/**
 * Platform Verification Plan — ref AS/AEGIS-CYBER/VERIFY/2026/001
 * VF-S5: KYT durable-persistence FIX — LIVE DEMONSTRATION (3-leg)
 *
 * Companion to scripts/vf-s5-kyt197-demonstration.ts (which empirically proved
 * the ORIGINAL hole: fire-and-forget persist omitted tenantId → NULL tenant_id
 * → RLS WITH CHECK reject → record silently lost). This script demonstrates the
 * FIX exercising the REAL exported functions and the REAL middleware — NOT a
 * code-read. Spec: VF_S5_KYT_PERSISTENCE_FIX_DESIGN_BRIEF.md §7 (3-leg) + §9
 * (acceptance) + §4A (trade-off honesty).
 *
 * Three legs:
 *   Leg 1 — POSITIVE, through the REAL running server (:5000): seed a user,
 *           log in over HTTP, mint CSRF, POST /api/kyt/analyze, then read the
 *           row back through an INDEPENDENT owner connection and assert it
 *           landed durably with the correct non-NULL tenant_id.
 *   Leg 2 — NEGATIVE, in-process, asserted via getKYTStats() counter deltas:
 *           (a) drop-gate — no authorized tenant (undefined / "default") →
 *               persistFailures++, returns false, NO row.
 *           (b) DB-error — numeric overflow inside the savepoint →
 *               persistFailures++, returns false, NO row, AND the OUTER request
 *               tx survives (savepoint-contained, proven by a follow-on query).
 *   Leg 3 — TRADE-OFF, minimal in-script Express app wired to the REAL
 *           tenantMiddleware + REAL persistKytResultDurable + REAL
 *           observeKytPersistCommitFate, with a DEMO-ONLY fault injected in THIS
 *           SCRIPT (never in kyt-engine.ts or routes.ts):
 *           (a) 5xx — handler returns 500 after a successful persist →
 *               middleware onFinish ROLLBACK + observer persistRollbacks++ →
 *               persisted-then-rolled-back row is absent.
 *           (b) abort — client disconnects before finish after a successful
 *               persist → middleware onClose ROLLBACK + observer
 *               persistRollbacks++ (!writableFinished) → row absent.
 *
 * FAITHFULNESS NOTES (Rule 5 / Rule 19 — claims tagged by HOW verified):
 *   - Legs 2 & 3 reproduce the request runtime with `withRequestTx`, which
 *     mirrors tenant-middleware exactly: `db.transaction(tx => { set GUC LOCAL;
 *     tenantContext.run({runner: tx}, fn) })`. The top-level db.transaction
 *     checks out an appPool (aegis_app, RLS-enforced) client and BEGINs; the
 *     ALS runner is the real PgTransaction, so persistKytResultDurable's inner
 *     db.transaction() nests as a real SAVEPOINT on the SAME connection — the
 *     exact mechanism under test. (The kyt197 harness used makeClientRunner +
 *     raw BEGIN, which double-BEGINs and breaks savepoint nesting; that shape is
 *     deliberately NOT used here.)
 *   - The §4A "abort-AFTER-commit" race (commit succeeds, then the client never
 *     receives the response) is NOT deterministically reproducible in this
 *     harness and is recorded honestly as such — NOT glossed as passing.
 *
 * Connections:
 *   - owner   = pg.Pool on DATABASE_URL (dev DB owner; BYPASSRLS; independent
 *               out-of-band observer for seed / read-back / cleanup).
 *   - real    = the imported functions + middleware, which use appPool
 *               (aegis_app restricted role; RLS-enforced) via the `db` proxy.
 *
 * Side-effect discipline: imports only db, tenant-middleware, and kyt-engine —
 * NOT server/index.ts or server/routes.ts (no server/scheduler boot).
 */

