new Promise((resolve, reject) => {
    server.once('error', reject)
    server.listen(0, '127.0.0.1', resolve)
  })
  return server.address().port
}

async function close(server) {
  server.closeAllConnections?.()
  await new Promise(resolve => server.close(resolve))
}

function request(port, { path = '/', method = 'GET', headers = {}, body } = {}) {
  return new Promise((resolve, reject) => {
    const outgoing = httpRequest({ hostname: '127.0.0.1', port, path, method, headers }, response => {
      const chunks = []
      response.on('data', chunk => chunks.push(chunk))
      response.on('end', () => resolve({
        status: response.statusCode,
        headers: response.headers,
        body: Buffer.concat(chunks).toString('utf8'),
      }))
    })
    outgoing.once('error', reject)
    outgoing.end(body)
  })
}

function assertInlineScriptsCompile(html) {
  const scripts = [...html.matchAll(/<script>([\s\S]*?)<\/script>/g)].map(match => match[1])
  assert.ok(scripts.length > 0, 'expected at least one inline script')
  for (const script of scripts) assert.doesNotThrow(() => new Function(script))
}

function fixture(initialState = 'never-initialized', options = {}) {
  let state = initialState
  const sessions = new Map()
  const managementSessions = new Map()
  const managementSources = new Map()
  const handoffs = new Map()
  const pending = new Map()
  const transitionNonces = new Map([['transition-valid', 'nonce-valid']])
  const continuations = new Map([['continuation-valid', null]])
  const calls = []
  const access = {
    request: async (method, path, body) => {
      calls.push({ method, path, body })
      if (path === '/v1/status') return {
        state,
        authenticationContext: 'dsh-authentication-context',
        account: state === 'initialized'
          ? {
              managementAdditionalCredential: { enabled: options.managementAdditionalEnabled ?? true },
              totp: { enabled: options.totpEnabled === true },
              managementAccess: options.managementAccess
                ?? { mode: 'compat', isolatedEntry: null, dshPublicOrigin: null },
            }
          : null,
      }
      if (path === '/v1/authentication-retry/status') {
        return options.totpRetry ?? { kind: null, retryAfterSeconds: 0 }
      }
      if (path === '/v1/dsh/initialize') {
        state = 'initialized'
        sessions.set('dshs_created', body.origin)
        return { session: { token: 'dshs_created', csrfToken: 'dshc_created' } }
      }
      if (path === '/v1/dsh/reset-authentication') {
        if (body.setupKey !== 'dshak_valid') throw Object.assign(new Error('authentication reset key is invalid or expired'), {
          code: 'AUTHENTICATION_RESET_KEY_INVALID', statusCode: 401,
        })
        state = 'initialized'
        sessions.set('dshs_reset', body.origin)
        return { session: { token: 'dshs_reset', csrfToken: 'dshc_reset' } }
      }
      if (path === '/v1/dsh/login') {
        if (body.password !== 'correct password') throw Object.assign(new Error('username or password is incorrect'), {
          code: 'AUTHENTICATION_FAILED', statusCode: 401,
        })
        if (options.totpEnabled === true) {
          return { totpRequired: true, challenge: { token: 'dshtl_login', expiresAt: new Date(Date.now() + 300_000).toISOString() } }
        }
        sessions.set('dshs_logged_in', body.origin)
        return { session: { token: 'dshs_logged_in', csrfToken: 'dshc_logged_in' } }
      }
      if (path === '/v1/dsh/totp/complete') {
        if (body.challengeToken !== 'dshtl_login') throw Object.assign(new Error('login challenge invalid'), {
          code: 'TOTP_LOGIN_INVALID', statusCode: 401,
        })
        if (body.code !== '123456') throw Object.assign(new Error('authentication code is incorrect'), {
          code: 'TOTP_INVALID', statusCode: 401,
        })
        sessions.set('dshs_totp', body.origin)
        return { session: { token: 'dshs_totp', csrfToken: 'dshc_totp' } }
      }
      if (path === '/v1/sessions/validate') return {
        authenticated: body.kind === 'dsh'
          ? sessions.get(body.token) === body.origin
          : managementSessions.get(body.token) === body.origin
            && sessions.has(managementSources.get(body.token)),
      }
      if (path === '/v1/sessions/logout') {
        if (sessions.delete(body.token)) {
          for (const [token, source] of managementSources) {
            if (source !== body.token) continue
            managementSources.delete(token)
            managementSessions.delete(token)
          }
        }
        managementSessions.delete(body.token)
        managementSources.delete(body.token)
        return { authenticated: false }
      }
      if (path === '/v1/dsh/browser-logout') {
        let managementRevoked = 0
        for (const [token, source] of managementSources) {
          if (source !== body.dshToken) continue
          managementSources.delete(token)
          managementSessions.delete(token)
          managementRevoked += 1
        }
        if (typeof body.managementToken === 'string' && managementSessions.delete(body.managementToken)) {
          managementSources.delete(body.managementToken)
          managementRevoked += 1
        }
        const dshRevoked = body.scope === 'all' && sessions.delete(body.dshToken)
        return { authenticated: body.scope !== 'all', dshRevoked, managementRevoked }
      }
      if (path === '/v1/dsh/capabilities') {
        if (sessions.get(body.dshToken) !== body.origin) {
          throw Object.assign(new Error('session invalid'), { statusCode: 401 })
        }
        return { capability: { token: 'dshcap_plugin', expiresAt: new Date(Date.now() + 5_000).toISOString() } }
      }
      if (path === '/v1/management/handoffs') {
        if (sessions.get(body.dshToken) !== body.dshOrigin) throw Object.assign(new Error('session invalid'), { statusCode: 401 })
        handoffs.set('dshh_created', { targetOrigin: body.targetOrigin, dshToken: body.dshToken })
        return { handoff: { token: 'dshh_created' } }
      }
      if (path === '/v1/management/handoffs/consume') {
        const handoff = handoffs.get(body.token)
        if (handoff?.targetOrigin !== body.origin) throw Object.assign(new Error('handoff invalid'), { statusCode: 401 })
        handoffs.delete(body.token)
        if (options.managementPending === true) {
          pending.set('dshmp_exchanged', handoff.dshToken)
          return { pending: { token: 'dshmp_exchanged' } }
        }
        managementSessions.set('dshms_exchanged', body.origin)
        managementSources.set('dshms_exchanged', handoff.dshToken)
        return { session: { token: 'dshms_exchanged', csrfToken: 'dshc_management' } }
      }
      if (path === '/v1/management/pending/complete') {
        if (body.authenticationContext !== 'dsh-authentication-context') {
          throw Object.assign(new Error('authentication context is stale'), {
            code: 'AUTHENTICATION_CONTEXT_STALE', statusCode: 409,
          })
        }
        const source = pending.get(body.pendingToken)
        if (source === undefined) throw Object.assign(new Error('management login is invalid or expired'), {
          code: 'PENDING_LOGIN_INVALID', statusCode: 401,
        })
        if (body.password !== 'correct management password') throw Object.assign(new Error('username or password is incorrect'), {
          code: 'AUTHENTICATION_FAILED', statusCode: 401,
        })
        pending.delete(body.pendingToken)
        managementSessions.set('dshms_completed', body.origin)
        managementSources.set('dshms_completed', source)
        return { session: { token: 'dshms_completed', csrfToken: 'dshc_management_completed' } }
      }
      if (path === '/v1/management/transitions/probe') {
        if (transitionNonces.get(body.transitionId) !== body.nonce) {
          throw Object.assign(new Error('transition probe is invalid'), {
            code: 'TRANSITION_PROBE_INVALID', statusCode: 401,
          })
        }
        transitionNonces.delete(body.transitionId)
        return { proof: 'proof-valid' }
      }
      if (path === '/v1/management/continuations/consume') {
        if (!continuations.has(body.token)) {
          throw Object.assign(new Error('continuation is invalid'), {
            code: 'CONTINUATION_INVALID', statusCode: 401,
          })
        }
        continuations.delete(body.token)
        managementSessions.set('dshms_continued', body.origin)
        return { session: { token: 'dshms_continued', csrfToken: 'dshc_continued' } }
      }
      throw new Error(`unexpected request ${method} ${path}`)
    },
  }
  const authentication = createBrowserAuthentication({ access, safeReturnPath })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void authentication.handle(incoming, response, url.pathname, url.searchParams).then(handled => {
      if (!handled) { response.writeHead(404); response.end() }
    })
  })
  return { access, authentication, calls, server, sessions, managementSessions, managementSources, state: () => state }
}

