import { test, before, after } from "node:test";
import assert from "node:assert/strict";
import { createServer, request as httpRequest } from "node:http";
import { spawn } from "node:child_process";
import { setTimeout as delay } from "node:timers/promises";
import { createHash } from "node:crypto";
import { rm, readFile } from "node:fs/promises";
const appContract = JSON.parse(
  await readFile(
    new URL("./fixtures/sgdj-app-contract.json", import.meta.url),
    "utf8",
  ),
).operations;
let strictContract = false;
import { join } from "node:path";

let mock,
  next,
  base,
  output = "";
let mockOrigin,
  seoSnapshotPath,
  configFailure = "";
let downloadAddress = "https://example.com/download";
let seoConfig = {},
  categories = [],
  listPayload,
  detailSeo;
let chapterPayload, videoPayload, chapterListPayload, commentPayload;
let tagOptionsPayload;
let requireSeoAuth = false,
  searchFailure = false,
  searchPayload;
let responseOverrides = {};
let upstreamKeySlash = false;
const defaultHeader = {
  categoryList: [
    { id: 1, name: "首页", urlValue: "", categoryType: 1 },
    { id: 2, name: "短剧", urlValue: "/shorts/", categoryType: 1 },
    { id: 3, name: "专题", urlValue: "/topics/", categoryType: 1 },
    { id: 4, name: "热榜", urlValue: "/hot", categoryType: 1 },
    { id: 5, name: "回家的路", urlValue: "", categoryType: 1 },
    { id: 6, name: "福利应用", urlValue: "", categoryType: 1 },
  ],
};
let headerPayload = defaultHeader,
  headerFailure = false;
let appsPayload, packagesPayload, accountListPayload, transactionsPayload;
let blockedDetail, footerPayload, themePayload, richTextPayload;
const calls = [];
const testEnvironment =
  process.env.TEST_APP_ENV === "test" ? "test" : "production";
const testBuildDirectory = testEnvironment === "test" ? ".next-test" : ".next";
const fixture = {
  id: 23456,
  title: "接口剧名 <script>alert(1)</script>",
  cover: "https://example.com/poster.webp",
  totalEpisode: 7,
  countLike: 1234,
  tagNames: ["都市"],
  showOnBanner: true,
};
let homePayload = {
  homeBannerData: [fixture],
  homeConfigData: [
    { id: 31, status: true, name: "后台配置标题", type: 1, list: [fixture] },
  ],
};
const playlist =
  '#EXTM3U\n#EXT-X-KEY:METHOD=AES-128,URI="/enkey?token=a%2Fb"\n#EXTINF:2,\nhttps://cdn.example/segment.ts?md=signed+value\n#EXT-X-ENDLIST\n';
async function listen(server) {
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
  return server.address().port;
}
function assertPageLinksHaveTrailingSlash(html) {
  for (const match of html.matchAll(
    /<a\b[^>]*\bhref="(\/[^"#?]*)(?:[?#][^"]*)?"/g,
  ))
    assert.ok(match[1].endsWith("/"), match[1]);
}

async function startNext(environment = {}) {
  const reservation = createServer();
  const port = await listen(reservation);
  await new Promise((resolve) => reservation.close(resolve));
  base = `http://127.0.0.1:${port}`;
  output = "";
  next = spawn(
    process.execPath,
    [
      "node_modules/next/dist/bin/next",
      "start",
      "--hostname",
      "0.0.0.0",
      "--port",
      String(port),
    ],
    {
      cwd: process.cwd(),
      env: {
        ...process.env,
        APP_ENV: testEnvironment,
        APP_DIST_DIR: testBuildDirectory,
        UPSTREAM_API_URL: mockOrigin,
        API_BASE_URL: "http://127.0.0.1:1",
        PUBLIC_DATA_CACHE_TTL_MS: "0",
        ...environment,
      },
      stdio: ["ignore", "pipe", "pipe"],
    },
  );
  next.stdout.on("data", (chunk) => {
    output += chunk.toString();
  });
  next.stderr.on("data", (chunk) => {
    output += chunk.toString();
  });
  for (let attempt = 0; attempt < 60; attempt++) {
    try {
      if ((await fetch(base + "/favicon.png")).ok) return;
    } catch {}
    if (next.exitCode !== null) throw new Error(output);
    await delay(100);
  }
  throw new Error("Test server did not start: " + output);
}

async function stopNext() {
  if (!next || next.exitCode !== null) return;
  const stopped = new Promise((resolve) => next.once("exit", resolve));
  next.kill("SIGTERM");
  await stopped;
}

test("deployment health endpoint bypasses guest creation, avoids redirects and never caches", async () => {
  for (const path of ["/healthz", "/healthz/"]) {
    const previous = calls.length;
    const response = await fetch(base + path, { redirect: "manual" });
    assert.equal(response.status, 200);
    assert.equal(response.headers.get("set-cookie"), null);
    assert.match(response.headers.get("cache-control"), /no-store/);
    assert.match(response.headers.get("x-robots-tag"), /noindex/);
    assert.deepEqual(await response.json(), {
      status: "ok",
      environment: testEnvironment,
      application: "jha-1050-jgdj-web",
    });
    assert.equal(calls.length, previous);
  }
  const head = await fetch(base + "/healthz", {
    method: "HEAD",
    redirect: "manual",
  });
  assert.equal(head.status, 200);
  assert.equal(await head.text(), "");
});

