/**
 * Privacy Page + Cookie Consent Workflow Verification
 *
 * Golden-path spec generated by v-workflow-verifier for session 47db79c4-4dbd-4525-966b-01f4b79597fc.
 * Changed files: resources/js/Pages/Marketing/Privacy.tsx, resources/js/lib/cookieConsent.ts
 *
 * Covers:
 *  1. Privacy page renders without console errors (golden path)
 *  2. Cookie consent banner appears on first visit (no prior consent cookie)
 *     — uses /login which does NOT have disableGlobalUi = true
 *  3. Accept-all dismisses the banner and sets consent cookies
 *  4. Decline-all dismisses the banner and sets declined cookie
 *  5. Customize panel opens/closes and saves granular preferences
 *  6. Privacy page DOES NOT show the cookie banner (disableGlobalUi = true)
 *  7. POST failure → inline error + retry affordance (GDPR Art. 7 compliance)
 *
 * Note: Most marketing pages (Welcome, Features, Pricing, Blog, etc.) use
 * disableGlobalUi = true and suppress the global banner — the banner appears
 * on auth pages and dashboard pages where disableGlobalUi is not set.
 */

import { test, expect } from '@playwright/test';

// Filter console errors that are known background noise in the test env
// (CSRF mismatch when APP_URL ≠ test baseURL, per memory: feedback_419_background_noise.md)
// 429 is rate-limiting noise — the test suite visits /login 4× in sequence (banner tests),
// which exhausts the login-page rate limiter. This is a test harness artifact, not a
// production workflow regression.
function isKnownNoise(text: string): boolean {
  if (text.includes('/api/lead-score/pql-signal')) return true;
  if (text.includes('419')) return true;
  if (text.includes('429')) return true;
  return false;
}

// In error-injection tests, a 500 response from fetch() causes a browser-level
// "Failed to load resource: the server responded with a status of 500" console message.
// This is the browser's own network error reporting — not an uncaught JS exception.
// Filter it out when we are intentionally injecting a 500 to exercise the error UX.
function isInjectedNetworkError(text: string): boolean {
  return text.includes('Failed to load resource') && text.includes('500');
}

// ── 1. Privacy page golden path ──────────────────────────────────────────────

test('privacy page renders with correct heading and no console errors', async ({ page }) => {
  const consoleErrors: string[] = [];
  const failedRequests: string[] = [];

  page.on('console', (msg) => {
    if (msg.type() === 'error' && !isKnownNoise(msg.text())) {
      consoleErrors.push(msg.text());
    }
  });
  page.on('requestfailed', (req) => {
    failedRequests.push(`${req.method()} ${req.url()} — ${req.failure()?.errorText ?? 'unknown'}`);
  });

  await page.goto('/privacy', { waitUntil: 'networkidle' });

  // Page title
  await expect(page).toHaveTitle(/Privacy Policy/i);

  // H1 is visible
  await expect(page.getByRole('heading', { name: 'Privacy Policy', level: 1 })).toBeVisible();

  // Last updated tag present
  await expect(page.getByText(/Last updated:/)).toBeVisible();

  // Key sections present
  await expect(page.getByRole('heading', { name: /1\. Information We Collect/i })).toBeVisible();
  await expect(page.getByRole('heading', { name: /8\. Cookie Policy/i })).toBeVisible();

  // No uncaught errors, no failed requests
  expect(consoleErrors, `Uncaught console errors: ${consoleErrors.join('; ')}`).toHaveLength(0);
  expect(failedRequests, `Failed requests: ${failedRequests.join('; ')}`).toHaveLength(0);
});

// ── 2. Cookie consent banner — first visit (no cookie set) ───────────────────
// The banner is mounted globally in app.tsx but is suppressed by disableGlobalUi = true
// on most marketing pages. Auth pages (/login, /register) do not set disableGlobalUi,
// so the banner renders there on first visit.

test('cookie consent banner appears on /login when no consent cookie exists', async ({ browser }) => {
  // Fresh context with NO cookies — simulates a first-time visitor
  const context = await browser.newContext({
    storageState: undefined,
  });
  const page = await context.newPage();

  const consoleErrors: string[] = [];
  page.on('console', (msg) => {
    if (msg.type() === 'error' && !isKnownNoise(msg.text())) {
      consoleErrors.push(msg.text());
    }
  });

  await page.goto('/login', { waitUntil: 'networkidle' });

  // Banner should be visible (no consent cookie, page does not use disableGlobalUi)
  const banner = page.getByRole('dialog', { name: /cookie consent/i });
  await expect(banner).toBeVisible({ timeout: 8_000 });