test('Management transition probe exposes a proof only to its exact source Origin and consumes the nonce', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const sourceOrigin = 'https://dsh.example'
    const path = '/_dsh_platform/transition/probe?transitionId=transition-valid&nonce=nonce-valid'
    const first = await request(port, {
      path,
      headers: { host: `127.0.0.1:${port}`, origin: sourceOrigin, accept: 'application/json' },
    })
    assert.equal(first.status, 200)
    assert.equal(first.headers['access-control-allow-origin'], sourceOrigin)
    assert.equal(first.headers['access-control-allow-credentials'], undefined)
    assert.equal(first.headers.vary, 'Origin')
    assert.deepEqual(JSON.parse(first.body), { proof: 'proof-valid' })
    const call = current.calls.find(value => value.path === '/v1/management/transitions/probe')
    assert.equal(call.body.sourceOrigin, sourceOrigin)
    assert.equal(call.body.candidateOrigin, `http://127.0.0.1:${port}`)

    const replay = await request(port, {
      path,
      headers: { host: `127.0.0.1:${port}`, origin: sourceOrigin, accept: 'application/json' },
    })
    assert.equal(replay.status, 401)
    assert.equal(replay.headers['access-control-allow-origin'], sourceOrigin)
  } finally { await close(current.server) }
})

test('same-origin Management transition probes use the request origin when browsers omit Origin on GET', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const response = await request(port, {
      path: '/_dsh_platform/transition/probe?transitionId=transition-valid&nonce=nonce-valid',
      headers: { host: `127.0.0.1:${port}`, accept: 'application/json' },
    })
    assert.equal(response.status, 200)
    assert.deepEqual(JSON.parse(response.body), { proof: 'proof-valid' })
    const call = current.calls.find(value => value.path === '/v1/management/transitions/probe')
    assert.equal(call.body.sourceOrigin, `http://127.0.0.1:${port}`)
    assert.equal(call.body.candidateOrigin, `http://127.0.0.1:${port}`)
  } finally { await close(current.server) }
})

test('Management continuation requires a top-level navigation and creates one session once', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const path = '/_dsh_platform/transition/continue?token=continuation-valid'
    const forbidden = await request(port, {
      path,
      headers: { host: `127.0.0.1:${port}`, 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty' },
    })
    assert.equal(forbidden.status, 403)

    const consumed = await request(port, {
      path,
      headers: { host: `127.0.0.1:${port}`, 'sec-fetch-mode': 'navigate', 'sec-fetch-dest': 'document' },
    })
    assert.equal(consumed.status, 200)
    assert.match(consumed.body, /location\.replace\("\/_dsh_platform\/console\/"\)/)
    assert.match(consumed.headers['set-cookie'][0], new RegExp(`^${MANAGEMENT_SESSION_COOKIE}=dshms_continued`))
    assert.match(consumed.headers['set-cookie'][0], /Path=\/_dsh_platform\//)
    assert.match(consumed.headers['set-cookie'][0], /SameSite=Lax/)

    const replay = await request(port, {
      path,
      headers: { host: `127.0.0.1:${port}`, 'sec-fetch-mode': 'navigate', 'sec-fetch-dest': 'document' },
    })
    assert.equal(replay.status, 401)
  } finally { await close(current.server) }
})

test('isolated Management continuation creates root-path cookies and enters from its own Origin', async () => {
  const current = fixture('initialized')
  const isolated = createBrowserAuthentication({
    access: current.access,
    safeReturnPath,
    paths: { authPrefix: '/auth/', accessPrefix: '/access/', transitionPrefix: '/transition/', consolePath: '/' },
  })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void isolated.handle(incoming, response, url.pathname, url.searchParams).then(handled => {
      if (!handled) { response.writeHead(404); response.end() }
    })
  })
  const port = await listen(server)
  try {
    const consumed = await request(port, {
      path: '/transition/continue?token=continuation-valid',
      headers: { host: `127.0.0.1:${port}`, 'sec-fetch-mode': 'navigate', 'sec-fetch-dest': 'document' },
    })
    assert.equal(consumed.status, 200)
    assert.match(consumed.body, /location\.replace\("\/"\)/)
    assert.match(consumed.headers['set-cookie'][0], new RegExp(`^${MANAGEMENT_SESSION_COOKIE}=dshms_continued`))
    assert.match(consumed.headers['set-cookie'][0], /Path=\//)
    assert.match(consumed.headers['set-cookie'][0], /SameSite=Lax/)
    assert.doesNotMatch(consumed.headers['set-cookie'][0], /Path=\/_dsh_platform\//)
  } finally { await close(server) }
})

test('renders state-driven initialization and recovery pages without exposing account material', async () => {
  for (const [state, expected] of [
    ['classification-pending', /Preparing authentication/],
    ['never-initialized', /autocomplete="new-password"/],
    ['initialized', /autocomplete="current-password"/],
    ['migration-required', /Administrator migration required/],
    ['recovery-required', /Administrator recovery required/],
  ]) {
    const current = fixture(state)
    const port = await listen(current.server)
    try {
      const response = await request(port, {
        path: '/_dsh_platform/auth/?return=https://evil.example/',
        headers: { host: `127.0.0.1:${port}`, 'accept-language': 'en' },
      })
      assert.equal(response.status, 200)
      assert.match(response.body, expected)
      assert.match(response.headers['cache-control'], /no-store/)
      assert.match(response.headers['x-dsh-csrf'], /^dsha_/)
      assert.match(response.headers['set-cookie'][1], new RegExp(`^${AUTH_RETRY_COOKIE}=dshr_`))
      assert.match(response.headers['content-security-policy'], /frame-ancestors 'none'/)
      assert.doesNotMatch(response.body, /https:\/\/evil\.example/)
      if (state === 'classification-pending') {
        assert.match(response.body, /setTimeout\(\(\)=>location\.reload\(\),1000\)/)
        assert.match(response.body, /<section class="waiting"><h1>Preparing authentication<\/h1>/)
        assert.match(response.body, /\.waiting\{text-align:center\}/)
        assert.doesNotMatch(response.body, /<form/)
      } else if (state !== 'recovery-required') {
        assertInlineScriptsCompile(response.body)
        assert.match(response.body, /<form method="post" action="\/_dsh_platform\/auth\/(?:session(?:\?return=[^"]+)?|reset)" novalidate>/)
        assert.doesNotMatch(response.body, /elements\.username\.addEventListener\('input'/)
        if (state === 'never-initialized' || state === 'migration-required') {
          assert.match(response.body, /class="field-error" data-field-error="username"[^>]*hidden/)
          assert.match(response.body, /class="field-error" data-field-error="password"[^>]*hidden/)
          assert.match(response.body, /name="confirmPassword" type="password" autocomplete="new-password" required/)
          assert.match(response.body, /class="field-error" data-field-error="confirmPassword"[^>]*hidden/)
          assert.match(response.body, /The new password confirmation does not match\./)
          assert.match(response.body, /\.field-error\{color:#ff7777;font-size:12px;font-weight:400;line-height:1\.5\}/)
          assert.match(response.body, /form\.elements\.password\.addEventListener\('input'/)
          assert.match(response.body, /form\.elements\.confirmPassword\.addEventListener\('input'/)
          assert.match(response.body, /if\(!validatePasswordConfirmation\(true\)\)return/)
        } else {
          assert.doesNotMatch(response.body, /class="field-error"|invalidUsername|invalidPassword|validateField/)
          assert.doesNotMatch(response.body, /minlength="8"|pattern="/)
          assert.doesNotMatch(response.body, /name="confirmPassword"|passwordMismatch|validatePasswordConfirmation/)
        }
        if (state === 'never-initialized') {
          assert.doesNotMatch(response.body, /name="setupKey"/)
          assert.doesNotMatch(response.body, /<h1>/)
        }
      } else {
        assert.match(response.body, /href="\/_dsh_platform\/auth\/reset\?return=/)
        assert.doesNotMatch(response.body, /name="setupKey"/)
      }
    } finally { await close(current.server) }
  }
})