before(
  async () => {
    mock = createServer(async (request, response) => {
      let raw = "";
      for await (const chunk of request) raw += chunk;
      const url = new URL(request.url, "http://local");
      calls.push({
        path: url.pathname,
        search: url.search,
        method: request.method,
        auth: request.headers.authorization,
        cookie: request.headers.cookie,
        range: request.headers.range,
        device: request.headers["x-user-agent"],
        ua: request.headers["user-agent"],
        accept: request.headers.accept,
        contentType: request.headers["content-type"],
        ip: request.headers["x-real-ip"],
        forwarded: request.headers["x-forwarded-for"],
        sdk: request.headers["x-sdk-common"],
        trackerId: request.headers["x-tracker-request-id"],
        trackerEvent: request.headers["x-tracker-event-name"],
        trackerContext: request.headers["x-dc-request-context"],
        body: raw,
      });
      if (url.pathname.startsWith("/h5/m3u8/")) {
        if (url.pathname.endsWith("redirect.m3u8")) {
          response.writeHead(302, { Location: "/unexpected" });
          response.end();
          return;
        }
        if (url.pathname.endsWith("missing.m3u8")) {
          response.writeHead(404);
          response.end();
          return;
        }
        if (url.pathname.endsWith("denied.m3u8")) {
          response.writeHead(200, { "Content-Type": "application/json" });
          response.end(
            JSON.stringify({ code: 1000, msg: "expired signed URL" }),
          );
          return;
        }
        if (url.pathname.endsWith("invalid.m3u8")) {
          response.writeHead(200, { "Content-Type": "text/html" });
          response.end("<html>Error</html>");
          return;
        }
        if (url.pathname.endsWith(".ts")) {
          response.writeHead(206, {
            "Content-Type": "application/octet-stream",
            "Content-Range": "bytes 0-2/10",
            "Accept-Ranges": "bytes",
          });
          response.end(Buffer.from([9, 8, 7]));
          return;
        }
        response.writeHead(200, { "Content-Type": "application/octet-stream" });
        response.end(playlist);
        return;
      }
      if (
        ["/enkey", "/enkey/", "/newenkey", "/newenkey/"].includes(url.pathname)
      ) {
        const canonical =
          url.pathname.replace(/\/$/, "") + (upstreamKeySlash ? "/" : "");
        if (url.pathname !== canonical) {
          response.writeHead(301, { Location: canonical + url.search });
          response.end();
          return;
        }
        response.writeHead(200, { "Content-Type": "application/octet-stream" });
        response.end(
          url.searchParams.has("invalid")
            ? Buffer.from(JSON.stringify({ code: 1000, msg: "bad key" }))
            : Buffer.from(Array.from({ length: 16 }, (_, index) => index)),
        );
        return;
      }
      const path = url.pathname.replace("/api/app/", "");
      if (Object.hasOwn(responseOverrides, path)) {
        const {
          status = 200,
          code = 200,
          data = null,
          raw: overrideRaw,
        } = responseOverrides[path];
        response.writeHead(status, { "Content-Type": "application/json" });
        response.end(overrideRaw ?? JSON.stringify({ code, data }));
        return;
      }
      if (path === "playlet/detail" && blockedDetail)
        await blockedDetail.promise;
      if (strictContract) {
        const op = appContract[request.method + " " + path];
        const invalid =
          !op ||
          [...url.searchParams.keys()].some((key) => !op.query.includes(key)) ||
          op.requiredQuery.some((key) => !url.searchParams.has(key));
        if (invalid) {
          response.writeHead(400, { "Content-Type": "application/json" });
          response.end(
            JSON.stringify({
              code: 400,
              msg: "Undocumented endpoint or query",
              data: null,
            }),
          );
          return;
        }
      }
      let data = { list: [], totalCount: 0 };
      let code = 200;
      if (path === "auth/guest")
        data = {
          token: "test-session-secret",
          userId: 77,
          nickName: "真实接口用户",
          type: 0,
        };
      else if (path === "auth/login") {
        const body = JSON.parse(raw);
        if (body.account === "wrong") code = 1000;
        data = {
          ...(body.account === "missing-token"
            ? {}
            : { token: "test-registered-secret" }),
          userId: 88,
          nickName: "正式用户",
          type: 1,
          isRegister: true,
        };
      } else if (path === "auth/register")
        data = {
          token: "test-bound-secret",
          userId: 77,
          nickName: "绑定游客",
          type: 1,
          isRegister: true,
        };
      else if (path === "auth/getInfo") {
        if (request.headers.authorization === "expired") code = 1000;
        else if (request.headers.authorization === "test-session-secret")
          data = { userId: 77, nickName: "真实接口用户", type: 0, recharge: 90 };
        else if (request.headers.authorization === "test-registered-secret")
          data = { userId: 88, nickName: "正式用户", type: 1 };
        else if (request.headers.authorization === "http-expired") {
          response.writeHead(401, { "Content-Type": "application/json" });
          response.end(JSON.stringify({ code: 401, data: null }));
          return;
        } else if (
          request.headers.authorization === "registered-user-a-secret" ||
          request.headers.authorization === "registered-user-b-secret"
        ) {
          const first =
            request.headers.authorization === "registered-user-a-secret";
          data = {
            userId: first ? 101 : 202,
            nickName: first ? "用户甲" : "用户乙",
            recharge: first ? 111 : 222,
            type: 1,
            isRegister: true,
            token: request.headers.authorization,
            password: "must-not-leak",
          };
        } else
          data = {
            userId: 77,
            nickName: "接口昵称",
            token: "must-not-leak",
            recharge: 90,
          };
      } else if (path === "config/info")
        data = {
          seoInfo: { webSiteName: "禁果短剧" },
          ...seoConfig,
          config: {
            foreverUrlAddr: "https://default.drama.test",
            telegram: "https://example.com/contact",
            tgGroup: "https://example.com/group",
            twitterAddr: "https://example.com/twitter",
            officialAppAddr: downloadAddress,
            ...seoConfig.config,
          },
          navPageList: Object.hasOwn(seoConfig, "navPageList")
            ? seoConfig.navPageList
            : [
                { line: 2, url: "https://example.com/entry-two" },
                { line: 1, url: "https://example.com/entry-one" },
                { line: 3, url: "javascript:alert(1)" },
              ],
        };
      else if (path === "navigation/header") {
        data = headerPayload;
        if (headerFailure) code = 500;
      } else if (path === "config/footer/info" && footerPayload)
        data = footerPayload;
      else if (path === "config/richtext/list") {
        const titles = new Set(
          (url.searchParams.get("titles") || "")
            .split(",")
            .map((item) => item.trim())
            .filter(Boolean),
        );
        const list = Array.isArray(richTextPayload) ? richTextPayload : [];
        data = {
          list: titles.size
            ? list.filter((item) => titles.has(item.title))
            : list,
        };
      }
      else if (path === "translation/category/list")
        data = { categoryList: categories };
      else if (path === "theme/list")
        data = themePayload || {
          list: [7, 8, 10404].map((id) => ({
            id,
            name: "题材" + id,
            slug: id === 7 ? "urban-topic" : undefined,
          })),
        };
      else if (path === "applist/list" && appsPayload) data = appsPayload;
      else if (path === "recharge/package/list" && packagesPayload)
        data = packagesPayload;
      else if (
        [
          "playlet/history/list",
          "playlet/collect/list",
          "playlet/like/list",
          "playlet/bought/list",
        ].includes(path) &&
        accountListPayload
      )
        data =
          typeof accountListPayload === "function"
            ? accountListPayload(path, request)
            : accountListPayload;
      else if (path === "coin/trans/list" && transactionsPayload)
        data = transactionsPayload;
      else if (path === "playlet/home") data = homePayload;
      else if (path === "playlet/home-config/list") {
        const modules =
          homePayload.modules ||
          (homePayload.homeConfigData || [])
            .filter((block) => block && block.status)
            .map((block) => ({
              id: block.id,
              slug: block.slug,
              title: block.name,
              desc: block.desc,
              moduleType: block.type === 3 ? 2 : 1,
              list: block.list,
              topicList: block.themeList,
            }));
        const module = modules.find((item) =>
          url.searchParams.has("slug")
            ? item.slug === url.searchParams.get("slug")
            : item.id === Number(url.searchParams.get("id")),
        );
        if (!module) {
          code = 5009;
          data = null;
        } else {
          const page = Number(url.searchParams.get("pageNum") || 1),
            size = Number(url.searchParams.get("pageSize") || 24),
            items =
              (module.moduleType === 2 ? module.topicList : module.list) || [];
          data = {
            config: module,
            list:
              module.moduleType === 1
                ? items.slice((page - 1) * size, page * size)
                : [],
            topicList:
              module.moduleType === 2
                ? items.slice((page - 1) * size, page * size)
                : [],
            totalCount: items.length,
            pageNum: page,
            pageSize: size,
          };
        }
      } else if (path === "playlet/tag/options")
        data = tagOptionsPayload || { list: [{ id: 9, name: "测试标签" }] };
      else if (path === "playlet/search")
        data = JSON.stringify(
          searchPayload || {
            list: [fixture],
            totalCount: 1,
            pageNum: 1,
            pageSize: 24,
          },
        );
      else if (path === "playlet/guess-like/list")
        data = {
          list: [{ ...fixture, id: 23458, title: "同类推荐短剧" }],
          totalCount: 1,
        };
      else if (path === "playlet/detail")
        data = {
          ...fixture,
          ...detailSeo,
          isCollect: 2,
          isLike: 2,
          playletChapterInfo: [
            { id: 90001, currentEpisode: 1, canWatch: true },
          ],
        };
      else if (path === "video/detail" && videoPayload) data = videoPayload;
      else if (
        listPayload &&
        [
          "playlet/hot/rank/list",
          "playlet/topic/list",
          "playlet/topic/detail",
          "playlet/all/list",
          "playlet/operate/list",
          "playlet/tag/list",
        ].includes(path)
      )
        data =
          typeof listPayload === "function"
            ? listPayload(path, url)
            : listPayload;
      else if (path === "playlet/chapter/list")
        data = chapterListPayload || {
          list: [{ id: 90001, currentEpisode: 1, canWatch: true }],
        };
      else if (path === "playlet/chapter/detail")
        data = chapterPayload || {
          id: 90001,
          playletId: 23456,
          currentEpisode: 1,
          canWatch: false,
          needUnlock: true,
          singleCoins: 13,
          balance: 90,
        };
      else if (path === "playlet/chapter/unlock") {
        const body = JSON.parse(raw);
        data = { ...body, balance: 77 };
      } else if (path === "playlet/collect/set") {
        if (
          request.headers.authorization === "expired" ||
          JSON.parse(raw).id === 999
        )
          code = 1000;
        else data = { id: 23456, isCollect: 1, countCollect: 1 };
      } else if (path === "comment/list")
        data = commentPayload || { list: [], totalCount: 0 };
      if (path === "playlet/topic/detail" && !data.id) {
        const slug = url.searchParams.get("topicSlug");
        if (slug) {
          const topic = listPayload?.list?.find((item) => item.slug === slug);
          if (topic) data = { ...data, ...topic };
          else {
            code = 5009;
            data = null;
          }
        } else data = { ...data, id: Number(url.searchParams.get("id")) };
      }
      if (path === "playlet/search" && searchFailure) {
        code = 5100;
        data = null;
      }
      if (path === "config/info" && configFailure) {
        if (configFailure === "http" || configFailure === "timeout") {
          if (configFailure === "timeout") await delay(5200);
          response.writeHead(503, { "Content-Type": "application/json" });
          response.end(JSON.stringify({ code: 503, data: null }));
          return;
        }
        if (configFailure === "business") code = 500;
        if (configFailure === "malformed") data = null;
      }
      if (
        requireSeoAuth &&
        ["playlet/detail", "comment/list", "playlet/search"].includes(path) &&
        !request.headers.authorization
      )
        code = 1000;
      response.writeHead(200, { "Content-Type": "application/json" });
      response.end(
        JSON.stringify({
          code,
          data,
          msg: code === 200 ? "success" : "session expired",
        }),
      );
    });
    const mockPort = await listen(mock);
    mockOrigin = `http://127.0.0.1:${mockPort}`;
    seoSnapshotPath = join(
      process.cwd(),
      testBuildDirectory,
      "cache",
      "seo",
      createHash("sha256").update(mockOrigin).digest("hex") + ".json",
    );
    await rm(seoSnapshotPath, { force: true });
    await startNext();
  },
  { timeout: 15000 },
);

after(async () => {
  await stopNext();
  if (mock) await new Promise((resolve) => mock.close(resolve));
  if (seoSnapshotPath) await rm(seoSnapshotPath, { force: true });
});

test("a cold configuration failure never uses request/forwarded hosts as canonical or publisher URLs", async () => {
  try {
    configFailure = "http";
    const response = await fetch(base + "/info/about-us/", {
      headers: {
        "X-Forwarded-Host": "untrusted.entry.test",
        "X-Forwarded-Proto": "https",
      },
    });
    assert.equal(response.status, 200);
    const html = await response.text(),
      head = html.match(/<head>([\s\S]*?)<\/head>/)[1];
    assert.ok(!head.includes('rel="canonical"'));
    assert.ok(!head.includes('property="og:url"'));
    assert.ok(!head.includes("untrusted.entry.test"));
    assert.ok(!/<script\b[^>]*data-site-json-ld=/.test(html));
    assert.match(head, /<title>关于我们 - 禁果短剧<\/title>/);
  } finally {
    configFailure = "";
  }
});

test("robots.txt serves crawler text without sessions and advertises the configured absolute sitemap", async () => {
  const before = calls.length;
  for (const agent of ["Googlebot", "YandexBot", "bingbot"])
    for (const method of ["GET", "HEAD"]) {
      const response = await fetch(base + "/robots.txt", {
        method,
        redirect: "manual",
        headers: {
          "User-Agent": agent,
          "X-Forwarded-Host": "untrusted.example",
          Cookie: "drama_session=expired",
        },
      });
      assert.equal(response.status, 200);
      assert.equal(response.headers.get("location"), null);
      assert.equal(response.headers.get("set-cookie"), null);
      assert.match(response.headers.get("content-type"), /^text\/plain\b/);
      const body = await response.text();
      if (method === "HEAD") {
        assert.equal(body, "");
        continue;
      }
      assert.match(body, /User-Agent: \*/i);
      assert.ok(!body.includes("<html"));
      assert.ok(!body.includes("untrusted.example"));
      if (testEnvironment === "production") {
        assert.match(body, /^Allow: \/$/m);
        assert.match(body, /^Disallow: \/api\/$/m);
        assert.match(body, /^Disallow: \/healthz$/m);
        assert.match(
          body,
          /^Sitemap: https:\/\/default\.drama\.test\/sitemap\.xml$/m,
        );
        assert.ok(!/^Disallow: \/$/m.test(body));
      } else {
        assert.match(body, /^Disallow: \/$/m);
        assert.ok(!body.includes("Sitemap:"));
      }
    }
  const reads = calls.slice(before);
  assert.ok(
    reads.every((call) => call.path === "/api/app/config/info" && !call.auth),
    "only public site configuration is needed",
  );
});

