// Standards-shaped loopback test IdP, never shipped in the mobile apps.
// It validates single-use codes, exact redirect URI, Basic client auth and S256
// PKCE, and signs real RS256 ID tokens containing the original nonce.
import https from 'node:https';
import { createHash, generateKeyPairSync, randomBytes, sign } from 'node:crypto';
import { once } from 'node:events';

export async function startIdentityProvider(tls) {
  const clientId = 'mobile-test-client';
  const secret = randomBytes(32).toString('hex');
  const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
  const key = { ...publicKey.export({ format: 'jwk' }), kid: 'fixture-key', alg: 'RS256', use: 'sig' };
  const codes = new Map();
  const access = new Set();
  const authenticatesClient = header => {
    if (!/^Basic /i.test(header || '')) return false;
    const decoded = Buffer.from(header.slice(6), 'base64').toString('utf8');
    const separator = decoded.indexOf(':');
    const formDecode = value => decodeURIComponent(value.replace(/\+/g, ' '));
    try {
      return separator >= 0 && formDecode(decoded.slice(0, separator)) === clientId &&
        formDecode(decoded.slice(separator + 1)) === secret;
    } catch { return false; }
  };
  let issuer;
  let redirect;
  const profile = { sub: 'mobile-oidc-subject', preferred_username: 'mobile-oidc', name: 'Mobile OIDC Test',
    email: 'mobile-test@example.invalid', email_verified: true };
  const json = (response, status, data) => {
    response.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
    response.end(JSON.stringify(data));
  };
  const idp = https.createServer(tls, async (request, response) => {
    const url = new URL(request.url, issuer);
    if (url.pathname === '/.well-known/openid-configuration') {
      return json(response, 200, { issuer, authorization_endpoint: issuer + '/authorize',
        token_endpoint: issuer + '/token', userinfo_endpoint: issuer + '/userinfo', jwks_uri: issuer + '/jwks',
        response_types_supported: ['code'], subject_types_supported: ['public'],
        id_token_signing_alg_values_supported: ['RS256'], token_endpoint_auth_methods_supported: ['client_secret_basic'],
        code_challenge_methods_supported: ['S256'] });
    }
    if (url.pathname === '/jwks') return json(response, 200, { keys: [key] });
    if (url.pathname === '/authorize') {
      const parameters = url.searchParams;
      if (parameters.get('client_id') !== clientId || parameters.get('redirect_uri') !== redirect ||
          parameters.get('code_challenge_method') !== 'S256' || !parameters.get('state') || !parameters.get('nonce')) {
        return json(response, 400, { error: 'invalid_request' });
      }
      const code = randomBytes(24).toString('hex');
      codes.set(code, { challenge: parameters.get('code_challenge'), nonce: parameters.get('nonce'), expires: Date.now() + 60_000 });
      const callback = new URL(redirect);
      callback.searchParams.set('code', code); callback.searchParams.set('state', parameters.get('state'));
      response.writeHead(302, { Location: callback.href, 'Cache-Control': 'no-store' }); response.end(); return;
    }
    if (url.pathname === '/token' && request.method === 'POST') {
      let body = '';
      for await (const chunk of request) { body += chunk; if (body.length > 8192) return json(response, 413, {}); }
      const parameters = new URLSearchParams(body);
      const code = parameters.get('code'); const grant = codes.get(code); codes.delete(code);
      if (!grant || grant.expires < Date.now() || parameters.get('grant_type') !== 'authorization_code' ||
          parameters.get('redirect_uri') !== redirect || !authenticatesClient(request.headers.authorization) ||
          createHash('sha256').update(parameters.get('code_verifier') || '').digest('base64url') !== grant.challenge) {
        console.error('Test IdP grant rejected:', JSON.stringify({
          knownCode: !!grant, expired: !!grant && grant.expires < Date.now(),
          redirectMatches: parameters.get('redirect_uri') === redirect,
          clientMatches: authenticatesClient(request.headers.authorization),
          pkceMatches: !!grant && createHash('sha256').update(parameters.get('code_verifier') || '').digest('base64url') === grant.challenge,
        }));
        return json(response, 400, { error: 'invalid_grant' });
      }
      const header = Buffer.from(JSON.stringify({ alg: 'RS256', kid: key.kid, typ: 'JWT' })).toString('base64url');
      const payload = Buffer.from(JSON.stringify({ iss: issuer, aud: clientId, sub: profile.sub, nonce: grant.nonce,
        iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 60 })).toString('base64url');
      const token = randomBytes(24).toString('hex'); access.add(token);
      const signature = sign('RSA-SHA256', Buffer.from(header + '.' + payload), privateKey).toString('base64url');
      return json(response, 200, { access_token: token, token_type: 'Bearer', expires_in: 60, id_token: header + '.' + payload + '.' + signature });
    }
    if (url.pathname === '/userinfo' && access.has(request.headers.authorization?.replace(/^Bearer /, ''))) {
      return json(response, 200, profile);
    }
    json(response, 404, { error: 'not_found' });
  });
  idp.listen(0, '127.0.0.1'); await once(idp, 'listening');
  issuer = 'https://127.0.0.1:' + idp.address().port;
  return { issuer, clientId, secret, port: idp.address().port, setRedirect(value) { redirect = value; }, close() { idp.close(); } };
}