test('a DSH session exchanges once for a separate Management session', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const origin = `http://127.0.0.1:${port}`
    current.sessions.set('dshs_existing', origin)
    const response = { writeHead(status, headers) { this.status = status; this.headers = headers }, end() {} }
    await current.authentication.enterManagement({
      headers: { host: `127.0.0.1:${port}`, cookie: `${DSH_SESSION_COOKIE}=dshs_existing` },
    }, response)
    assert.equal(response.status, 303)
    assert.match(response.headers.location, /management\/handoff\?token=dshh_created$/)

    const exchanged = await request(port, {
      path: response.headers.location,
      headers: { host: `127.0.0.1:${port}`, 'sec-fetch-mode': 'navigate', 'sec-fetch-dest': 'document' },
    })
    assert.equal(exchanged.status, 200)
    assert.match(exchanged.body, /location\.replace\("\/_dsh_platform\/console\/"\)/)
    assert.match(exchanged.headers['set-cookie'][0], new RegExp(`^${MANAGEMENT_SESSION_COOKIE}=dshms_exchanged`))
    assert.match(exchanged.headers['set-cookie'][0], /Max-Age=86400/)
    assert.match(exchanged.headers['set-cookie'][1], /Max-Age=86400/)
    const replay = await request(port, {
      path: response.headers.location,
      headers: { host: `127.0.0.1:${port}`, 'sec-fetch-mode': 'navigate', 'sec-fetch-dest': 'document' },
    })
    assert.equal(replay.status, 401)
  } finally { await close(current.server) }
})

test('a Management handoff preserves the fixed Authentication settings destination', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const origin = `http://127.0.0.1:${port}`
    current.sessions.set('dshs_existing', origin)
    const response = { writeHead(status, headers) { this.status = status; this.headers = headers }, end() {} }
    await current.authentication.enterManagement({
      headers: { host: `127.0.0.1:${port}`, cookie: `${DSH_SESSION_COOKIE}=dshs_existing` },
    }, response, new URLSearchParams('tab=auth-settings'))
    assert.equal(response.status, 303)
    assert.match(response.headers.location, /management\/handoff\?token=dshh_created&tab=auth-settings$/)

    const exchanged = await request(port, {
      path: response.headers.location,
      headers: { host: `127.0.0.1:${port}`, 'sec-fetch-mode': 'navigate', 'sec-fetch-dest': 'document' },
    })
    assert.equal(exchanged.status, 200)
    assert.match(exchanged.body, /location\.replace\("\/_dsh_platform\/console\/#auth-settings"\)/)
  } finally { await close(current.server) }
})

test('initialization requires same-origin JSON and a matching login CSRF token', async () => {
  const current = fixture()
  const port = await listen(current.server)
  try {
    const page = await request(port, {
      path: '/_dsh_platform/auth/', headers: { host: `127.0.0.1:${port}` },
    })
    assertInlineScriptsCompile(page.body)
    assert.match(page.body, /retryUntil=Date\.now\(\)\+seconds\*1000/)
    assert.match(page.body, /Math\.ceil\(\(retryUntil-Date\.now\(\)\)\/1000\)/)
    assert.match(page.body, /button\.disabled=true/)
    assert.match(page.body, /error\.hidden=true;button\.disabled=false/)
    assert.match(page.body, /if\(response\.ok\)\{navigating=true;location\.replace/)
    assert.match(page.body, /finally\{if\(!navigating&&retryUntil<=Date\.now\(\)\)button\.disabled=false;if\(!navigating\)button\.textContent=/)
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const retryCookie = page.headers['set-cookie'][1].split(';')[0]
    const browserCookies = `${csrfCookie}; ${retryCookie}`
    const csrf = csrfCookie.split('=')[1]
    const rejected = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin: 'https://evil.example',
        cookie: browserCookies, 'content-type': 'application/json', 'x-dsh-csrf': csrf,
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(rejected.status, 403)

    const initialized = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin: `http://127.0.0.1:${port}`,
        cookie: browserCookies, 'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors', 'user-agent': 'Session Test Browser',
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(initialized.status, 201)
    assert.equal(current.state(), 'initialized')
    assert.match(initialized.headers['set-cookie'][0], new RegExp(`^${DSH_SESSION_COOKIE}=dshs_created`))
    assert.match(initialized.headers['set-cookie'][0], /Max-Age=2592000/)
    assert.match(initialized.headers['set-cookie'][1], /Max-Age=2592000/)
    const initialization = current.calls.find(call => call.path === '/v1/dsh/initialize')
    assert.equal(initialization.body.client.userAgent, 'Session Test Browser')
    assert.equal(initialization.body.client.ip, '127.0.0.1')
    assert.match(initialization.body.authenticationSource, /^browser:[A-Za-z0-9_-]+$/)
  } finally { await close(current.server) }
})

test('parallel login pages share a stable context and stale submissions never become credential failures', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    const first = await request(port, { path: '/_dsh_platform/auth/', headers: { host } })
    const firstCsrfCookie = first.headers['set-cookie'][0].split(';')[0]
    const firstRetryCookie = first.headers['set-cookie'][1].split(';')[0]
    const firstCsrf = firstCsrfCookie.split('=')[1]
    const second = await request(port, {
      path: '/_dsh_platform/auth/',
      headers: { host, cookie: `${firstCsrfCookie}; ${firstRetryCookie}` },
    })
    const secondCsrfCookie = second.headers['set-cookie'][0].split(';')[0]
    assert.equal(secondCsrfCookie, firstCsrfCookie)

    const stale = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host, origin, cookie: `${AUTH_CSRF_COOKIE}=dsha_newer; ${firstRetryCookie}`,
        'content-type': 'application/json', 'x-dsh-csrf': firstCsrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(stale.status, 409)
    assert.equal(JSON.parse(stale.body).code, 'AUTHENTICATION_CONTEXT_STALE')
    assert.equal(current.calls.some(call => call.path === '/v1/dsh/login'), false)
    assert.match(first.body, /AUTHENTICATION_CONTEXT_STALE/)
    assert.match(first.body, /auth\/context/)