test("robots sitemap uses permanent-domain precedence, survives configuration failure and never guesses a host", async () => {
  if (testEnvironment !== "production") return;
  try {
    seoConfig = {
      config: { foreverUrlAddr: "https://robots.drama.test/nested/?source=1" },
      newAddressInfo: { foreverUrlAddr: "https://backup.drama.test" },
    };
    let response = await fetch(base + "/robots.txt");
    assert.equal(response.status, 200);
    assert.match(
      await response.text(),
      /^Sitemap: https:\/\/robots\.drama\.test\/sitemap\.xml$/m,
    );
    configFailure = "http";
    response = await fetch(base + "/robots.txt", {
      headers: { "X-Forwarded-Host": "fake.test" },
    });
    assert.equal(response.status, 200);
    assert.match(
      await response.text(),
      /^Sitemap: https:\/\/robots\.drama\.test\/sitemap\.xml$/m,
    );
    configFailure = "";
    seoConfig = {
      config: { foreverUrlAddr: "" },
      newAddressInfo: { foreverUrlAddr: "https://backup.drama.test/base/" },
    };
    response = await fetch(base + "/robots.txt");
    assert.match(
      await response.text(),
      /^Sitemap: https:\/\/backup\.drama\.test\/sitemap\.xml$/m,
    );
  } finally {
    configFailure = "";
    seoConfig = {};
  }
});

test("the bare site origin and root slash both serve the homepage without redirecting to shorts", async () => {
  for (const address of [base, base + "/"]) {
    const response = await fetch(address, { redirect: "manual" });
    const html = await response.text();
    assert.equal(response.status, 200, address);
    assert.equal(response.headers.get("location"), null, address);
    assert.equal(new URL(response.url).pathname, "/");
    assert.ok(html.includes('class="home-content"'));
    assert.ok(html.includes("后台配置标题"));
    assert.match(html, /<a href="\/"[^>]*data-page="home"/);
    assert.match(html, /<a href="\/shorts\/"[^>]*data-page="shorts"/);
  }
});

test("SSR uses upstream content, escapes HTML, and does not restore homepage filters", async () => {
  const response = await fetch(base);
  const html = await response.text();
  assert.equal(response.status, 200);
  assert.equal(
    (html.match(/<h1\b/g) || []).length,
    1,
    "only the homepage title may use h1, including hidden templates",
  );
  assert.match(
    html,
    /<h1 id="home-title" class="home-page-title">禁果短剧 · 精品原创 · 日更爽看<\/h1>/,
  );
  assert.match(
    html,
    /<h2 class="hero-feature-title"><a[^>]*>接口剧名 &lt;script&gt;alert\(1\)&lt;\/script&gt;<\/a><\/h2>/,
  );
  assert.ok(html.includes("后台配置标题"));
  assert.ok(html.includes("接口剧名 &lt;script&gt;"));
  assert.ok(!html.includes("<script>alert(1)</script>"));
  assert.ok(!html.includes("data-must-watch-sort"));
  assert.ok(!html.includes("人人嫌猎户粗野"));
  assert.ok(html.includes('href="/shorts/"'));
  assert.ok(html.includes('href="/detail/23456/"'));
  assert.ok(html.includes('href="/config/31/"'));
  assert.ok(html.includes('data-src="https://example.com/poster.webp"'));
  assert.ok(html.includes('src="/placeholder.png"'));
  assert.ok(
    !/<img\b[^>]*\ssrc="https:\/\/example.com\/poster.webp"/.test(html),
  );
  assert.ok(
    !/href="#(?:page|info|member|detail|play|video|search)\//.test(html),
  );
  assert.ok(!html.includes('id="entry-navigation"'));
  assert.ok(!html.includes("entry-navigation-pending"));
  assert.match(
    html,
    /<dialog id="startup-grid" class="startup-popup" aria-label="应用推广">/,
  );
  assert.match(
    html,
    /<div class="startup-promotions" id="startup-promotions"><\/div>/,
  );
  assert.ok(!html.includes('id="header-download-qr"'));
  assert.ok(!html.includes('id="download-qr-panel"'));
  const entries = [
    ...html.matchAll(
      /<(?:div|section|a)\b[^>]*\bdata-app-download-entry\b[^>]*>/g,
    ),
  ];
  assert.equal(entries.length, 3);
  for (const entry of entries) assert.match(entry[0], /\bhidden(?:[\s=>])/);
  assertPageLinksHaveTrailingSlash(html);
});

test("homepage stays available when upstream ad and content lists are null or malformed", async () => {
  const saved = homePayload;
  try {
    homePayload = { ...saved, advitise: { nineGridList: null } };
    let response = await fetch(base, { redirect: "manual" });
    let html = await response.text();
    assert.equal(response.status, 200);
    assert.equal(response.headers.get("location"), null);
    assert.ok(html.includes("后台配置标题"));
    assert.ok(html.includes('href="/detail/23456/"'));
    for (const value of [null, {}, "bad"]) {
      homePayload = {
        homeBannerData: value,
        homeConfigData: value,
        announcements: value,
        advitise: { nineGridList: value },
      };
      response = await fetch(base, { redirect: "manual" });
      html = await response.text();
      assert.equal(response.status, 200);
      assert.equal(response.headers.get("location"), null);
      assert.equal(
        (html.match(/<h1\b/g) || []).length,
        1,
        "the homepage keeps its title without banners",
      );
      assert.ok(html.includes('id="home-title"'));
      assert.ok(html.includes("暂无推荐剧集"));
      assert.ok(html.includes("暂时没有内容"));
    }
    homePayload = {
      homeBannerData: [null, fixture],
      homeConfigData: [null, ...saved.homeConfigData],
      announcements: [null, { title: "正常公告" }],
      advitise: { nineGridList: [null] },
    };
    response = await fetch(base);
    html = await response.text();
    assert.equal(response.status, 200);
    assert.ok(html.includes("后台配置标题"));
    assert.ok(html.includes("正常公告"));
  } finally {
    homePayload = saved;
  }
});

test("/navigation renders direct download links without a hover QR panel", async () => {
  const before = calls.length;
  const response = await fetch(base + "/navigation/", { redirect: "manual" });
  const html = await response.text();
  assert.equal(response.status, 200);
  assert.equal(response.headers.get("location"), null);
  assert.ok(html.includes("<title>官方入口 - 禁果短剧</title>"));
  assert.ok(
    html.includes('<div id="entry-navigation" class="navigation-page">'),
  );
  assert.ok(!html.includes('<dialog id="entry-navigation"'));
  assert.ok(html.includes("禁果短剧 · 线路一"));
  assert.ok(html.includes("禁果短剧 · 线路二"));
  assert.ok(!html.includes("禁果短剧 · 线路三"));
  assert.ok(html.includes('href="https://example.com/entry-one"'));
  assert.ok(html.includes('href="https://example.com/entry-two"'));
  assert.ok(!html.includes('href="javascript:'));
  assert.ok(html.includes('href="https://example.com/contact"'));
  assert.ok(html.includes('href="https://example.com/group"'));
  assert.ok(html.includes('href="/home-road/"'));
  assert.ok(html.includes('href="/apps/"'));
  assert.match(
    html,
    /<a class="entry-download" href="https:\/\/example.com\/download" target="_blank" rel="sponsored nofollow noopener noreferrer" data-app-download=""/,
  );
  assert.match(
    html,
    /<a class="entry-channel" href="https:\/\/example.com\/download" target="_blank" rel="sponsored nofollow noopener noreferrer" data-app-download=""/,
  );
  assert.ok(!html.includes('src="data:image/png;base64,'));
  assert.ok(!html.includes('id="site-sidebar"'));
  assert.ok(!html.includes("/scripts/site-runtime.js"));
  assert.ok(!html.includes('id="startup-age"'));
  assert.ok(!html.includes("entry-navigation-pending"));
  assertPageLinksHaveTrailingSlash(html);
  // jha-1048: SSR never guests; client GuestAuthBootstrap owns auth/guest.
  assert.deepEqual(
    calls.slice(before).map((call) => call.path),
    ["/api/app/config/info"],
  );
  assert.ok(
    !calls.slice(before).some((call) => call.path === "/api/app/auth/guest"),
  );
  assert.equal(
    (
      await fetch(base + "/navigation/", {
        redirect: "manual",
        headers: { "Cache-Control": "no-cache" },
      })
    ).status,
    200,
  );
});

test("/navigation renders configured identity, routes, permanent entry and channels in its initial HTML", async () => {
  try {
    seoConfig = {
      seoNavInfo: {
        dhSiteName: "动态导航站",
        dhDescription: "后端配置的导航介绍",
      },
      config: {
        telegram: "@configured_contact",
        tgGroup: "@configured_group",
        twitterAddr: "https://x.com/configured_91",
        foreverUrlAddr: "https://permanent.drama.test/entry",
      },
      navPageList: [
        { line: 4, url: "https://four.drama.test" },
        { line: 2, url: "https://two.drama.test" },
      ],
    };
    const start = calls.length,
      response = await fetch(base + "/navigation/"),
      html = await response.text();
    assert.equal(response.status, 200);
    assert.ok(html.includes("动态导航站官方入口"));
    assert.ok(html.includes("后端配置的导航介绍"));
    assert.ok(html.includes("动态导航站 · 线路二"));
    assert.ok(html.includes("动态导航站 · 线路四"));
    assert.ok(!html.includes("动态导航站 · 线路一"));
    assert.ok(
      html.indexOf("动态导航站 · 线路二") < html.indexOf("动态导航站 · 线路四"),
    );
    assert.match(
      html,
      /<a class="entry-permanent" href="https:\/\/permanent.drama.test\/entry" rel="sponsored nofollow noopener noreferrer"/,
    );
    for (const url of [
      "https://t.me/configured_contact",
      "https://t.me/configured_group",
      "https://x.com/configured_91",
    ])
      assert.ok(html.includes(`href="${url}"`));
    assert.ok(!html.includes("huangguoshortdrama"));
    assert.ok(!html.includes("huangguodrama"));
    assert.deepEqual(
      calls.slice(start).map((call) => call.path),
      ["/api/app/config/info"],
    );
    assert.ok(
      !calls.slice(start).some((call) => call.path === "/api/app/auth/guest"),
    );
  } finally {
    seoConfig = {};
  }
});