import pg from "pg";
import bcrypt from "bcryptjs";
import express from "express";
import { once } from "node:events";
import { randomUUID } from "node:crypto";
import { sql } from "drizzle-orm";
import { db, appPool, ddlPool, tenantContext, type DrizzleDb } from "../server/db";
import { tenantMiddleware } from "../server/lib/tenant-middleware";
import {
  analyzeTransaction,
  recordKYTResult,
  persistKytResultDurable,
  observeKytPersistCommitFate,
  getKYTStats,
  type TransactionContext,
} from "../server/lib/kyt-engine";

const owner = new pg.Pool({ connectionString: process.env.DATABASE_URL });

const SERVER = "http://127.0.0.1:5000";
const DEMO_TENANT = "aegis-sovereign"; // a real dev tenant (seeded on boot)
const base = Date.now() * 100;
const uid = (n: number) => base + n; // numeric sentinel userId
const ustr = (n: number) => String(base + n); // its stored string form
const SENTINELS = [1, 20, 22, 30, 31];

const settle = (ms = 1500) => new Promise((r) => setTimeout(r, ms));

async function countByUser(u: string): Promise<number> {
  const r = await owner.query<{ n: string }>(
    "SELECT count(*)::int AS n FROM kyt_results WHERE user_id = $1",
    [u],
  );
  return Number(r.rows[0].n);
}

async function tenantsByUser(u: string): Promise<(string | null)[]> {
  const r = await owner.query<{ tenant_id: string | null }>(
    "SELECT tenant_id FROM kyt_results WHERE user_id = $1",
    [u],
  );
  return r.rows.map((x) => x.tenant_id);
}

function validCtx(n: number, amount = 250_000): TransactionContext {
  return {
    userId: uid(n),
    amount,
    currency: "UGX",
    recipientId: "vf-s5-recipient",
    recipientType: "KNOWN",
    channel: "WEB",
    timeOfDay: 12,
    isRecurring: false,
  };
}

/** Faithful request runtime: top-level db.transaction (appPool / aegis_app,
 *  RLS-enforced) + LOCAL tenant GUC + tenantContext ALS active, exactly as
 *  tenantMiddleware does. The ALS runner is the real PgTransaction, so the
 *  inner db.transaction() inside persistKytResultDurable nests as a SAVEPOINT. */
async function withRequestTx<T>(
  tenantId: string,
  fn: () => Promise<T>,
): Promise<T> {
  return await db.transaction(async (tx) => {
    await tx.execute(
      sql`SELECT set_config('app.current_tenant_id', ${tenantId}, true)`,
    );
    return await tenantContext.run(
      { runner: tx as unknown as DrizzleDb, tenantId },
      fn,
    );
  });
}

// ── minimal cookie jar (Node fetch / undici getSetCookie) ────────────────────
class Jar {
  private cookies = new Map<string, string>();
  ingest(res: Response) {
    const setCookies =
      (res.headers as unknown as { getSetCookie?: () => string[] }).getSetCookie?.() ??
      [];
    for (const sc of setCookies) {
      const pair = sc.split(";")[0];
      const idx = pair.indexOf("=");
      if (idx > 0)
        this.cookies.set(pair.slice(0, idx).trim(), pair.slice(idx + 1).trim());
    }
  }
  header(): string {
    return [...this.cookies.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
  }
  get size() {
    return this.cookies.size;
  }
}

interface LegResult {
  id: string;
  scenario: string;
  expectation: string;
  observed: string;
  verdict: string;
  pass: boolean;
}
const results: LegResult[] = [];
const rec = (r: LegResult) => results.push(r);

// ─────────────────────────────────────────────────────────────────────────────
// LEG 1 — POSITIVE through the REAL running server (:5000)
// ─────────────────────────────────────────────────────────────────────────────
async function leg1(): Promise<string | null> {
  const demoUserId = randomUUID();
  const demoUsername = `vf-s5-demo-${base}`;
  const demoPassword = `Vf!S5-${base}-Demo`;
  const demoHash = bcrypt.hashSync(demoPassword, 10);