  // Required buttons present
  await expect(banner.getByRole('button', { name: /accept all/i })).toBeVisible();
  await expect(banner.getByRole('button', { name: /decline/i })).toBeVisible();
  await expect(banner.getByRole('button', { name: /customize/i })).toBeVisible();

  // Privacy Policy link present in the banner
  await expect(banner.getByRole('link', { name: /privacy policy/i })).toBeVisible();

  expect(consoleErrors, `Uncaught console errors: ${consoleErrors.join('; ')}`).toHaveLength(0);

  await context.close();
});

// ── 3. Accept-all ─────────────────────────────────────────────────────────────

test('accept all dismisses the cookie banner', async ({ browser }) => {
  const context = await browser.newContext({ storageState: undefined });
  const page = await context.newPage();

  const consoleErrors: string[] = [];
  page.on('console', (msg) => {
    if (msg.type() === 'error' && !isKnownNoise(msg.text())) {
      consoleErrors.push(msg.text());
    }
  });

  await page.goto('/login', { waitUntil: 'networkidle' });

  const banner = page.getByRole('dialog', { name: /cookie consent/i });
  await banner.waitFor({ state: 'visible', timeout: 8_000 });

  // Mock the /cookie-consent POST to return 200 so the banner can dismiss
  await page.route('/cookie-consent', (route) => {
    if (route.request().method() === 'POST') {
      void route.fulfill({ status: 200, body: JSON.stringify({ ok: true }) });
    } else {
      void route.continue();
    }
  });

  await banner.getByRole('button', { name: /accept all/i }).click();

  // Banner should disappear after the POST succeeds
  await expect(banner).not.toBeVisible({ timeout: 5_000 });

  expect(consoleErrors, `Uncaught console errors: ${consoleErrors.join('; ')}`).toHaveLength(0);

  await context.close();
});

// ── 4. Decline-all ────────────────────────────────────────────────────────────

test('decline all dismisses the cookie banner', async ({ browser }) => {
  const context = await browser.newContext({ storageState: undefined });
  const page = await context.newPage();

  const consoleErrors: string[] = [];
  page.on('console', (msg) => {
    if (msg.type() === 'error' && !isKnownNoise(msg.text())) {
      consoleErrors.push(msg.text());
    }
  });

  await page.goto('/login', { waitUntil: 'networkidle' });

  const banner = page.getByRole('dialog', { name: /cookie consent/i });
  await banner.waitFor({ state: 'visible', timeout: 8_000 });

  await page.route('/cookie-consent', (route) => {
    if (route.request().method() === 'POST') {
      void route.fulfill({ status: 200, body: JSON.stringify({ ok: true }) });
    } else {
      void route.continue();
    }
  });

  await banner.getByRole('button', { name: /^decline$/i }).click();

  await expect(banner).not.toBeVisible({ timeout: 5_000 });

  expect(consoleErrors, `Uncaught console errors: ${consoleErrors.join('; ')}`).toHaveLength(0);

  await context.close();
});

// ── 5. Customize panel: granular preferences ──────────────────────────────────

test('customize panel opens and saves granular preferences', async ({ browser }) => {
  const context = await browser.newContext({ storageState: undefined });
  const page = await context.newPage();

  const consoleErrors: string[] = [];
  page.on('console', (msg) => {
    if (msg.type() === 'error' && !isKnownNoise(msg.text())) {
      consoleErrors.push(msg.text());
    }
  });

  await page.goto('/login', { waitUntil: 'networkidle' });

  const banner = page.getByRole('dialog', { name: /cookie consent/i });
  await banner.waitFor({ state: 'visible', timeout: 8_000 });

  // Open customize panel
  await banner.getByRole('button', { name: /customize/i }).click();

  // Customize panel should be visible
  const panel = page.locator('#cookie-customize-panel');
  await expect(panel).toBeVisible();

  // Necessary cookies switch is disabled (always on)
  const necessarySwitch = panel.getByRole('switch', { name: /necessary cookies/i });
  await expect(necessarySwitch).toBeDisabled();

  // Analytics and marketing toggles are present
  const analyticsSwitch = panel.getByRole('switch', { name: /analytics cookies/i });
  const marketingSwitch = panel.getByRole('switch', { name: /marketing cookies/i });
  await expect(analyticsSwitch).toBeVisible();
  await expect(marketingSwitch).toBeVisible();

  // Toggle analytics on
  await analyticsSwitch.click();
  await expect(analyticsSwitch).toBeChecked();