test("/navigation omits unconfigured routes and contacts instead of showing homepage links or demo accounts", async () => {
  const saved = downloadAddress;
  try {
    downloadAddress = "";
    seoConfig = {
      navPageList: null,
      config: {
        foreverUrlAddr: "",
        telegram: "",
        telegramAdd: "",
        tgGroup: "",
        twitterAddr: "",
      },
    };
    const response = await fetch(base + "/navigation/"),
      html = await response.text();
    assert.equal(response.status, 200);
    assert.ok(html.includes("暂未配置访问线路"));
    for (const className of [
      "entry-route",
      "entry-permanent",
      "entry-contact",
      "entry-download",
    ])
      assert.ok(!html.includes(`class="${className}"`));
    for (const label of ["官方TG群", "官方推特"])
      assert.ok(!html.includes(label));
    assert.ok(html.includes('href="/home-road/"'));
    assert.ok(html.includes('href="/apps/"'));
    assert.ok(html.includes("grid-template-columns:repeat(2, minmax(0, 1fr))"));
  } finally {
    seoConfig = {};
    downloadAddress = saved;
  }
});

test("sidebar and footer render configured contacts and omit missing or unsafe channels in initial HTML", async () => {
  try {
    for (const configured of [true, false]) {
      seoConfig = {
        config: configured
          ? {
              telegram: "@jgdj_contact",
              tgGroup: "@jgdj_group",
              twitterAddr: "https://x.com/jgdj_channel",
            }
          : {
              telegram: "",
              telegramAdd: "",
              tgGroup: "javascript:alert(1)",
              twitterAddr: "data:text/html,bad",
            },
      };
      const response = await fetch(base + "/"),
        html = await response.text();
      assert.equal(response.status, 200);
      for (const className of ["sidebar-social", "site-footer-social"]) {
        const channels = html.match(
          new RegExp(`<div class="${className}"[^>]*>([\\s\\S]*?)</div>`),
        )?.[1];
        assert.notEqual(channels, undefined, className);
        if (configured)
          for (const url of [
            "https://t.me/jgdj_contact",
            "https://t.me/jgdj_group",
            "https://x.com/jgdj_channel",
          ])
            assert.ok(channels.includes(`href="${url}"`), className);
        else assert.doesNotMatch(channels, /<a\b/);
      }
      assert.doesNotMatch(html, /huangguoAI_2026|huangguoAITV/);
    }
  } finally {
    seoConfig = {};
  }
});

test("/navigation omits every download entry when no valid App URL is configured", async () => {
  const saved = downloadAddress;
  try {
    for (const value of ["", "javascript:alert(1)"]) {
      downloadAddress = value;
      const response = await fetch(base + "/navigation/", {
        redirect: "manual",
      });
      const html = await response.text();
      assert.equal(response.status, 200);
      assert.ok(!html.includes('class="entry-download"'));
      assert.ok(!html.includes('data-app-download=""'));
      assert.ok(!html.includes('id="app-download-dialog"'));
      assert.ok(html.includes("官方渠道"));
      assert.ok(html.includes('href="/apps/"'));
    }
  } finally {
    downloadAddress = saved;
  }
});

test("all clean page URLs support direct access and refresh", async () => {
  const paths = [
    "/shorts/",
    "/topics/",
    "/rank/",
    "/apps/",
    "/home-road/",
    "/topics/3/",
    "/theme/8/",
    "/tag/9/",
    "/config/31/",
    "/detail/23456/",
    "/play/23456/90001/",
    "/search/" + encodeURIComponent("都市 / 爱情?#%") + "/",
    "/member/center/",
    "/member/favorites/",
    "/member/history/",
    "/member/likes/",
    "/member/purchased/",
    "/member/settings/",
    "/info/deposit/",
    "/info/deposit/vip/",
    "/info/user-center/",
    "/info/settings/",
    "/info/about-us/",
    "/info/user-agreement/",
    "/info/privacy-policy/",
    "/info/help-center/",
    "/info/2257/",
    "/info/dmca/",
    "/info/feedback/",
  ];
  for (const path of paths) {
    const response = await fetch(new URL(path, base + "/"), {
      redirect: "manual",
    });
    assert.equal(response.status, 200, path);
    assert.equal(response.headers.get("location"), null, path);
    assert.equal(
      new URL(response.url).pathname,
      new URL(path, base).pathname,
      path,
    );
    const html = await response.text();
    assert.ok(html.includes('id="channel-page"'), path);
    assert.ok(html.includes("/scripts/site-runtime.js"), path);
    assert.equal(
      (html.match(/<h1\b/g) || []).length,
      1,
      path + " must retain its own h1 without inactive template headings",
    );
    assert.ok(!html.includes('id="entry-navigation"'), path);
    assert.ok(!html.includes("entry-navigation-pending"), path);
    assertPageLinksHaveTrailingSlash(html);
    const withoutSlash = await fetch(base + path.slice(0, -1), {
      redirect: "manual",
    });
    assert.equal(withoutSlash.status, 308, path);
    assert.equal(
      new URL(withoutSlash.headers.get("location"), base).href,
      base + path,
      path,
    );
  }
  const refreshed = await fetch(base + "/shorts/", {
    headers: { "Cache-Control": "no-cache" },
  });
  assert.equal(refreshed.status, 200);
});

test("page slash redirects preserve encoded paths and queries without requesting upstream content", async () => {
  const keyword = encodeURIComponent("都市 / 爱情?#% example.com");
  const paths = [
    "/navigation",
    "/search",
    "/search/" + keyword,
    "/search/" + keyword + "/page/2",
    "/rank/hot",
    "/rank/new",
    "/rank/follow",
    "/info/deposit/vip",
    "/shorts/page/2",
  ];
  const query = "?channel=a%2Fb+1&sort=2&source=x%252Fy";
  const before = calls.length;
  for (const path of paths) {
    for (const method of ["GET", "HEAD"]) {
      const response = await fetch(base + path + query, {
        method,
        redirect: "manual",
      });
      assert.equal(response.status, 308, path);
      assert.equal(
        new URL(response.headers.get("location"), base).href,
        base + path + "/" + query,
        path,
      );
    }
  }
  assert.equal(
    calls.length,
    before,
    "redirects must run before page/API data fetching",
  );
  for (const path of [
    "/favicon.png",
    "/placeholder.png",
    "/scripts/site-runtime.js",
  ]) {
    const response = await fetch(base + path, { redirect: "manual" });
    assert.equal(response.status, 200, path);
    assert.equal(response.headers.get("location"), null, path);
    await response.arrayBuffer();
  }
  const missing = await fetch(base + "/unknown-page", { redirect: "manual" });
  assert.equal(missing.status, 404);
  assert.equal(missing.headers.get("location"), null);
});

test("empty and paginated search entries retain native paths and keyword-specific metadata", async () => {
  searchPayload = { list: [fixture], totalCount: 48, pageSize: 24 };
  try {
    for (const path of [
      "/search/",
      "/search/" + encodeURIComponent("都市 / 爱情") + "/",
      "/search/" + encodeURIComponent("都市 / 爱情") + "/page/2/",
    ]) {
      const response = await fetch(base + path, { redirect: "manual" });
      assert.equal(response.status, 200, path);
      assert.equal(response.headers.get("location"), null);
      const html = await response.text();
      assert.ok(
        html.includes("搜索短剧") || html.includes("都市 / 爱情 · 搜索结果"),
      );
      if (path.includes("/page/2/")) assert.match(html, /第\s*2\s*页/);
    }
  } finally {
    searchPayload = undefined;
  }
});

test("fixed information pages retain local article markup and only load shared head configuration in SSR", async () => {
  for (const [key, title, marker] of [
    ["about-us", "关于我们", "品牌介绍"],
    ["user-agreement", "用户协议", "关于《使用条款》"],
    ["privacy-policy", "隐私政策", "八、问题和建议"],
    ["help-center", "常见问题", "<details open>"],
    ["2257", "2257 合规声明", "资料留存"],
    ["dmca", "DMCA 版权声明", "版权通知及反通知请通过本站"],
  ]) {
    const count = calls.length,
      response = await fetch(base + `/info/${key}/`, { redirect: "manual" });
    assert.equal(response.status, 200);
    assert.equal(response.headers.get("location"), null);
    const html = await response.text();
    assert.ok(html.includes(`<title>${title} - 禁果短剧</title>`));
    assert.ok(html.includes(marker), key);
    const main = html.match(/<main\b[^>]*\bid="info-page"[^>]*>/)?.[0];
    assert.ok(main);
    assert.ok(main.includes(`data-info="${key}"`));
    assert.ok(!/\shidden(?:[=\s>])/.test(main));
    assert.deepEqual(
      calls
        .slice(count)
        .map((call) => call.path)
        .sort(),
      [
        "/api/app/config/info",
        "/api/app/config/footer/info",
        "/api/app/navigation/header",
        "/api/app/translation/category/list",
      ].sort(),
      "fixed page SSR must not fetch homepage, guest, or rich text",
    );
    assert.ok(
      !calls.slice(count).some((call) => call.path === "/api/app/auth/guest"),
    );
    assert.ok(html.includes('class="home-content" hidden=""'));
  }
});