    const refreshed = await request(port, {
      path: '/_dsh_platform/auth/context',
      headers: {
        host, cookie: `${AUTH_CSRF_COOKIE}=dsha_newer; ${firstRetryCookie}`,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
    })
    assert.equal(refreshed.status, 200)
    assert.equal(JSON.parse(refreshed.body).csrfToken, 'dsha_newer')
    const recovered = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host, origin, cookie: `${AUTH_CSRF_COOKIE}=dsha_newer; ${firstRetryCookie}`,
        'content-type': 'application/json', 'x-dsh-csrf': 'dsha_newer',
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(recovered.status, 200)
    assert.equal(current.calls.filter(call => call.path === '/v1/dsh/login').length, 1)
  } finally { await close(current.server) }
})

test('TOTP retry countdown refreshes the current browser source from Access Manager', async () => {
  const current = fixture('initialized', {
    totpEnabled: true,
    totpRetry: { kind: 'retry', retryAfterSeconds: 6 },
  })
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const page = await request(port, { path: '/_dsh_platform/auth/', headers: { host } })
    const cookies = page.headers['set-cookie'].map(value => value.split(';')[0]).join('; ')
    assert.match(page.body, /refreshTotpRetry/)
    const response = await request(port, {
      path: '/_dsh_platform/auth/context',
      headers: { host, cookie: cookies, 'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors' },
    })
    assert.equal(response.status, 200)
    assert.deepEqual(JSON.parse(response.body).totpRetry, { kind: 'retry', retryAfterSeconds: 6 })
    const statusCall = current.calls.find(call => call.path === '/v1/authentication-retry/status')
    assert.equal(statusCall.method, 'POST')
    assert.equal(statusCall.body.credential, 'totp')
    assert.match(statusCall.body.source, /^browser:[A-Za-z0-9_-]+$/)
  } finally { await close(current.server) }
})

test('successful DSH and Management logins preserve parallel login-page context', async () => {
  const current = fixture('initialized', { managementAdditionalEnabled: false })
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    const page = await request(port, { path: '/_dsh_platform/auth/', headers: { host } })
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const retryCookie = page.headers['set-cookie'][1].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    const login = (path = '/_dsh_platform/auth/session') => request(port, {
      path, method: 'POST',
      headers: {
        host, origin, cookie: `${csrfCookie}; ${retryCookie}`,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })

    const first = await login()
    assert.equal(first.status, 200)
    assert.equal(first.headers['set-cookie'].some(cookie => cookie.startsWith(`${AUTH_CSRF_COOKIE}=;`)), false)
    const second = await login('/_dsh_platform/auth/session?return=%2F_dsh_platform%2Fauth%2Fmanagement%2Fstart')
    assert.equal(second.status, 200)

    const dshCookie = second.headers['set-cookie'][0].split(';')[0]
    const next = JSON.parse(second.body).next
    const handoff = await request(port, {
      path: next,
      headers: { host, cookie: `${dshCookie}; ${csrfCookie}; ${retryCookie}` },
    })
    assert.equal(handoff.status, 200)
    assert.equal(handoff.headers['set-cookie'].some(cookie => cookie.startsWith(`${AUTH_CSRF_COOKIE}=;`)), false)
    const afterManagement = await login()
    assert.equal(afterManagement.status, 200)
    const incorrect = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host, origin, cookie: `${csrfCookie}; ${retryCookie}`,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'wrong password' }),
    })
    assert.equal(incorrect.status, 401)
    assert.equal(JSON.parse(incorrect.body).code, 'AUTHENTICATION_FAILED')
    assert.equal(current.calls.filter(call => call.path === '/v1/dsh/login').length, 4)
  } finally { await close(current.server) }
})

test('TOTP completes on the existing login page and replaces its one-time challenge with a DSH session', async () => {
  const current = fixture('initialized', { totpEnabled: true })
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    const page = await request(port, {
      path: '/_dsh_platform/auth/', headers: { host, 'accept-language': 'zh-CN' },
    })
    assert.equal(page.status, 200)
    assert.match(page.body, /动态验证码/)
    assert.doesNotMatch(page.body, /name="totpCode"[^>]+pattern=/)
    assert.match(page.body, /if\(error\.textContent===initialMessage\)sync\(\)/)
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const retryCookie = page.headers['set-cookie'][1].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    const headers = {
      host, origin, cookie: `${csrfCookie}; ${retryCookie}`,
      'content-type': 'application/json', 'x-dsh-csrf': csrf,
      'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
    }
    const password = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST', headers,
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(password.status, 202)
    assert.deepEqual(JSON.parse(password.body), { authenticated: false, totpRequired: true })
    const challengeCookie = password.headers['set-cookie'].find(value => value.startsWith(`${TOTP_LOGIN_COOKIE}=`)).split(';')[0]
    const completed = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: { ...headers, cookie: `${csrfCookie}; ${retryCookie}; ${challengeCookie}` },
      body: JSON.stringify({ totpCode: '123456' }),
    })
    assert.equal(completed.status, 200)
    assert.equal(JSON.parse(completed.body).authenticated, true)
    assert.equal(completed.headers['set-cookie'].some(value => value.startsWith(`${DSH_SESSION_COOKIE}=dshs_totp`)), true)
    assert.equal(completed.headers['set-cookie'].some(value => value.startsWith(`${TOTP_LOGIN_COOKIE}=;`)), true)
    const completion = current.calls.find(value => value.path === '/v1/dsh/totp/complete')
    assert.equal(completion.body.challengeToken, 'dshtl_login')
    assert.equal(completion.body.code, '123456')
  } finally { await close(current.server) }
})

test('login reports an unavailable Access Manager instead of a credential failure', async () => {
  const access = {
    request: async (_method, path) => {
      if (path === '/v1/status') return { state: 'initialized' }
      throw new Error('access socket unavailable')
    },
  }
  const authentication = createBrowserAuthentication({ access, safeReturnPath })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void authentication.handle(incoming, response, url.pathname, url.searchParams)
  })
  const port = await listen(server)
  try {
    const origin = `http://127.0.0.1:${port}`
    const page = await request(port, {
      path: '/_dsh_platform/auth/', headers: { host: `127.0.0.1:${port}` },
    })
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    const response = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin, cookie: csrfCookie,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(response.status, 503)
    assert.equal(JSON.parse(response.body).code, 'ACCESS_MANAGER_UNAVAILABLE')
    assert.match(page.body, /authentication service is temporarily unavailable/i)
  } finally { await close(server) }
})

test('login waits for a restarting Access Manager before submitting credentials once', async () => {
  let restarting = false
  let statusAttempts = 0
  let loginAttempts = 0
  const access = {
    request: async (_method, path) => {
      if (path === '/v1/status') {
        statusAttempts += 1
        if (restarting && statusAttempts < 4) throw new Error('access socket unavailable')
        return { state: 'initialized', account: { managementAccess: { mode: 'compat' } } }
      }
      if (path === '/v1/dsh/login') {
        loginAttempts += 1
        return { session: { token: 'dshs_restarted', csrfToken: 'dshc_restarted' } }
      }
      if (path === '/v1/sessions/validate') return { authenticated: false }
      throw new Error(`unexpected Access request: ${path}`)
    },
  }
  const authentication = createBrowserAuthentication({ access, safeReturnPath, wait: async () => {} })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void authentication.handle(incoming, response, url.pathname, url.searchParams)
  })
  const port = await listen(server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    const page = await request(port, { path: '/_dsh_platform/auth/', headers: { host } })
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const retryCookie = page.headers['set-cookie'][1].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    statusAttempts = 0
    restarting = true
    const response = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host, origin, cookie: `${csrfCookie}; ${retryCookie}`,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(response.status, 200)
    assert.equal(statusAttempts, 4)
    assert.equal(loginAttempts, 1)
  } finally { await close(server) }
})