  // seed via owner (BYPASSRLS): users + primary UTR on the real dev tenant.
  await owner.query(
    `INSERT INTO users (id, username, password, role, full_name, is_active)
     VALUES ($1, $2, $3, 'admin', 'VF-S5 Demo User', true)`,
    [demoUserId, demoUsername, demoHash],
  );
  await owner.query(
    `INSERT INTO user_tenant_roles (user_id, tenant_id, role, is_active, is_primary)
     VALUES ($1, $2, 'admin', true, true)`,
    [demoUserId, DEMO_TENANT],
  );

  const jar = new Jar();
  // Distinct X-Forwarded-For so this harness gets its OWN rate-limit bucket.
  // The dev server runs `app.set("trust proxy", 1)`, so a direct localhost
  // connection that sets XFF has req.ip resolved to the XFF value. The browser
  // preview shares the 127.0.0.1 bucket and floods the api limiter (100/60s);
  // isolating onto a documentation IP (RFC 5737 TEST-NET-3) keeps the single
  // pre-auth login POST off that saturated bucket. Pure harness concern — no
  // product code changes.
  const HARNESS_XFF = "203.0.113.55";
  try {
    // 1) login (CSRF-exempt)
    const loginRes = await fetch(`${SERVER}/api/auth/login`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-forwarded-for": HARNESS_XFF,
      },
      body: JSON.stringify({ username: demoUsername, password: demoPassword }),
    });
    jar.ingest(loginRes);
    const loginJson: any = await loginRes.json().catch(() => ({}));
    if (loginRes.status !== 200 || loginJson?.success !== true) {
      rec({
        id: "L1",
        scenario: "real server :5000 — login → csrf → POST /api/kyt/analyze",
        expectation:
          "row persists durably with non-NULL tenant_id = aegis-sovereign",
        observed: `login HTTP ${loginRes.status} ${JSON.stringify(loginJson).slice(0, 160)}`,
        verdict: "FAIL (could not authenticate seeded user)",
        pass: false,
      });
      return demoUserId;
    }

    // 2) mint CSRF on the authenticated session
    const csrfRes = await fetch(`${SERVER}/api/csrf-token`, {
      headers: { cookie: jar.header(), "x-forwarded-for": HARNESS_XFF },
    });
    jar.ingest(csrfRes);
    const csrfJson: any = await csrfRes.json().catch(() => ({}));
    const csrfToken: string = csrfJson?.csrfToken;

    // 3) POST the real KYT analyze route (requireAuth + CSRF + tenantMiddleware)
    const analyzeRes = await fetch(`${SERVER}/api/kyt/analyze`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        cookie: jar.header(),
        "x-csrf-token": csrfToken,
        "x-forwarded-for": HARNESS_XFF,
      },
      body: JSON.stringify(validCtx(1)),
    });
    const analyzeJson: any = await analyzeRes.json().catch(() => ({}));

    await settle(1500); // let the request commit before reading back

    // 4) independent owner read-back
    const tids = await tenantsByUser(ustr(1));
    const pass =
      analyzeRes.status === 200 &&
      tids.length === 1 &&
      tids[0] === DEMO_TENANT;
    rec({
      id: "L1",
      scenario: "real server :5000 — login → csrf → POST /api/kyt/analyze",
      expectation:
        "HTTP 200; exactly 1 kyt_results row; tenant_id = aegis-sovereign (non-NULL)",
      observed: `analyze HTTP ${analyzeRes.status} (risk=${analyzeJson?.riskLevel ?? "?"}); rows=${tids.length}; tenant_ids=${JSON.stringify(tids)}`,
      verdict: pass
        ? "PASS (fix persists durably through the real route — row read back independently)"
        : "FAIL (row absent / wrong tenant_id)",
      pass,
    });
  } catch (e: any) {
    rec({
      id: "L1",
      scenario: "real server :5000 — login → csrf → POST /api/kyt/analyze",
      expectation: "row persists durably with tenant_id = aegis-sovereign",
      observed: `EXCEPTION ${e?.message ?? String(e)} (is the dev server running on :5000?)`,
      verdict: "FAIL (harness/connectivity error)",
      pass: false,
    });
  }
  return demoUserId;
}