test("footer navigation comes from footer info and opens the matching rich text page", async () => {
  const previousFooter = footerPayload;
  const previousRich = richTextPayload;
  try {
    footerPayload = {
      footerInfo: {
        brand: { title: "接口品牌", content: "接口页脚" },
        token: "private-footer-token",
        navList: [
          {
            id: 1,
            name: "规则",
            urlValue: "/ignored/",
            translationList: [
              { id: 2, name: "关于我们", urlValue: "/richetext/关于我们" },
              { id: 3, name: "外链", urlValue: "https://example.com/rules" },
              { id: 4, name: "脚本", urlValue: "javascript:alert(1)" },
            ],
          },
          { id: 5, name: "用户协议", urlValue: "用户协议" },
        ],
      },
    };
    richTextPayload = [
      {
        id: 7,
        title: "关于我们",
        desc: "企业介绍",
        content: "<h2>品牌正文</h2><p>富文本段落</p>",
        token: "private-richtext-token",
      },
    ];
    const home = await (await fetch(base + "/")).text();
    const links = home.match(
      /<nav class="site-footer-links"[^>]*>[\s\S]*?<\/nav>/,
    )?.[0];
    assert.ok(links);
    assert.ok(home.includes("接口页脚"));
    assert.match(home, /<strong class="site-footer-title">接口品牌<i/);
    assert.match(home, /© \d{4} 接口品牌　All rights reserved\./);
    assert.ok(!home.match(/<strong class="site-footer-title">[^<]*禁果短剧/));
    assert.ok(links.includes('href="/richtext/%E5%85%B3%E4%BA%8E%E6%88%91%E4%BB%AC/"'));
    assert.ok(links.includes('href="/richtext/%E7%94%A8%E6%88%B7%E5%8D%8F%E8%AE%AE/"'));
    assert.ok(links.includes('href="https://example.com/rules"'));
    assert.ok(links.includes('target="_blank"'));
    assert.ok(!links.includes("javascript:"));
    assert.ok(!links.includes('href="/ignored/"'));
    assert.ok(!links.includes(">规则<"));
    assert.ok(!home.includes("private-footer-token"));
    const start = calls.length;
    const response = await fetch(base + "/richtext/" + encodeURIComponent("关于我们") + "/", {
      redirect: "manual",
    });
    assert.equal(response.status, 200);
    const html = await response.text();
    const main = currentMain(html, "info-page");
    assert.ok(main.includes('data-info="richtext"'));
    assert.ok(main.includes("企业介绍"));
    assert.ok(main.includes("品牌正文"));
    assert.ok(main.includes("富文本段落"));
    assert.ok(!html.includes("private-richtext-token"));
    assert.match(html, /<link rel="canonical" href="https:\/\/default\.drama\.test\/richtext\/%E5%85%B3%E4%BA%8E%E6%88%91%E4%BB%AC\/"/);
    assert.ok(
      calls.slice(start).some((call) => {
        return (
          call.path === "/api/app/config/richtext/list" &&
          new URLSearchParams(call.search).get("titles") === "关于我们"
        );
      }),
    );
    const alias = await (
      await fetch(base + "/richetext/" + encodeURIComponent("关于我们") + "/")
    ).text();
    assert.ok(alias.includes("品牌正文"));
    assert.match(alias, /<link rel="canonical" href="https:\/\/default\.drama\.test\/richtext\/%E5%85%B3%E4%BA%8E%E6%88%91%E4%BB%AC\/"/);
    const missing = await (
      await fetch(base + "/richtext/" + encodeURIComponent("没有这篇") + "/")
    ).text();
    assert.ok(currentMain(missing, "info-page").includes("这篇内容暂时没有发布。"));
    assert.match(missing, /<meta name="robots" content="noindex,\s*follow"/);
  } finally {
    footerPayload = previousFooter;
    richTextPayload = previousRich;
  }
});

test("unknown pages and malformed detail paths return a visible 404", async () => {
  for (const path of [
    "/unknown-page",
    "/shorts/extra/",
    "/play/23456/",
    "/detail/not-a-number/",
    "/detail/0/",
    "/detail/9007199254740992/",
    "/play/23456/0/",
    "/member/unknown/",
    "/info/unknown/",
    "/richtext/",
    "/richtext/a/b/",
    "/assets/missing.png",
    "/rank/unknown/",
    "/rank/new/extra/",
  ]) {
    const response = await fetch(base + path);
    const html = await response.text();
    assert.equal(response.status, 404, path);
    assert.ok(html.includes("route-not-found"), path);
    assert.ok(html.includes("返回首页"), path);
  }
});

test("ranking slash URLs render their titles and bare URLs redirect to the same ranking", async () => {
  for (const [slug, title] of [
    ["hot", "热播榜"],
    ["new", "新剧榜"],
    ["follow", "追剧榜"],
  ]) {
    for (const suffix of ["/", ""]) {
      const path = `/rank/${slug}${suffix}`;
      const response = await fetch(base + path, {
        redirect: "manual",
        headers: { "Cache-Control": "no-cache" },
      });
      if (!suffix) {
        assert.equal(response.status, 308, path);
        assert.equal(
          new URL(response.headers.get("location"), base).href,
          base + path + "/",
          path,
        );
        continue;
      }
      assert.equal(response.status, 200, path);
      assert.equal(response.headers.get("location"), null, path);
      const html = await response.text();
      assert.ok(html.includes(`<title>${title} - 禁果短剧</title>`), path);
      assert.ok(html.includes('href="/rank/hot/"'));
      assertPageLinksHaveTrailingSlash(html);
    }
  }
});

test("SSR emits configured TDK, site_name, canonical and bounded pagination links inside head for browser and crawler user agents", async () => {
  try {
    seoConfig = {
      config: {
        foreverUrlAddr: "https://canonical.drama.test/entry/?channel=abc",
      },
      seoInfo: JSON.stringify({
        title: "后台首页标题",
        description: "后台首页描述",
        keyworld: "首页词，短剧",
        webSiteName: "91剧场",
      }),
    };
    categories = [
      {
        urlValue: "/playlet/",
        seoInfo: {
          title: "短剧导航标题",
          description: "短剧导航描述",
          keyworld: ["导航关键词"],
        },
      },
    ];
    listPayload = {
      list: [fixture],
      totalCount: 72,
      seoInfo: {
        title: "列表接口标题",
        description: "列表接口描述",
        keywords: ["接口关键词"],
      },
    };
    const headOf = (html) => {
      const match = html.match(/<head>([\s\S]*?)<\/head>/);
      assert.ok(match);
      return match[1];
    };
    const start = calls.length;
    const home = await (await fetch(base)).text(),
      head = headOf(home);
    assert.match(head, /<title>后台首页标题 - 91剧场<\/title>/);
    assert.match(head, /<meta name="description" content="后台首页描述"/);
    assert.match(head, /<meta name="keywords" content="首页词,短剧"/);
    assert.match(head, /<meta property="og:site_name" content="91剧场"/);
    assert.match(
      head,
      /<link rel="canonical" href="https:\/\/canonical.drama.test\/"/,
    );
    assert.match(
      head,
      /<meta property="og:image" content="https:\/\/canonical.drama.test\/og-default.jpg"/,
    );
    assert.match(
      head,
      /<meta name="twitter:card" content="summary_large_image"/,
    );
    assert.equal(
      calls.slice(start).filter((call) => call.path === "/api/app/playlet/home")
        .length,
      1,
      "SSR and metadata share one homepage request",
    );
    assert.equal(
      calls.slice(start).filter((call) => call.path === "/api/app/config/info")
        .length,
      1,
      "SSR and metadata share one configuration request",
    );
    assert.match(head,/google-site-verification" content="QJFFfKYHJsNfa-lGTdGjsCJc4rytPw-4wsTty-BM6iU"/);
    assert.ok(!/google-analytics|mc\.yandex/.test(head));
    assert.match(home,/googletagmanager\.com\/gtm\.js\?id=/);
    assert.match(home,/['"]GTM-TXLP67SX['"]/);
    assert.match(home,/googletagmanager\.com\/ns\.html\?id=GTM-TXLP67SX/);
    for (const agent of [
      "Mozilla/5.0 Chrome/130",
      "Googlebot",
      "facebookexternalhit",
    ]) {
      for (const [path, page] of [
        ["/shorts/", 1],
        ["/shorts/page/2/", 2],
        ["/shorts/page/3/", 3],
      ]) {
        const response = await fetch(base + path + "?channel=campaign", {
          redirect: "manual",
          headers: { "User-Agent": agent },
        });
        assert.equal(response.status, 200);
        assert.equal(response.headers.get("location"), null);
        const head = headOf(await response.text());
        const canonical = `https://canonical.drama.test/shorts/${page > 1 ? `page/${page}/` : ""}`;
        assert.ok(head.includes(`<link rel="canonical" href="${canonical}"`));
        assert.ok(
          head.includes(`<meta property="og:url" content="${canonical}"`),
        );
        assert.ok(
          head.includes(
            `<title>短剧导航标题${page > 1 ? " - 第" + page + "页" : ""}</title>`,
          ),
        );
        assert.ok(
          head.includes(
            `<meta name="keywords" content="导航关键词${page > 1 ? ",第" + page + "页" : ""}"`,
          ),
        );
        assert.equal(head.includes('<link rel="prev"'), page > 1);
        assert.equal(head.includes('<link rel="next"'), page < 3);
        if (page === 2)
          assert.ok(
            head.includes(
              'rel="prev" href="https://canonical.drama.test/shorts/?channel=campaign"',
            ),
          );
        assert.equal((head.match(/rel="canonical"/g) || []).length, 1);
      }
    }
    for (const path of [
      "/search/爱情/",
      "/info/deposit/",
      "/member/history/",
      "/navigation/",
      "/shorts/?sort=2",
    ]) {
      const head = headOf(await (await fetch(base + path)).text());
      assert.ok(!head.includes('rel="canonical"'), path);
      assert.match(head, /<meta name="robots" content="noindex/);
    }
    const overflowResponse = await fetch(base + "/shorts/page/4/");
    assert.equal(overflowResponse.status, 404);
    const overflow = headOf(await overflowResponse.text());
    assert.match(overflow, /<meta name="robots" content="noindex/);
    assert.ok(!overflow.includes('rel="canonical"'));
    assert.ok(!overflow.includes('rel="next"'));
  } finally {
    seoConfig = {};
    categories = [];
    listPayload = undefined;
  }
});