test('login preserves explicit Access Manager rate limits', async () => {
  const access = {
    request: async (_method, path) => {
      if (path === '/v1/status') return { state: 'initialized' }
      throw Object.assign(new Error('authentication is temporarily unavailable'), {
        statusCode: 429,
        code: 'AUTHENTICATION_RETRY_REQUIRED',
        retryAfterSeconds: 7,
      })
    },
  }
  const authentication = createBrowserAuthentication({ access, safeReturnPath })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void authentication.handle(incoming, response, url.pathname, url.searchParams)
  })
  const port = await listen(server)
  try {
    const origin = `http://127.0.0.1:${port}`
    const page = await request(port, {
      path: '/_dsh_platform/auth/', headers: { host: `127.0.0.1:${port}` },
    })
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    const response = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin, cookie: csrfCookie,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'wrong password' }),
    })
    assert.equal(response.status, 429)
    assert.equal(response.headers['retry-after'], '7')
    assert.deepEqual(JSON.parse(response.body), {
      error: 'authentication is temporarily unavailable',
      code: 'AUTHENTICATION_RETRY_REQUIRED',
      retryAfterSeconds: 7,
    })
  } finally { await close(server) }
})

test('legacy migration exchanges a root-issued authentication reset key for a DSH session', async () => {
  const current = fixture('migration-required')
  const port = await listen(current.server)
  try {
    const origin = `http://127.0.0.1:${port}`
    const page = await request(port, {
      path: '/_dsh_platform/auth/', headers: { host: `127.0.0.1:${port}`, 'accept-language': 'en' },
    })
    assert.match(page.body, /name="setupKey"/)
    assert.match(page.body, /method="post"/)
    assert.match(page.body, /Use 8 to 1024 characters\. Unicode letters, numbers, spaces, and symbols are supported; control and bidirectional-control characters are not\./)
    assert.match(page.body, /The authentication reset key is invalid, expired, or already used\./)
    assert.match(page.body, /name="username"[^>]+pattern="\[\^\\p\{Cc\}/)
    assert.match(page.body, /name="password"[^>]+minlength="8"[^>]+pattern="\[\^\\p\{Cc\}/)
    assert.match(page.body, /name="confirmPassword" type="password" autocomplete="new-password" required/)
    assert.match(page.body, /html\{height:100%;color-scheme:light dark}/)
    assert.match(page.body, /body\{min-height:100%;margin:0;display:grid;place-items:center;/)
    assert.doesNotMatch(page.body, /100dvh/)
    assert.match(page.body, /input:focus-visible\{border-color:#f3f3f4;outline:none\}/)
    assert.doesNotMatch(page.body, /name="password"[^>]*value=/)
    assertInlineScriptsCompile(page.body)
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    const migrated = await request(port, {
      path: '/_dsh_platform/auth/reset', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin, cookie: csrfCookie,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ setupKey: 'dshak_valid', username: 'admin', password: 'correct password' }),
    })
    assert.equal(migrated.status, 201)
    assert.match(migrated.headers['set-cookie'][0], new RegExp(`^${DSH_SESSION_COOKIE}=dshs_reset`))
    assert.equal(current.calls.some(call => call.path === '/v1/dsh/reset-authentication'), true)
  } finally { await close(current.server) }
})

test('migration and initialization pages distinguish registration errors from login failures', async () => {
  for (const [state, language, expected] of [
    ['never-initialized', 'zh-CN', ['密码支持 8 至 1024 个字符，可使用中文、字母、数字、空格和符号；不能包含控制字符或双向控制字符。', '无法创建管理员账户，请检查填写内容后重试。']],
    ['migration-required', 'zh-CN', ['认证重置密钥无效、已过期或已使用，请重新生成。', '密码支持 8 至 1024 个字符，可使用中文、字母、数字、空格和符号；不能包含控制字符或双向控制字符。']],
    ['never-initialized', 'en', ['Use 8 to 1024 characters. Unicode letters, numbers, spaces, and symbols are supported; control and bidirectional-control characters are not.', 'The administrator account could not be created.']],
  ]) {
    const current = fixture(state)
    const port = await listen(current.server)
    try {
      const page = await request(port, {
        path: '/_dsh_platform/auth/',
        headers: { host: `127.0.0.1:${port}`, 'accept-language': language },
      })
      for (const message of expected) assert.match(page.body, new RegExp(message.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
      assertInlineScriptsCompile(page.body)
    } finally { await close(current.server) }
  }
})

test('a parallel TOTP page reuses the DSH session completed by another tab', async () => {
  const current = fixture('initialized', { totpEnabled: true })
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    current.sessions.set('dshs_existing', origin)
    const response = await request(port, {
      path: '/_dsh_platform/auth/session?return=%2F_dsh_platform%2Fauth%2Fmanagement%2Fstart',
      method: 'POST',
      headers: {
        host, origin,
        cookie: `${DSH_SESSION_COOKIE}=dshs_existing; ${TOTP_LOGIN_COOKIE}=dshtl_consumed`,
        'content-type': 'application/json',
        'x-dsh-csrf': 'dsha_stale',
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ totpCode: '123456' }),
    })
    assert.equal(response.status, 200)
    assert.deepEqual(JSON.parse(response.body), {
      authenticated: true,
      next: '/_dsh_platform/auth/management/start',
    })
    assert.equal(response.headers['set-cookie'].some(value => value.startsWith(`${TOTP_LOGIN_COOKIE}=;`)), true)
    assert.equal(current.calls.some(call => call.path === '/v1/dsh/totp/complete'), false)

    const forbidden = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host, origin: 'https://attacker.example',
        cookie: `${DSH_SESSION_COOKIE}=dshs_existing`,
        'content-type': 'application/json',
        'sec-fetch-site': 'cross-site', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ totpCode: '123456' }),
    })
    assert.equal(forbidden.status, 403)
  } finally { await close(current.server) }
})

test('damaged authentication requires an explicit reset page and never places credentials in its URL', async () => {
  const current = fixture('recovery-required')
  const port = await listen(current.server)
  try {
    const origin = `http://127.0.0.1:${port}`
    const recovery = await request(port, {
      path: '/_dsh_platform/auth/', headers: { host: `127.0.0.1:${port}`, 'accept-language': 'en' },
    })
    assert.match(recovery.body, /Reset administrator authentication/)
    assert.match(recovery.body, /\.button:focus-visible\{outline:2px solid/)
    assert.doesNotMatch(recovery.body, /name="(?:setupKey|username|password)"/)

    const page = await request(port, {
      path: '/_dsh_platform/auth/reset?return=%2Fsettings',
      headers: { host: `127.0.0.1:${port}`, 'accept-language': 'en' },
    })
    assert.equal(page.status, 200)
    assert.match(page.body, /<form method="post" action="\/_dsh_platform\/auth\/reset" novalidate>/)
    assert.match(page.body, /name="confirmPassword" type="password" autocomplete="new-password" required/)
    assert.doesNotMatch(page.body, /dshak_valid|username=|password=/)
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    const reset = await request(port, {
      path: '/_dsh_platform/auth/reset', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin, cookie: csrfCookie,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ setupKey: 'dshak_valid', username: 'recovered', password: 'correct password' }),
    })
    assert.equal(reset.status, 201)
    assert.equal(current.calls.some(call => call.path === '/v1/dsh/reset-authentication'), true)
  } finally { await close(current.server) }
})