  // Mock POST success
  await page.route('/cookie-consent', (route) => {
    if (route.request().method() === 'POST') {
      void route.fulfill({ status: 200, body: JSON.stringify({ ok: true }) });
    } else {
      void route.continue();
    }
  });

  await panel.getByRole('button', { name: /save preferences/i }).click();

  // Banner dismisses after save
  await expect(banner).not.toBeVisible({ timeout: 5_000 });

  expect(consoleErrors, `Uncaught console errors: ${consoleErrors.join('; ')}`).toHaveLength(0);

  await context.close();
});

// ── 6. Privacy page: disableGlobalUi = true → NO banner ──────────────────────

test('privacy page does not show the cookie consent banner (disableGlobalUi)', async ({ browser }) => {
  // First-visit context (no consent cookie) — banner would appear on auth/dashboard pages
  const context = await browser.newContext({ storageState: undefined });
  const page = await context.newPage();

  await page.goto('/privacy', { waitUntil: 'networkidle' });

  // Privacy page uses disableGlobalUi = true — banner MUST NOT appear
  const banner = page.getByRole('dialog', { name: /cookie consent/i });
  await expect(banner).not.toBeVisible({ timeout: 3_000 });

  // Page content still renders correctly
  await expect(page.getByRole('heading', { name: 'Privacy Policy', level: 1 })).toBeVisible();

  await context.close();
});

// ── 7. POST failure → inline error + retry (GDPR Art. 7 compliance) ──────────

test('banner shows inline error and retry when consent POST fails', async ({ browser }) => {
  const context = await browser.newContext({ storageState: undefined });
  const page = await context.newPage();

  const consoleErrors: string[] = [];
  page.on('console', (msg) => {
    if (msg.type() === 'error' && !isKnownNoise(msg.text()) && !isInjectedNetworkError(msg.text())) {
      consoleErrors.push(msg.text());
    }
  });

  await page.goto('/login', { waitUntil: 'networkidle' });

  const banner = page.getByRole('dialog', { name: /cookie consent/i });
  await banner.waitFor({ state: 'visible', timeout: 8_000 });

  // Force the POST to fail
  await page.route('/cookie-consent', (route) => {
    if (route.request().method() === 'POST') {
      void route.fulfill({ status: 500, body: 'Server error' });
    } else {
      void route.continue();
    }
  });

  await banner.getByRole('button', { name: /accept all/i }).click();

  // Banner stays open (GDPR compliance — cannot silently drop consent recording)
  await expect(banner).toBeVisible({ timeout: 3_000 });

  // Inline error message appears
  const errorAlert = banner.getByRole('alert');
  await expect(errorAlert).toBeVisible({ timeout: 5_000 });
  await expect(errorAlert).toContainText(/couldn.*t save your preference/i);

  // Retry button is present and clickable
  await expect(banner.getByRole('button', { name: /retry/i })).toBeVisible();

  // No application-level console errors (component handles failure gracefully)
  expect(consoleErrors, `Uncaught console errors: ${consoleErrors.join('; ')}`).toHaveLength(0);

  await context.close();
});

// ── 8. GPC (Global Privacy Control) signal — cookieConsent.ts COMPLY-008 ─────
// When navigator.globalPrivacyControl === true, getConsentStatus() returns
// 'declined' (not null), so the banner MUST NOT appear even on a fresh visit.
// This is a GDPR/CCPA compliance requirement.

test('GPC signal suppresses cookie consent banner (COMPLY-008)', async ({ browser }) => {
  // Fresh context — no cookies
  const context = await browser.newContext({ storageState: undefined });
  const page = await context.newPage();

  // Inject GPC signal BEFORE the page loads so navigator.globalPrivacyControl is
  // already set when React mounts and calls getConsentStatus().
  await page.addInitScript(() => {
    Object.defineProperty(navigator, 'globalPrivacyControl', {
      value: true,
      writable: false,
      configurable: true,
    });
  });

  const consoleErrors: string[] = [];
  page.on('console', (msg) => {
    if (msg.type() === 'error' && !isKnownNoise(msg.text())) {
      consoleErrors.push(msg.text());
    }
  });

  await page.goto('/login', { waitUntil: 'networkidle' });

  // Banner MUST NOT appear — GPC overrides any stored preference and
  // getConsentStatus() returns 'declined', so setVisible(true) is never called.
  const banner = page.getByRole('dialog', { name: /cookie consent/i });
  await expect(banner).not.toBeVisible({ timeout: 4_000 });

  // Page still renders correctly (login form — button is "Sign in")
  await expect(page.getByRole('button', { name: /sign in/i })).toBeVisible();

  expect(consoleErrors, `Uncaught console errors: ${consoleErrors.join('; ')}`).toHaveLength(0);

  await context.close();
});