test("detail SEO reads protected upstream content without exposing credentials and keeps registered sessions intact", async () => {
  try {
    requireSeoAuth = true;
    seoConfig = {
      seoInfo: { webSiteName: "91剧场" },
      config: { foreverUrlAddr: "https://canonical.drama.test/" },
    };
    detailSeo = {
      seoInfo: {
        title: "剧集独立标题",
        description: "真实剧集描述",
        keywords: "剧集词",
      },
    };
    const start = calls.length;
    // Protected SEO reads use the client cookie token (jha-1048); SSR must not invent a guest.
    const response = await fetch(base + "/detail/23456/", {
      headers: {
        "X-Real-IP": "203.0.113.8",
        Cookie: "drama_bearer=test-session-secret",
      },
    });
    assert.equal(response.status, 200);
    const html = await response.text(),
      head = html.match(/<head>([\s\S]*?)<\/head>/)[1];
    assert.ok(head.includes("<title>剧集独立标题 - 91剧场</title>"));
    assert.ok(head.includes('content="真实剧集描述"'));
    assert.ok(
      head.includes(
        'rel="canonical" href="https://canonical.drama.test/detail/23456/"',
      ),
    );
    assert.equal(
      calls.slice(start).filter((call) => call.path === "/api/app/auth/guest")
        .length,
      0,
    );
    assert.ok(
      calls
        .slice(start)
        .some(
          (call) =>
            call.path === "/api/app/auth/getInfo" &&
            call.ip === "203.0.113.8",
        ),
    );
    assert.ok(!html.includes("test-session-secret"));
    assert.ok(!html.includes("drama_session"));
    const registeredStart = calls.length;
    const registered = await fetch(base + "/detail/23456/", {
      headers: { Cookie: "drama_session=expired; drama_registered=1" },
    });
    assert.equal(registered.status, 200);
    const signedOut = await registered.text();
    assert.ok(signedOut.includes("请先登录账号"));
    assert.ok(signedOut.includes('data-auth-mode="login"'));
    assert.ok(signedOut.includes("noindex"));
    assert.ok(!signedOut.includes('rel="canonical"'));
    assert.equal(
      calls
        .slice(registeredStart)
        .filter((call) => call.path === "/api/app/auth/guest").length,
      0,
      "registered identity is never replaced with guest",
    );
  } finally {
    requireSeoAuth = false;
    seoConfig = {};
    detailSeo = undefined;
  }
});

test("permanent canonical and site identity survive config errors, timeouts, missing fields and a server restart", async () => {
  const domain = "https://stable.drama.test",
    brand = "稳定站点";
  const identity = async () => {
    const response = await fetch(base + "/shorts/page/2/?channel=campaign", {
      headers: {
        "X-Forwarded-Host": "alternate.entry.test",
        "X-Forwarded-Proto": "http",
      },
    });
    assert.equal(response.status, 200);
    const html = await response.text(),
      head = html.match(/<head>([\s\S]*?)<\/head>/)[1];
    assert.ok(head.includes(`rel="canonical" href="${domain}/shorts/page/2/"`));
    assert.ok(
      head.includes(`property="og:url" content="${domain}/shorts/page/2/"`),
    );
    assert.ok(head.includes(`property="og:site_name" content="${brand}"`));
    assert.ok(
      head.includes(`rel="prev" href="${domain}/shorts/?channel=campaign"`),
    );
    assert.ok(
      head.includes(
        `rel="next" href="${domain}/shorts/page/3/?channel=campaign"`,
      ),
    );
    const graph = JSON.parse(
      html.match(
        /<script\b[^>]*data-site-json-ld=""[^>]*>([\s\S]*?)<\/script>/,
      )[1],
    )["@graph"];
    const organization = graph.find((item) => item["@type"] === "Organization"),
      website = graph.find((item) => item["@type"] === "WebSite");
    assert.equal(organization.url, domain + "/");
    assert.equal(organization.name, brand);
    assert.equal(website.name, brand);
    assert.ok(!head.includes("alternate.entry.test"));
    assert.ok(!head.includes("noindex"));
  };
  try {
    seoConfig = {
      config: { foreverUrlAddr: domain },
      seoInfo: { webSiteName: brand },
    };
    listPayload = { list: [fixture], totalCount: 72 };
    await identity();
    for (const failure of ["http", "business", "malformed", "timeout"]) {
      configFailure = failure;
      await identity();
    }
    configFailure = "";
    seoConfig = {
      config: { foreverUrlAddr: "" },
      newAddressInfo: { foreverUrlAddr: "" },
      seoInfo: { webSiteName: "不可替换的错误品牌" },
    };
    await identity();
    configFailure = "http";
    await stopNext();
    await startNext();
    await identity();
    configFailure = "";
    seoConfig = {
      config: { foreverUrlAddr: "https://updated.drama.test" },
      seoInfo: { webSiteName: "更新站点" },
    };
    const html = await (await fetch(base + "/shorts/")).text();
    assert.ok(
      html.includes(
        'rel="canonical" href="https://updated.drama.test/shorts/"',
      ),
    );
    assert.ok(html.includes('property="og:site_name" content="更新站点"'));
  } finally {
    configFailure = "";
    seoConfig = {};
    categories = [];
    listPayload = undefined;
  }
});

test("SSR JSON-LD matches each canonical route, list page, content entity and visible FAQ without credentials or executable injection", async () => {
  const savedHome = homePayload;
  const graphOf = (html) => {
    const scripts = [
      ...html.matchAll(
        /<script\b[^>]*data-site-json-ld=""[^>]*>([\s\S]*?)<\/script>/g,
      ),
    ];
    assert.equal(
      scripts.length,
      1,
      "one native JSON-LD script in the initial HTML",
    );
    const graph = JSON.parse(scripts[0][1]);
    assert.equal(graph["@context"], "https://schema.org");
    return graph["@graph"];
  };
  try {
    const origin = "https://schema.drama.test";
    seoConfig = {
      seoInfo: { webSiteName: "91剧场" },
      config: { foreverUrlAddr: origin },
    };
    listPayload = {
      list: [
        { ...fixture, id: 7 },
        { ...fixture, id: 8 },
      ],
      totalCount: 72,
      name: "当前接口栏目",
    };
    detailSeo = {
      onlineAt: "2025-10-18 10:30:00",
      mediaUpdatedAt: "2025-10-19 09:00:00",
      title: "剧名 </script><script>alert(1)</script>",
      desc: "真实剧集简介",
    };
    chapterPayload = {
      id: 90001,
      playletId: 23456,
      currentEpisode: 3,
      canWatch: true,
      needUnlock: false,
      videoUrl: "https://media.drama.test/episode.m3u8",
      mediaTime: 123,
    };
    videoPayload = {
      ...fixture,
      coverImg: fixture.cover,
      createdAt: "2025-10-17",
      video: { url: "https://media.drama.test/movie.mp4", videoTime: 600 },
    };
    let html = await (await fetch(base)).text(),
      graph = graphOf(html);
    assert.ok(
      graph.some(
        (node) => node["@type"] === "Organization" && node.name === "91剧场",
      ),
    );
    assert.ok(
      graph.some(
        (node) => node["@type"] === "WebSite" && node.url === origin + "/",
      ),
    );
    assert.equal(
      graph.find((node) => node["@type"] === "ItemList").itemListElement[0].url,
      origin + "/detail/23456/",
    );
    for (const [path, type] of [
      ["/shorts/page/2/", "CollectionPage"],
      ["/rank/new/", "CollectionPage"],
      ["/topics/", "CollectionPage"],
      ["/topics/7/", "CollectionPage"],
      ["/info/about-us/", "AboutPage"],
      ["/info/help-center/", "FAQPage"],
    ]) {
      html = await (
        await fetch(base + path + "?channel=campaign", {
          headers: { "User-Agent": "Googlebot" },
        })
      ).text();
      graph = graphOf(html);
      assert.ok(
        graph.some((node) => node["@type"] === type),
        path,
      );
      assert.equal(
        graph.find((node) => node["@id"] === origin + path + "#webpage").url,
        origin + path,
      );
      if (path === "/shorts/page/2/") {
        const items = graph.find(
          (node) => node["@type"] === "ItemList",
        ).itemListElement;
        assert.deepEqual(
          items.map((item) => [item.position, item.url]),
          [
            [25, origin + "/detail/7/"],
            [26, origin + "/detail/8/"],
          ],
        );
      }
      if (path === "/info/help-center/")
        assert.equal(
          graph.find((node) => node["@type"] === "FAQPage").mainEntity.length,
          6,
        );
    }
    for (const path of ["/detail/23456/", "/play/23456/90001/"]) {
      html = await (await fetch(base + path)).text();
      graph = graphOf(html);
      assert.ok(!html.includes("<script>alert(1)</script>"));
      assert.ok(!JSON.stringify(graph).includes("test-session-secret"));
      if (path.startsWith("/detail/")) {
        assert.ok(graph.some((node) => node["@type"] === "TVSeries"));
        assert.ok(!graph.some((node) => node["@type"] === "VideoObject"));
      } else {
        const video = graph.find((node) => node["@type"] === "VideoObject");
        assert.ok(video, path);
        assert.ok(video.thumbnailUrl[0]);
        assert.ok(video.uploadDate.includes("+08:00"));
        assert.ok(video.contentUrl.startsWith("https://media.drama.test/"));
        if (path.startsWith("/play/"))
          assert.equal(
            graph.find((node) => node["@type"] === "TVEpisode").episodeNumber,
            3,
          );
      }
    }
    for (const path of [
      "/search/爱情/",
      "/member/center/",
      "/info/deposit/",
      "/navigation/",
      "/apps/",
      "/shorts/?sort=2",
      "/unknown/",
    ]) {
      html = await (await fetch(base + path)).text();
      assert.ok(!/<script\b[^>]*data-site-json-ld=/.test(html), path);
    }
  } finally {
    homePayload = savedHome;
    seoConfig = {};
    listPayload = undefined;
    detailSeo = undefined;
    chapterPayload = undefined;
    videoPayload = undefined;
  }
});