test('login sessions are origin-bound and safe return paths remain local', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const page = await request(port, {
      path: '/_dsh_platform/auth/?return=%2Fsettings%3Fsection%3Dplugins',
      headers: { host: `127.0.0.1:${port}` },
    })
    assert.doesNotMatch(page.body, /Administrator sign in|Enter the local administrator account/)
    assert.doesNotMatch(page.body, /<h1>/)
    const csrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const csrf = csrfCookie.split('=')[1]
    const login = await request(port, {
      path: '/_dsh_platform/auth/session', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin: `http://127.0.0.1:${port}`,
        cookie: csrfCookie, 'content-type': 'application/json', 'x-dsh-csrf': csrf,
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(login.status, 200)
    const sessionCookie = login.headers['set-cookie'][0].split(';')[0]
    assert.equal((await current.authentication.validateDsh({ headers: {
      host: `127.0.0.1:${port}`, cookie: sessionCookie,
    } })).authenticated, true)
    assert.equal((await current.authentication.validateDsh({ headers: {
      host: 'different.example', cookie: sessionCookie,
    } })).authenticated, false)
    assert.equal(safeReturnPath('//evil.example'), '/')
    assert.equal(safeReturnPath('/settings?section=plugins'), '/settings?section=plugins')
  } finally { await close(current.server) }
})

test('direct Management access requires a DSH login before exchanging a Management session', async () => {
  const current = fixture('initialized', { managementAdditionalEnabled: false })
  const port = await listen(current.server)
  try {
    const origin = `http://127.0.0.1:${port}`
    const staleCookies = `${DSH_SESSION_COOKIE}=dshs_previous_instance; ${MANAGEMENT_SESSION_COOKIE}=dshms_previous_instance`
    const entry = await request(port, {
      path: '/_dsh_platform/auth/management', headers: {
        host: `127.0.0.1:${port}`, cookie: staleCookies,
      },
    })
    assert.equal(entry.status, 303)
    const loginEntry = new URL(entry.headers.location)
    assert.equal(loginEntry.origin, origin)
    assert.equal(loginEntry.pathname, '/_dsh_platform/auth/')
    assert.equal(loginEntry.searchParams.get('return'), '/_dsh_platform/auth/management/start')
    const page = await request(port, {
      path: `${loginEntry.pathname}${loginEntry.search}`, headers: {
        host: `127.0.0.1:${port}`, cookie: staleCookies,
      },
    })
    assert.doesNotMatch(page.body, /class="field-error"|invalidUsername|invalidPassword|validateField/)
    assert.doesNotMatch(page.body, /name="confirmPassword"|validatePasswordConfirmation/)
    assert.doesNotMatch(page.body, /minlength="8"|pattern="/)
    const loginCsrfCookie = page.headers['set-cookie'][0].split(';')[0]
    const loginCsrf = loginCsrfCookie.split('=')[1]
    const dshLogin = await request(port, {
      path: '/_dsh_platform/auth/session?return=%2F_dsh_platform%2Fauth%2Fmanagement%2Fstart', method: 'POST',
      headers: {
        host: `127.0.0.1:${port}`, origin, cookie: loginCsrfCookie,
        'content-type': 'application/json', 'x-dsh-csrf': loginCsrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })
    assert.equal(dshLogin.status, 200)
    const loginResult = JSON.parse(dshLogin.body)
    assert.equal(loginResult.authenticated, true)
    assert.match(loginResult.next, /^\/_dsh_platform\/auth\/management\/handoff\?token=dshh_created$/)
    const dshCookie = dshLogin.headers['set-cookie'][0].split(';')[0]
    const exchanged = await request(port, {
      path: loginResult.next,
      headers: { host: `127.0.0.1:${port}`, cookie: dshCookie },
    })
    assert.equal(exchanged.status, 200)
    assert.match(exchanged.body, /location\.replace\("\/_dsh_platform\/console\/"\)/)
    assert.match(exchanged.headers['set-cookie'][0], new RegExp(`^${MANAGEMENT_SESSION_COOKIE}=dshms_exchanged`))
    assert.equal(current.calls.some(call => call.path === '/v1/management/login'), false)
    assert.equal((await request(port, {
      path: '/_dsh_platform/auth/management/session', method: 'POST',
      headers: { host: `127.0.0.1:${port}`, origin, 'content-type': 'application/json' },
      body: JSON.stringify({ username: 'admin', password: 'correct password' }),
    })).status, 404)
  } finally { await close(current.server) }
})

test('isolated Management sends the first login layer to the verified DSH Origin', async () => {
  const current = fixture('initialized', {
    managementAccess: {
      mode: 'isolated',
      dshPublicOrigin: 'https://dsh.example',
      isolatedEntry: { kind: 'public', managementPublicOrigin: 'https://manage.example' },
    },
  })
  const isolated = createBrowserAuthentication({
    access: current.access,
    safeReturnPath,
    paths: { authPrefix: '/auth/', accessPrefix: '/access/', transitionPrefix: '/transition/', consolePath: '/' },
  })
  const response = { writeHead(status, headers) { this.status = status; this.headers = headers }, end() {} }
  await isolated.enterManagement({ headers: { host: 'manage.example' } }, response)
  assert.equal(response.status, 303)
  const entry = new URL(response.headers.location)
  assert.equal(entry.origin, 'https://dsh.example')
  assert.equal(entry.pathname, '/_dsh_platform/auth/')
  assert.equal(entry.searchParams.get('return'), '/_dsh_platform/auth/management/start')
})

test('Management entry reuses an existing Management session instead of re-handing off', async () => {
  const current = fixture('initialized', {
    managementAccess: {
      mode: 'isolated',
      dshPublicOrigin: 'https://dsh.example',
      isolatedEntry: { kind: 'public', managementPublicOrigin: 'https://manage.example' },
    },
  })
  const isolated = createBrowserAuthentication({
    access: current.access,
    safeReturnPath,
    paths: { authPrefix: '/auth/', accessPrefix: '/access/', transitionPrefix: '/transition/', consolePath: '/' },
  })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void isolated.handle(incoming, response, url.pathname, url.searchParams).then(handled => {
      if (!handled) { response.writeHead(404); response.end() }
    })
  })
  const port = await listen(server)
  try {
    const origin = `http://127.0.0.1:${port}`
    current.sessions.set('dshs_existing', origin)
    current.managementSessions.set('dshms_existing', origin)
    current.managementSources.set('dshms_existing', 'dshs_existing')
    const response = await request(port, {
      path: '/auth/management',
      headers: { host: `127.0.0.1:${port}`, cookie: `${MANAGEMENT_SESSION_COOKIE}=dshms_existing` },
    })
    assert.equal(response.status, 200)
    assert.match(response.body, /location\.replace\("\/"\)/)
    assert.equal(current.calls.some(call => call.path === '/v1/management/handoffs'), false)
  } finally { await close(server) }
})

test('Management return-to-DSH navigation uses the current compatibility origin', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    current.sessions.set('dshs_existing', origin)
    current.managementSessions.set('dshms_existing', origin)
    current.managementSources.set('dshms_existing', 'dshs_existing')
    const response = await request(port, {
      path: '/_dsh_platform/auth/return-dsh',
      headers: {
        host,
        cookie: `${MANAGEMENT_SESSION_COOKIE}=dshms_existing`,
        'sec-fetch-mode': 'navigate',
        'sec-fetch-dest': 'document',
      },
    })
    assert.equal(response.status, 303)
    assert.equal(response.headers.location, `${origin}/`)
  } finally { await close(current.server) }
})