// ─────────────────────────────────────────────────────────────────────────────
// LEG 2 — NEGATIVE, in-process, asserted via getKYTStats() deltas
// ─────────────────────────────────────────────────────────────────────────────
async function leg2() {
  // 2(a) — drop-gate: no authorized tenant (undefined and "default")
  {
    const result = analyzeTransaction(validCtx(20));
    const ctx = validCtx(20);
    const before = getKYTStats().persistFailures;
    const okUndef = await persistKytResultDurable(result, ctx, undefined);
    const okDefault = await persistKytResultDurable(result, ctx, "default");
    const after = getKYTStats().persistFailures;
    const n = await countByUser(ustr(20));
    const pass =
      okUndef === false &&
      okDefault === false &&
      after - before === 2 &&
      n === 0;
    rec({
      id: "L2a",
      scenario: "drop-gate — persistKytResultDurable(undefined) and (\"default\")",
      expectation:
        "both return false; persistFailures += 2; NO row written (fail-closed, no NULL/garbage row)",
      observed: `returned [undefined→${okUndef}, "default"→${okDefault}]; persistFailures Δ=${after - before}; rows=${n}`,
      verdict: pass
        ? "PASS (unauthorized tenant drops the write, counted, no row)"
        : "FAIL",
      pass,
    });
  }

  // 2(b) — DB-error: numeric overflow inside the savepoint; outer tx survives
  {
    const ctxOver = validCtx(22, 1e20); // String(1e20) = 21 digits > numeric(20,2)
    const result = analyzeTransaction(ctxOver);
    const before = getKYTStats().persistFailures;
    let okOver: boolean | string = "n/a";
    let outerAlive = false;
    let outerProbeErr = "";
    await withRequestTx(DEMO_TENANT, async () => {
      okOver = await persistKytResultDurable(result, ctxOver, DEMO_TENANT);
      // If the savepoint did NOT contain the failure, the outer tx would be
      // aborted and this follow-on query would throw "current transaction is
      // aborted". It succeeding proves savepoint-containment.
      try {
        await db.execute(sql`SELECT 1 AS ok`);
        outerAlive = true;
      } catch (e: any) {
        outerProbeErr = e?.message ?? String(e);
      }
    });
    const after = getKYTStats().persistFailures;
    const n = await countByUser(ustr(22));
    const pass =
      okOver === false && after - before === 1 && outerAlive === true && n === 0;
    rec({
      id: "L2b",
      scenario:
        "DB-error — numeric overflow inside savepoint (tenant authorized, GUC matches)",
      expectation:
        "returns false; persistFailures += 1; NO row; OUTER request tx survives (savepoint-contained)",
      observed: `returned=${okOver}; persistFailures Δ=${after - before}; outerTxAlive=${outerAlive}${outerProbeErr ? " (" + outerProbeErr + ")" : ""}; rows=${n}`,
      verdict: pass
        ? "PASS (insert failure contained in savepoint, counted, swallowed; request unharmed)"
        : "FAIL",
      pass,
    });
  }
}

// ─────────────────────────────────────────────────────────────────────────────
// LEG 3 — TRADE-OFF: real middleware + observer + DEMO-ONLY fault (in THIS script)
// ─────────────────────────────────────────────────────────────────────────────
async function leg3() {
  if (process.env.NODE_ENV === "production") {
    rec({
      id: "L3",
      scenario: "fault-injection harness",
      expectation: "runs in a non-production environment",
      observed: "NODE_ENV=production — fault injection is gated off; leg skipped",
      verdict: "SKIP",
      pass: false,
    });
    return;
  }