test("paginated routes serve slash URLs directly and redirect bare paths with their queries", async () => {
  const savedHome = homePayload;
  try {
    listPayload = accountListPayload = { list: [fixture], totalCount: 48 };
    searchPayload = { list: [fixture], totalCount: 48, pageSize: 24 };
    commentPayload = transactionsPayload = { list: [], totalCount: 18 };
    homePayload = {
      ...savedHome,
      homeConfigData: [
        {
          id: 31,
          status: true,
          name: "后台配置标题",
          type: 1,
          list: Array.from({ length: 48 }, (_, i) => ({
            ...fixture,
            id: fixture.id + i,
          })),
        },
      ],
    };
    const keyword = encodeURIComponent("都市 / page/7/?#%");
    const bases = [
      "/shorts/",
      "/topics/",
      "/topics/7/",
      "/theme/8/",
      "/tag/9/",
      "/config/31/",
      "/rank/",
      "/rank/hot/",
      "/rank/new/",
      "/rank/follow/",
      "/search/" + keyword + "/",
      "/member/favorites/",
      "/member/history/",
      "/member/likes/",
      "/member/purchased/",
      "/info/deposit/",
      "/info/deposit/vip/",
      "/detail/23456/",
      "/play/23456/90001/",
    ];
    for (const basePath of bases) {
      for (const suffix of ["page/2/", "page/2"]) {
        const path = basePath + suffix + "?sort=2";
        const response = await fetch(base + path, {
          redirect: "manual",
          headers: { "Cache-Control": "no-cache" },
        });
        if (!suffix.endsWith("/")) {
          assert.equal(response.status, 308, path);
          assert.equal(
            new URL(response.headers.get("location"), base).href,
            base + basePath + suffix + "/?sort=2",
            path,
          );
          continue;
        }
        assert.equal(response.status, 200, path);
        assert.equal(response.headers.get("location"), null, path);
        assert.equal(new URL(response.url).pathname, basePath + suffix, path);
        const html = await response.text();
        if (response.status === 200) assert.match(html, /第\s*2\s*页/, path);
        assertPageLinksHaveTrailingSlash(html);
      }
    }
    for (const path of [
      "/shorts/page/0/",
      "/shorts/page/01/",
      "/shorts/page/2/page/3/",
      "/apps/page/2/",
      "/home-road/page/2/",
      "/info/about-us/page/2/",
    ]) {
      const response = await fetch(base + path, { redirect: "manual" });
      assert.equal(response.status, 404, path);
      assert.equal(response.headers.get("location"), null, path);
    }
  } finally {
    homePayload = savedHome;
    listPayload =
      accountListPayload =
      searchPayload =
      commentPayload =
      transactionsPayload =
        undefined;
  }
});

test("guest session token stays in HttpOnly cookie and device header is forwarded", async () => {
  const response = await fetch(base + "/api/app/auth/guest", {
    method: "POST",
    redirect: "manual",
    headers: { "Content-Type": "application/json" },
    body: "{}",
  });
  assert.equal(response.status, 200);
  assert.equal(response.headers.get("location"), null);
  const payload = await response.json();
  assert.equal(payload.code, 200);
  assert.equal(payload.data.token, undefined);
  const cookies = response.headers.getSetCookie();
  assert.ok(
    cookies.some(
      (value) =>
        value.startsWith("drama_session=") &&
        value.toLowerCase().includes("httponly") &&
        value.includes("SameSite=lax"),
    ),
  );
  assert.ok(
    calls
      .findLast((call) => call.path.endsWith("/auth/guest"))
      .device.includes("SysType=h5_pc;Ver=1.0.0;"),
  );
});

test("browser app API routes preserve sessions and queries through Next", async () => {
  let start = calls.length;
  const guest = await fetch(base + "/api/app/auth/guest", {
    method: "POST",
    headers: { Origin: base, "Content-Type": "application/json" },
    body: JSON.stringify({ devID: "bff-device" }),
  });
  assert.equal(guest.status, 200);
  assert.equal((await guest.json()).data.token, undefined);
  assert.ok(
    guest.headers
      .getSetCookie()
      .some(
        (value) =>
          value.startsWith("drama_session=") && value.includes("HttpOnly"),
      ),
  );
  assert.deepEqual(
    calls.slice(start).map((call) => call.path),
    ["/api/app/auth/guest"],
  );
  const cookie = guest.headers
    .getSetCookie()
    .map((value) => value.split(";")[0])
    .join("; ");
  const info = await fetch(base + "/api/app/auth/getInfo", {
    headers: { Cookie: cookie },
  });
  assert.equal(info.status, 200);
  assert.equal((await info.json()).data.userId, 77);
  assert.equal(calls.at(-1).auth, "test-session-secret");
  const search = await fetch(
    base + "/api/app/playlet/search?keyword=test&pageNum=2&pageSize=4",
    { headers: { Cookie: cookie } },
  );
  assert.equal(search.status, 200);
  assert.ok(Array.isArray((await search.json()).data.list));
  assert.equal(calls.at(-1).path, "/api/app/playlet/search");
  assert.equal(new URLSearchParams(calls.at(-1).search).get("pageNum"), "2");
  start = calls.length;
  assert.equal((await fetch(base + "/api/app/not-allowed")).status, 404);
  assert.equal(calls.length, start);
});

test("both API routes preserve native and client UA, SDK identity, IP and JSON request headers", async () => {
  const ua =
    "Mozilla/5.0 (Linux; Android 14; Pixel 8 Build/AP1A) Chrome/124.0 Mobile Safari/537.36";
  const xua =
    "DevID=client-device;DevType=Android;SysType=h5_android;Ver=2.0;BuildID=web;sid=client-sid";
  const fields = {
    sid: "sdk-sid",
    device_id: "sdk-device",
    device: "Android",
    device_fingerprint: "raw",
    fp_version: "3",
    app_version: "1.0.0",
  };
  for (const prefix of ["/api", "/api/app"]) {
    const response = await fetch(base + prefix + "/auth/guest", {
      method: "POST",
      headers: {
        "User-Agent": ua,
        "X-User-Agent": xua,
        "X-Real-IP": "203.0.113.9",
        "X-Forwarded-For": "203.0.113.8, 10.0.0.1",
        "X-SDK-Common": Buffer.from(JSON.stringify(fields)).toString("base64"),
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ devID: "business-device" }),
    });
    assert.equal(response.status, 200);
    assert.equal((await response.json()).data.token, undefined);
    const call = calls.at(-1);
    assert.equal(call.ua, ua);
    assert.equal(call.device, xua);
    assert.equal(call.ip, "203.0.113.9");
    assert.equal(call.accept, "application/json");
    assert.equal(call.contentType, "application/json");
    assert.equal(JSON.parse(call.body).devID, "business-device");
    assert.deepEqual(JSON.parse(Buffer.from(call.sdk, "base64")), fields);
    assert.equal(call.forwarded, undefined);
    assert.equal(call.cookie, undefined);
  }
});

test("public SSR and page session requests use the visitor UA, SID and IP with the configured upstream", async () => {
  const ua =
    "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 Version/17.5 Safari/605.1.15";
  const start = calls.length;
  const response = await fetch(base + "/shorts/", {
    headers: {
      "User-Agent": ua,
      "X-Real-IP": "203.0.113.6",
      Cookie:
        "drama_session=registered-user-a-secret; drama_registered=1; sid=ssr-sid",
    },
  });
  assert.equal(response.status, 200);
  await response.text();
  const forwarded = calls.slice(start);
  assert.ok(forwarded.some((call) => call.path === "/api/app/auth/getInfo"));
  assert.ok(
    forwarded.some((call) => call.path === "/api/app/playlet/operate/list"),
  );
  for (const call of forwarded) {
    assert.equal(call.ua, ua, call.path);
    assert.equal(call.ip, "203.0.113.6", call.path);
    assert.equal(
      call.device,
      "DevType=Apple Mac desktop;SysType=h5_pc;Ver=1.0.0;BuildID=Safari 17.5;device_brand=Apple;device_model=Mac;system_name=macOS;system_version=14.5;sid=ssr-sid",
      call.path,
    );
    if (call.path !== "/api/app/auth/getInfo")
      assert.equal(call.auth, undefined);
  }
});

test("browser POSTs reach upstream through CDN host and protocol changes on both API routes", async () => {
  const port = new URL(base).port;
  const browserOrigin = "https://cdn.drama.example";
  const cases = [
    { Host: `localhost:${port}`, Origin: `http://localhost:${port}` },
    { Host: `127.0.0.1:${port}`, Origin: `http://127.0.0.1:${port}` },
    { Host: "cdn.drama.example", Origin: browserOrigin },
    {
      Host: "next.internal:21030",
      Origin: browserOrigin,
      "X-Forwarded-Host": "cdn.drama.example",
      "X-Forwarded-Proto": "https",
    },
    { Host: "next.internal:21030", Origin: "null" },
    {
      Host: "next.internal:21030",
      Origin: "https://other.example",
      "Sec-Fetch-Site": "cross-site",
    },
  ];
  for (const prefix of ["/api", "/api/app"])
    for (const headers of cases) {
      const count = calls.length;
      // Node fetch replaces a custom Host; use HTTP directly to exercise the actual authority.
      const { status, payload } = await new Promise((resolve, reject) => {
        const request = httpRequest(
          base + prefix + "/auth/guest",
          {
            method: "POST",
            headers: {
              "Sec-Fetch-Site": "same-origin",
              "Content-Type": "application/json",
              ...headers,
            },
          },
          (response) => {
            let body = "";
            response.on("data", (chunk) => (body += chunk));
            response.on("end", () => {
              try {
                resolve({
                  status: response.statusCode,
                  payload: JSON.parse(body),
                });
              } catch (error) {
                reject(error);
              }
            });
          },
        );
        request.on("error", reject);
        request.end(
          JSON.stringify({ automatic: true, devID: "origin-test-device" }),
        );
      });
      assert.equal(
        status,
        200,
        prefix + " " + JSON.stringify(headers) + ": " + payload.msg,
      );
      assert.equal(payload.data.userId, 77);
      assert.deepEqual(
        calls.slice(count).map((call) => call.path),
        ["/api/app/auth/guest"],
      );
      assert.equal(payload.data.token, undefined);
    }
});

test("browser POSTs preserve upstream authorization errors after proxy forwarding", async () => {
  responseOverrides["auth/guest"] = { status: 403, code: 403 };
  try {
    for (const prefix of ["/api", "/api/app"]) {
      const count = calls.length;
      const response = await fetch(base + prefix + "/auth/guest", {
        method: "POST",
        headers: {
          Origin: "https://cdn.drama.example",
          "Content-Type": "application/json",
        },
        body: "{}",
      });
      assert.equal(response.status, 403);
      assert.equal((await response.json()).code, 403);
      assert.deepEqual(
        calls.slice(count).map((call) => call.path),
        ["/api/app/auth/guest"],
      );
    }
  } finally {
    delete responseOverrides["auth/guest"];
  }
});

test("public content ignores expired credentials; double-encoded data is normalized", async () => {
  await fetch(base + "/api/app/playlet/home", {
    headers: { Cookie: "drama_session=expired" },
  });
  assert.equal(
    calls.findLast((call) => call.path.endsWith("/playlet/home")).auth,
    undefined,
  );
  const response = await fetch(base + "/api/app/playlet/search?keyword=abc");
  const payload = await response.json();
  assert.equal(payload.data.list[0].id, 23456);
});