test('isolated Management return-to-DSH navigation uses the stored DSH Origin', async () => {
  const current = fixture('initialized', {
    managementAccess: {
      mode: 'isolated',
      dshPublicOrigin: 'https://dsh.example',
      isolatedEntry: { kind: 'public', managementPublicOrigin: 'https://manage.example' },
    },
  })
  const isolated = createBrowserAuthentication({
    access: current.access,
    safeReturnPath,
    paths: { authPrefix: '/auth/', accessPrefix: '/access/', transitionPrefix: '/transition/', consolePath: '/' },
  })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void isolated.handle(incoming, response, url.pathname, url.searchParams).then(handled => {
      if (!handled) { response.writeHead(404); response.end() }
    })
  })
  const port = await listen(server)
  try {
    current.sessions.set('dshs_existing', 'http://manage.example')
    current.managementSessions.set('dshms_existing', 'http://manage.example')
    current.managementSources.set('dshms_existing', 'dshs_existing')
    const response = await request(port, {
      path: '/auth/return-dsh',
      headers: {
        host: 'manage.example',
        cookie: `${MANAGEMENT_SESSION_COOKIE}=dshms_existing`,
        'sec-fetch-mode': 'navigate',
        'sec-fetch-dest': 'document',
      },
    })
    assert.equal(response.status, 303)
    assert.equal(response.headers.location, 'https://dsh.example/')
  } finally { await close(server) }
})

test('Management return-to-DSH navigation refuses missing targets and unauthenticated requests', async () => {
  const current = fixture('initialized', {
    managementAccess: {
      mode: 'isolated',
      dshPublicOrigin: null,
      isolatedEntry: { kind: 'public', managementPublicOrigin: 'https://manage.example' },
    },
  })
  const isolated = createBrowserAuthentication({
    access: current.access,
    safeReturnPath,
    paths: { authPrefix: '/auth/', accessPrefix: '/access/', transitionPrefix: '/transition/', consolePath: '/' },
  })
  const server = createServer((incoming, response) => {
    const url = new URL(incoming.url, 'http://gateway.internal')
    void isolated.handle(incoming, response, url.pathname, url.searchParams).then(handled => {
      if (!handled) { response.writeHead(404); response.end() }
    })
  })
  const port = await listen(server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    current.sessions.set('dshs_existing', origin)
    current.managementSessions.set('dshms_existing', origin)
    current.managementSources.set('dshms_existing', 'dshs_existing')
    const missing = await request(port, {
      path: '/auth/return-dsh',
      headers: { host, cookie: `${MANAGEMENT_SESSION_COOKIE}=dshms_existing` },
    })
    assert.equal(missing.status, 409)
    assert.match(missing.body, /DSH_RETURN_UNAVAILABLE/)
    const unauthenticated = await request(port, {
      path: '/auth/return-dsh',
      headers: { host },
    })
    assert.equal(unauthenticated.status, 401)
    assert.match(unauthenticated.body, /AUTHENTICATION_REQUIRED/)
  } finally { await close(server) }
})

test('DSH browser logout exposes only additional-password state and revokes the requested sessions', async () => {
  const current = fixture('initialized')
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    current.sessions.set('dshs_existing', origin)
    current.managementSessions.set('dshms_existing', origin)
    const dshCookies = `${DSH_SESSION_COOKIE}=dshs_existing; dsh_gateway_csrf=dshc_existing`
    const managementCookie = `${MANAGEMENT_SESSION_COOKIE}=dshms_existing`

    const context = await request(port, {
      path: '/_dsh_platform/auth/session-context', headers: { host, cookie: dshCookies },
    })
    assert.equal(context.status, 200)
    assert.deepEqual(JSON.parse(context.body), {
      managementAdditionalPasswordEnabled: true,
      managementConsoleHref: '/_dsh_platform/console/',
    })
    assert.doesNotMatch(context.body, /account|username|verifier|password.*version/i)

    const managementOnly = await request(port, {
      path: '/_dsh_platform/auth/browser-logout', method: 'POST',
      headers: {
        host, origin, cookie: `${dshCookies}; ${managementCookie}`,
        'content-type': 'application/json', 'x-dsh-csrf': 'dshc_existing',
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ scope: 'management' }),
    })
    assert.equal(managementOnly.status, 200)
    assert.equal(current.sessions.has('dshs_existing'), true)
    assert.equal(current.managementSessions.has('dshms_existing'), false)
    assert.equal(managementOnly.headers['set-cookie'].some(value => value.startsWith(`${DSH_SESSION_COOKIE}=`)), false)
    assert.equal(managementOnly.headers['set-cookie'].some(value => value.startsWith(`${MANAGEMENT_SESSION_COOKIE}=`)), true)

    const all = await request(port, {
      path: '/_dsh_platform/auth/browser-logout', method: 'POST',
      headers: {
        host, origin, cookie: dshCookies,
        'content-type': 'application/json', 'x-dsh-csrf': 'dshc_existing',
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({ scope: 'all' }),
    })
    assert.equal(all.status, 200)
    assert.equal(current.sessions.has('dshs_existing'), false)
    assert.equal(all.headers['set-cookie'].some(value => value.startsWith(`${DSH_SESSION_COOKIE}=`)), true)
    assert.equal(all.headers['set-cookie'].some(value => value.startsWith(`${MANAGEMENT_SESSION_COOKIE}=`)), true)
    assert.equal(all.headers['set-cookie'].some(value => value.startsWith(`${AUTH_CSRF_COOKIE}=`)), true)
    const logoutCall = current.calls.find(value => value.path === '/v1/dsh/browser-logout' && value.body.scope === 'all')
    assert.equal(logoutCall.body.dshOrigin, origin)
    assert.equal(logoutCall.body.dshToken, 'dshs_existing')
  } finally { await close(current.server) }
})

test('DSH session context publishes the configured separate Management Console URL', async () => {
  for (const [managementAccess, expected] of [
    [{ mode: 'isolated', isolatedEntry: { kind: 'public', managementPublicOrigin: 'https://manage.example' } }, 'https://manage.example/'],
    [{ mode: 'isolated', isolatedEntry: { kind: 'local-only', managementLocalOrigin: 'http://127.0.0.1:43081' } }, 'http://127.0.0.1:43081/'],
  ]) {
    const current = fixture('initialized', { managementAccess })
    current.sessions.set('dshs_existing', 'http://dsh.example')
    const port = await listen(current.server)
    try {
      const response = await request(port, {
        path: '/_dsh_platform/auth/session-context',
        headers: { host: 'dsh.example', cookie: `${DSH_SESSION_COOKIE}=dshs_existing` },
      })
      assert.equal(response.status, 200)
      assert.equal(JSON.parse(response.body).managementConsoleHref, expected)
    } finally { await close(current.server) }
  }
})

test('Management session context rejects a browser after its linked session is revoked', async () => {
  const current = fixture('initialized')
  current.sessions.set('dshs_existing', 'http://dsh.example')
  current.managementSessions.set('dshms_existing', 'http://dsh.example')
  current.managementSources.set('dshms_existing', 'dshs_existing')
  const port = await listen(current.server)
  try {
    const headers = { host: 'dsh.example', cookie: `${MANAGEMENT_SESSION_COOKIE}=dshms_existing` }
    assert.equal((await request(port, { path: '/_dsh_platform/auth/management/session-context', headers })).status, 200)
    current.managementSessions.delete('dshms_existing')
    assert.equal((await request(port, { path: '/_dsh_platform/auth/management/session-context', headers })).status, 401)
  } finally { await close(current.server) }
})