  const app = express();
  app.use(express.json());
  // inject a session BEFORE tenantMiddleware so Source 2 (session) resolves the
  // tenant exactly as the real authenticated flow does (x-tenant-id header
  // source was removed in T002.5 Operation 1).
  app.use((req, _res, next) => {
    (req as any).session = { tenantId: DEMO_TENANT, userId: "vf-s5-leg3" };
    next();
  });
  app.use("/api", tenantMiddleware); // faithful mount (baseUrl="/api")
  app.post("/api/kyt/analyze-faulttest", async (req, res) => {
    try {
      const result = analyzeTransaction(req.body);
      recordKYTResult(result);
      const tid = (req as any).tenantId as string | undefined;
      const persisted = await persistKytResultDurable(result, req.body, tid);
      if (persisted) observeKytPersistCommitFate(res, result, tid);

      // DEMO-ONLY fault injection — lives ONLY in this script, dev-gated.
      const fault =
        process.env.NODE_ENV !== "production"
          ? process.env.KYT_FAULT_INJECT
          : undefined;
      if (fault === "5xx") {
        res
          .status(500)
          .json({ injected: "5xx", persisted, transactionId: result.transactionId });
        return;
      }
      if (fault === "abort") {
        return; // never respond; client aborts → res 'close' → onClose rollback
      }
      res.json({ injected: null, persisted, transactionId: result.transactionId });
    } catch (e: any) {
      res.status(500).json({ error: e?.message ?? String(e) });
    }
  });

  const server = app.listen(0);
  await once(server, "listening");
  const port = (server.address() as { port: number }).port;
  const L3 = `http://127.0.0.1:${port}`;

  try {
    // 3(a) — 5xx variant (deterministic): persist succeeds, then 500 → rollback
    {
      process.env.KYT_FAULT_INJECT = "5xx";
      const before = getKYTStats();
      const res3a = await fetch(`${L3}/api/kyt/analyze-faulttest`, {
        method: "POST",
        headers: { "content-type": "application/json" },
        body: JSON.stringify(validCtx(30)),
      });
      const body3a: any = await res3a.json().catch(() => ({}));
      await settle(1500); // let 'finish' fire → middleware rollback + observer
      const after = getKYTStats();
      const n = await countByUser(ustr(30));
      const pass =
        res3a.status === 500 &&
        body3a?.persisted === true &&
        after.persistRollbacks - before.persistRollbacks === 1 &&
        after.persistFailures - before.persistFailures === 0 &&
        n === 0;
      rec({
        id: "L3a",
        scenario: "5xx after successful persist (onFinish ROLLBACK path)",
        expectation:
          "persisted=true; persistRollbacks += 1; persistFailures += 0; row ABSENT (rolled back with request)",
        observed: `HTTP ${res3a.status}; persisted=${body3a?.persisted}; rollbacks Δ=${after.persistRollbacks - before.persistRollbacks}; failures Δ=${after.persistFailures - before.persistFailures}; rows=${n}`,
        verdict: pass
          ? "PASS (persisted-then-rolled-back observed; row gone; counter fired)"
          : "FAIL",
        pass,
      });
    }

    // 3(b) — abort variant (client disconnect before finish; onClose ROLLBACK)
    {
      process.env.KYT_FAULT_INJECT = "abort";
      const before = getKYTStats();
      const ac = new AbortController();
      const pending = fetch(`${L3}/api/kyt/analyze-faulttest`, {
        method: "POST",
        headers: { "content-type": "application/json" },
        body: JSON.stringify(validCtx(31)),
        signal: ac.signal,
      })
        .then(() => "completed")
        .catch((e) => `aborted:${e?.name ?? "err"}`);
      await settle(1200); // persist completes + observer arms before we abort
      ac.abort();
      const outcome = await pending;
      await settle(1500); // server detects 'close' → middleware rollback + observer
      const after = getKYTStats();
      const n = await countByUser(ustr(31));
      const pass =
        outcome.startsWith("aborted") &&
        after.persistRollbacks - before.persistRollbacks === 1 &&
        after.persistFailures - before.persistFailures === 0 &&
        n === 0;
      rec({
        id: "L3b",
        scenario: "client abort before finish after successful persist (onClose ROLLBACK path)",
        expectation:
          "persistRollbacks += 1 (!writableFinished); persistFailures += 0; row ABSENT",
        observed: `client=${outcome}; rollbacks Δ=${after.persistRollbacks - before.persistRollbacks}; failures Δ=${after.persistFailures - before.persistFailures}; rows=${n}`,
        verdict: pass
          ? "PASS (abort-before-finish rolls the row back; onClose counter fired)"
          : "FAIL",
        pass,
      });
    }

