import {chromium,expect} from '@playwright/test';
import fs from 'node:fs/promises';
import assert from 'node:assert/strict';
import {createHash} from 'node:crypto';
const base=new URL(process.env.TIMEWEB_BASE_URL||'https://app.caterium.ru');
assert.equal(base.href,'https://app.caterium.ru/');
const output='production-ui-results';await fs.mkdir(output,{recursive:true});
const browser=await chromium.launch(),results=[];
try{
 for(const width of [390,1440]){
  const context=await browser.newContext({viewport:{width,height:900},serviceWorkers:'block'});
  try{
   const page=await context.newPage();
   await page.route('**/*',r=>{const u=new URL(r.request().url());return r.request().method()==='GET'&&u.origin===base.origin&&!u.pathname.startsWith('/api/')?r.continue():r.abort();});
   await page.goto(base.href,{waitUntil:'domcontentloaded'});
   await page.getByRole('button',{name:'Помощь со входом',exact:true}).click();
   await page.locator('#ctContactTab').click();await expect(page.locator('#ctContactForm')).toBeVisible();
   await expect(page.locator('#ctContactSection')).toContainText('support@caterium.ru');
   assert(await page.locator('#ctContactForm').evaluate(el=>el.scrollWidth<=el.clientWidth));
   await page.screenshot({path:`${output}/support-form-${width}.png`,animations:'disabled'});
   results.push({width,form:true,recipient:'support@caterium.ru',draftOnly:true});
  }finally{await context.close();}
 }
 const context=await browser.newContext();
 try{
  for(const path of ['core/help-center.js','core/support-form.js']){
   const response=await context.request.get(new URL(path+'?verification='+Date.now(),base).href,{headers:{'Cache-Control':'no-cache'}});assert.equal(response.status(),200);
   const local=await fs.readFile('public/'+path);assert.equal(createHash('sha256').update(await response.body()).digest('hex'),createHash('sha256').update(local).digest('hex'));
  }
  // No real message is sent. Check the live PHP/session contract and that a
  // cross-origin request cannot reach mail(). Inbox delivery is a separate check.
  const response=await context.request.get(new URL('api/support.php',base).href);
  assert.equal(response.status(),200);assert.match(response.headers()['cache-control'],/no-store/);
  const data=await response.json();assert.equal(data.recipient,'support@caterium.ru');assert.match(data.csrf,/^[a-f0-9]{64}$/);
  const rejected=await context.request.post(new URL('api/support.php',base).href,{headers:{Origin:'https://example.invalid'},data:{}});assert.equal(rejected.status(),403);
  await fs.writeFile(`${output}/support-form.json`,JSON.stringify({checkedAt:new Date().toISOString(),results,phpSessionEndpoint:true,crossOriginBlocked:true,realEmailSent:false,inboxDeliveryVerified:false},null,2));
 }finally{await context.close();}
}finally{await browser.close();}