test('DSH browser sessions authorize only path-bound Plugin API capabilities', async () => {
  const current = fixture('initialized')
  current.sessions.set('dshs_existing', 'http://dsh.example')
  const authorization = await current.authentication.authorizePlugin({
    headers: {
      host: 'dsh.example',
      origin: 'http://dsh.example',
      cookie: `${DSH_SESSION_COOKIE}=dshs_existing; dsh_gateway_csrf=dshc_existing`,
      'x-dsh-csrf': 'dshc_existing',
      'sec-fetch-site': 'same-origin',
      'sec-fetch-mode': 'cors',
    },
  }, {
    method: 'POST', target: '/_dsh_platform/api/v1/restart-dsh', requireCsrf: true,
  })
  assert.equal(authorization.authorized, true)
  assert.equal(authorization.capability.token, 'dshcap_plugin')
  const call = current.calls.find(value => value.path === '/v1/dsh/capabilities')
  assert.deepEqual(call.body, {
    dshToken: 'dshs_existing',
    origin: 'http://dsh.example',
    csrfToken: 'dshc_existing',
    requireCsrf: true,
    method: 'POST',
    target: '/_dsh_platform/api/v1/restart-dsh',
  })
  assert.equal((await current.authentication.authorizePlugin({
    headers: {
      host: 'dsh.example', origin: 'http://dsh.example',
      cookie: `${DSH_SESSION_COOKIE}=missing`, 'sec-fetch-site': 'same-origin',
    },
  }, { method: 'GET', target: '/_dsh_platform/api/v1/status' })).authorized, false)
})

test('Management pending page asks only for the additional password', () => {
  const current = fixture('initialized')
  return listen(current.server).then(async port => {
    try {
      const page = await request(port, {
        path: '/_dsh_platform/auth/management/pending',
        headers: {
          host: `127.0.0.1:${port}`,
          cookie: 'dsh_management_pending=dshmp_pending',
        },
      })
      assert.equal(page.status, 200)
      assert.equal(page.headers['set-cookie'].some(value => value.startsWith(`${MANAGEMENT_CSRF_COOKIE}=`)), true)
      assert.equal(page.headers['set-cookie'].some(value => value.startsWith(`${AUTH_CSRF_COOKIE}=`)), false)
      assertInlineScriptsCompile(page.body)
      assert.match(page.body, /Management console password/)
      assert.match(page.body, /html\{height:100%;color-scheme:light dark}/)
      assert.match(page.body, /body\{min-height:100%;margin:0;display:grid;place-items:center;/)
      assert.doesNotMatch(page.body, /100dvh/)
      assert.match(page.body, /input:focus-visible\{border-color:#f3f3f4;outline:none\}/)
      assert.match(page.body, /AUTHENTICATION_RETRY_REQUIRED/)
      assert.match(page.body, /AUTHENTICATION_RATE_LIMITED/)
      assert.match(page.body, /AUTHENTICATION_CONTEXT_STALE/)
      assert.match(page.body, /location\.replace\("\/_dsh_platform\/auth\/management"\)/)
      assert.match(page.body, /retryUntil=Date\.now\(\)\+seconds\*1000/)
      assert.match(page.body, /Math\.ceil\(\(retryUntil-Date\.now\(\)\)\/1000\)/)
      assert.match(page.body, /button\.disabled=true/)
      assert.match(page.body, /error\.hidden=true;button\.disabled=false/)
      assert.match(page.body, /if\(response\.ok\)\{navigating=true;location\.replace/)
      assert.match(page.body, /finally\{if\(!navigating&&retryUntil<=Date\.now\(\)\)button\.disabled=false}/)
      assert.match(page.body, /<form method="post" action="\/_dsh_platform\/auth\/management\/pending" novalidate>/)
      assert.doesNotMatch(page.body, /minlength="8"|pattern="|field-error|Use 8 to 1024 characters/)
      assert.doesNotMatch(page.body, /name="username"|management\/session/)
    } finally { await close(current.server) }
  })
})

test('a stale Management pending submission is renewed and completed without asking again', async () => {
  for (const staleCsrf of [false, true]) {
    const current = fixture('initialized', { managementPending: true })
    const port = await listen(current.server)
    try {
      const host = `127.0.0.1:${port}`
      const origin = `http://${host}`
      current.sessions.set('dshs_existing', origin)
      const page = await request(port, {
        path: '/_dsh_platform/auth/management/pending',
        headers: {
          host,
          cookie: `${DSH_SESSION_COOKIE}=dshs_existing; dsh_management_pending=dshmp_stale`,
        },
      })
      const csrfCookie = page.headers['set-cookie'].find(value => value.startsWith(`${MANAGEMENT_CSRF_COOKIE}=`))
      const csrf = csrfCookie.split(';')[0].split('=')[1]
      const response = await request(port, {
        path: '/_dsh_platform/auth/management/pending', method: 'POST',
        headers: {
          host, origin,
          cookie: `${DSH_SESSION_COOKIE}=dshs_existing; dsh_management_pending=dshmp_stale; ${MANAGEMENT_CSRF_COOKIE}=${csrf}`,
          'content-type': 'application/json',
          'x-dsh-csrf': staleCsrf ? 'dshm_stale' : csrf,
          'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
        },
        body: JSON.stringify({
          password: 'correct management password',
          authenticationContext: staleCsrf ? 'dsh-authentication-context' : 'stale-context',
        }),
      })
      assert.equal(response.status, 200)
      assert.equal(JSON.parse(response.body).authenticated, true)
      assert.equal(response.headers['set-cookie'].some(value => value.startsWith(`${MANAGEMENT_SESSION_COOKIE}=dshms_completed`)), true)
      assert.equal(current.calls.filter(call => call.path === '/v1/management/handoffs').length, 1)
      assert.equal(current.calls.filter(call => call.path === '/v1/management/handoffs/consume').length, 1)
      assert.equal(current.calls.filter(call => call.path === '/v1/management/pending/complete').length, staleCsrf ? 1 : 2)
    } finally { await close(current.server) }
  }
})

test('an incorrect Management password is rejected once without renewing its pending login', async () => {
  const current = fixture('initialized', { managementPending: true })
  const port = await listen(current.server)
  try {
    const host = `127.0.0.1:${port}`
    const origin = `http://${host}`
    current.sessions.set('dshs_existing', origin)
    const handoff = await current.access.request('POST', '/v1/management/handoffs', {
      dshToken: 'dshs_existing', dshOrigin: origin, targetOrigin: origin,
    })
    const exchanged = await current.access.request('POST', '/v1/management/handoffs/consume', {
      token: handoff.handoff.token, origin,
    })
    const page = await request(port, {
      path: '/_dsh_platform/auth/management/pending',
      headers: {
        host,
        cookie: `${DSH_SESSION_COOKIE}=dshs_existing; dsh_management_pending=${exchanged.pending.token}`,
      },
    })
    const csrfCookie = page.headers['set-cookie'].find(value => value.startsWith(`${MANAGEMENT_CSRF_COOKIE}=`))
    const csrf = csrfCookie.split(';')[0].split('=')[1]
    const callsBefore = current.calls.length
    const response = await request(port, {
      path: '/_dsh_platform/auth/management/pending', method: 'POST',
      headers: {
        host, origin,
        cookie: `${DSH_SESSION_COOKIE}=dshs_existing; dsh_management_pending=${exchanged.pending.token}; ${MANAGEMENT_CSRF_COOKIE}=${csrf}`,
        'content-type': 'application/json', 'x-dsh-csrf': csrf,
        'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors',
      },
      body: JSON.stringify({
        password: 'wrong management password',
        authenticationContext: 'dsh-authentication-context',
      }),
    })
    assert.equal(response.status, 401)
    assert.equal(JSON.parse(response.body).code, 'AUTHENTICATION_FAILED')
    assert.deepEqual(current.calls.slice(callsBefore).map(call => call.path), ['/v1/management/pending/complete'])
  } finally { await close(current.server) }
})