    // §4A honesty: the abort-AFTER-commit race is not deterministically
    // reproducible in this harness — recorded as such, not asserted as passing.
    rec({
      id: "L3c",
      scenario: "§4A abort-AFTER-commit race (commit wins, client never receives response)",
      expectation: "documented trade-off; not a deterministic test target",
      observed:
        "NOT deterministically reproduced in this harness. Per design brief §4A the benign outcome (row stays committed once the outer tx COMMITs on finish<500) is by-design; the racy window is acknowledged, not falsely demonstrated.",
      verdict: "RECORDED (honest non-reproduction per Rule 19)",
      pass: true,
    });
  } finally {
    delete process.env.KYT_FAULT_INJECT;
    server.close();
    await once(server, "close").catch(() => {});
  }
}

async function main() {
  console.log("=".repeat(80));
  console.log("VF-S5 — KYT durable-persistence FIX — LIVE DEMONSTRATION (3-leg)");
  console.log(
    "ref AS/AEGIS-CYBER/VERIFY/2026/001 | env: DEV |",
    new Date().toISOString(),
  );
  console.log("=".repeat(80));

  let demoUserId: string | null = null;
  try {
    demoUserId = await leg1();
    await leg2();
    await leg3();
  } finally {
    // ── cleanup (owner bypasses RLS) ──
    try {
      const del = await owner.query(
        "DELETE FROM kyt_results WHERE user_id = ANY($1::text[])",
        [SENTINELS.map((n) => ustr(n))],
      );
      console.log(`\ncleanup: deleted ${del.rowCount} sentinel kyt_results row(s).`);
    } catch (e: any) {
      console.log(`cleanup kyt_results error: ${e?.message ?? e}`);
    }
    if (demoUserId) {
      for (const [label, q, p] of [
        ["user_tenant_roles", "DELETE FROM user_tenant_roles WHERE user_id = $1", [demoUserId]],
        ["sessions", "DELETE FROM sessions WHERE user_id = $1", [demoUserId]],
        ["users", "DELETE FROM users WHERE id = $1", [demoUserId]],
      ] as [string, string, any[]][]) {
        try {
          await owner.query(q, p);
        } catch (e: any) {
          console.log(`cleanup ${label} (non-fatal): ${e?.message ?? e}`);
        }
      }
    }
  }

  // ── report ──
  console.log("");
  for (const r of results) {
    console.log("-".repeat(80));
    console.log(`[${r.id}] ${r.scenario}`);
    console.log(`     expect  : ${r.expectation}`);
    console.log(`     observe : ${r.observed}`);
    console.log(`     VERDICT : ${r.verdict}`);
  }
  console.log("-".repeat(80));
  const passed = results.filter((r) => r.pass).length;
  const total = results.length;
  const allPass = results.every((r) => r.pass);
  console.log(
    `ACCEPTANCE (§9): ${passed}/${total} checks PASS — ${allPass ? "ALL PASS" : "SEE FAILURES ABOVE"}`,
  );
  console.log("=".repeat(80));

  await owner.end();
  await appPool.end();
  await ddlPool.end();
  process.exit(allPass ? 0 : 1);
}

main().catch(async (e) => {
  console.error("FATAL:", e);
  try {
    await owner.end();
  } catch {}
  try {
    await appPool.end();
  } catch {}
  try {
    await ddlPool.end();
  } catch {}
  process.exit(1);
});