test("registered session expiry never retries a write as a guest", async () => {
  const guestCount = calls.filter((call) =>
    call.path.endsWith("/auth/guest"),
  ).length;
  const response = await fetch(base + "/api/app/playlet/collect/set", {
    method: "POST",
    headers: {
      Cookie: "drama_session=expired; drama_registered=1",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ id: 23456, isCollect: true }),
  });
  assert.equal(response.status, 401);
  assert.equal((await response.json()).code, 1000);
  assert.equal(
    calls.filter((call) => call.path.endsWith("/auth/guest")).length,
    guestCount,
  );
  assert.equal(response.headers.get("X-Auth-State"), "login-required");
  assert.ok(
    !response.headers
      .getSetCookie()
      .some(
        (value) =>
          value.startsWith("drama_session=;") && value.includes("Max-Age=0"),
      ),
  );
});

test("login sends device/channel and trimmed credentials without attaching the previous identity", async () => {
  const response = await fetch(base + "/api/app/auth/login", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-Real-IP": "203.0.113.9",
      Cookie:
        "drama_session=old-guest; drama_device=device-stable; drama_channel=first",
    },
    body: JSON.stringify({
      account: " player01 ",
      password: " Secure123 ",
      devID: "different",
      channel: "later",
    }),
  });
  assert.equal(response.status, 200);
  const data = await response.json();
  assert.equal(data.data.userId, 88);
  assert.equal(data.data.token, undefined);
  const call = calls.at(-1);
  assert.equal(call.auth, undefined);
  assert.deepEqual(JSON.parse(call.body), {
    account: "player01",
    password: " Secure123 ",
    devID: "device-stable",
    channel: "first",
  });
  assert.ok(call.device.includes("SysType=h5_pc;Ver=1.0.0;"));
  assert.equal(call.ip, "203.0.113.9");
  assert.ok(
    response.headers
      .getSetCookie()
      .some((value) => value.startsWith("drama_registered=1;")),
  );
});

test("switching accounts logs in on a new device without keeping the previous identity", async () => {
  const response = await fetch(base + "/api/app/auth/login", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie:
        "drama_session=old-guest; drama_device=device-stable; drama_channel=first",
    },
    body: JSON.stringify({
      account: " player02 ",
      password: "Secure123",
      switchAccount: true,
      devID: "different",
    }),
  });
  assert.equal(response.status, 200);
  assert.equal((await response.json()).data.userId, 88);
  const login = calls.filter((call) => call.path.endsWith("/auth/login")).at(-1);
  assert.equal(login.auth, undefined);
  const body = JSON.parse(login.body);
  assert.equal(body.account, "player02");
  assert.equal(body.password, "Secure123");
  assert.notEqual(body.devID, "device-stable");
  assert.notEqual(body.devID, "different");
  assert.match(body.devID, /^[0-9a-f-]{36}$/i);
  assert.ok(
    response.headers
      .getSetCookie()
      .some((value) => value.startsWith("drama_session=test-registered-secret")),
  );
  assert.ok(
    response.headers
      .getSetCookie()
      .some((value) => value.startsWith("drama_device=" + body.devID)),
  );
});

test("binding retains the guest Authorization, device, channel and invite and fills the optional email", async () => {
  const response = await fetch(base + "/api/app/auth/register", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie:
        "drama_session=old-guest; drama_registered=0; drama_device=device-stable; drama_channel=first",
    },
    body: JSON.stringify({
      accountNo: " player01 ",
      password: "Secure123",
      agentInviteCode: " INV123 ",
      channel: "later",
    }),
  });
  assert.equal(response.status, 200);
  const data = await response.json();
  assert.equal(data.data.userId, 77);
  assert.equal(data.data.token, undefined);
  const call = calls.at(-1);
  assert.equal(call.auth, "old-guest");
  assert.deepEqual(JSON.parse(call.body), {
    accountNo: "player01",
    password: "Secure123",
    email: "player01@jgdj.local",
    devID: "device-stable",
    channel: "first",
    agentInviteCode: "INV123",
  });
  const memberResponse = await fetch(base + "/api/app/auth/register", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie: "drama_session=registered; drama_registered=1",
    },
    body: JSON.stringify({
      accountNo: "player02",
      password: "Secure123",
      email: "me@example.com",
    }),
  });
  assert.equal(memberResponse.status, 200);
  assert.equal(calls.at(-1).auth, undefined);
  assert.equal(JSON.parse(calls.at(-1).body).email, "me@example.com");
});

test("refresh restores an existing account and keeps its token when getInfo omits it", async () => {
  const count = calls.length;
  const response = await fetch(base + "/api/app/auth/guest", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie: "drama_session=test-registered-secret; drama_registered=1",
    },
    body: '{"automatic":true}',
  });
  assert.equal(response.status, 200);
  const data = await response.json();
  assert.equal(data.data.userId, 88);
  assert.equal(data.data.isRegister, true);
  assert.equal(data.data.token, undefined);
  assert.deepEqual(
    calls.slice(count).map((call) => call.path),
    ["/api/app/auth/getInfo"],
  );
  // Keep the browser cookie as-is when getInfo echoes the same token, so a later
  // login cookie cannot be overwritten by a stale refresh of the previous identity.
  assert.equal(
    response.headers
      .getSetCookie()
      .some((value) => value.startsWith("drama_session=")),
    false,
  );
  assert.equal(
    response.headers
      .getSetCookie()
      .some((value) => value.startsWith("drama_registered=")),
    false,
  );
});

test("an expired registered account is cleared during initialization without becoming a guest", async () => {
  const count = calls.length;
  const response = await fetch(base + "/api/app/auth/guest", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie: "drama_session=expired; drama_registered=1",
    },
    body: '{"automatic":true}',
  });
  assert.equal(response.status, 401);
  assert.equal(response.headers.get("X-Auth-State"), "login-required");
  assert.deepEqual(
    calls.slice(count).map((call) => call.path),
    ["/api/app/auth/getInfo"],
  );
  assert.ok(
    response.headers
      .getSetCookie()
      .some(
        (value) =>
          value.startsWith("drama_session=;") && value.includes("Max-Age=0"),
      ),
  );
});

test("expired guest requests recover once with the same device, including an explicitly rejected write", async () => {
  for (const [path, method, body] of [
    ["auth/getInfo", "GET", undefined],
    [
      "playlet/collect/set",
      "POST",
      JSON.stringify({ id: 23456, isCollect: true }),
    ],
  ]) {
    const count = calls.length;
    const response = await fetch(base + "/api/app/" + path, {
      method,
      headers: {
        "Content-Type": "application/json",
        Cookie:
          "drama_session=expired; drama_registered=0; drama_device=device-stable",
      },
      body,
    });
    assert.equal(response.status, 200);
    assert.equal((await response.json()).code, 200);
    const requests = calls.slice(count);
    assert.deepEqual(
      requests.map((call) => call.path),
      ["/api/app/" + path, "/api/app/auth/guest", "/api/app/" + path],
    );
    assert.equal(requests[1].auth, undefined);
    assert.equal(JSON.parse(requests[1].body).devID, "device-stable");
    assert.equal(requests[2].auth, "test-session-secret");
  }
  const count = calls.length;
  const response = await fetch(base + "/api/app/playlet/collect/set", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie: "drama_session=expired; drama_registered=0",
    },
    body: '{"id":999}',
  });
  assert.equal(response.status, 401);
  assert.equal(calls.length - count, 3);
});

test("an HTTP 401 follows the same guest recovery path", async () => {
  const count = calls.length;
  const response = await fetch(base + "/api/app/auth/getInfo", {
    headers: { Cookie: "drama_session=http-expired; drama_registered=0" },
  });
  assert.equal(response.status, 200);
  assert.equal((await response.json()).code, 200);
  assert.deepEqual(
    calls.slice(count).map((call) => call.path),
    ["/api/app/auth/getInfo", "/api/app/auth/guest", "/api/app/auth/getInfo"],
  );
});

test("SDK snapshots reach order APIs and the same drama context survives the guest retry", async () => {
  const common = {
    app_id: "1050",
    uid: "",
    channel: "organic",
    sid: "sdk-session",
    client_ts: Math.floor(Date.now() / 1000),
    device: "PC",
    device_id: "sdk-device",
    device_brand: "",
    device_model: "",
    device_fingerprint: "raw-sdk-fingerprint",
    fp_version: "3.0.1",
    user_agent: "test UA",
    sdk_version: "1.2.0",
    app_version: "1.0.0",
  };
  const sdk = Buffer.from(JSON.stringify(common)).toString("base64");
  const requestId = "1234567890abcdef1234567890abcdef",
    context = {
      v: 1,
      request_id: requestId,
      event_name: "drama_collect",
      common,
      drama: {
        media_id: "",
        drama_id: "23456",
        episode: 1,
        video_id: "90001",
        recommend_trace_id: "",
      },
    };
  const count = calls.length;
  const response = await fetch(base + "/api/app/playlet/collect/set", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie:
        "drama_session=expired; drama_registered=0; drama_device=business-device",
      "X-SDK-Common": sdk,
      "X-Tracker-Request-Id": requestId,
      "X-Tracker-Event-Name": "drama_collect",
      "X-DC-Request-Context": Buffer.from(JSON.stringify(context)).toString(
        "base64url",
      ),
    },
    body: '{"id":23456,"isCollect":true}',
  });
  assert.equal(response.status, 200);
  const requests = calls.slice(count);
  assert.equal(requests.length, 3);
  for (const call of [requests[0], requests[2]]) {
    assert.equal(call.trackerId, requestId);
    assert.equal(call.trackerEvent, "drama_collect");
    assert.deepEqual(
      JSON.parse(Buffer.from(call.trackerContext, "base64url")),
      context,
    );
    assert.equal(call.sdk, sdk);
  }
  assert.equal(requests[1].trackerContext, undefined);
  assert.equal(requests[1].sdk, sdk);
  assert.equal(JSON.parse(requests[1].body).devID, "business-device");
  await fetch(base + "/api/app/coin/buy", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie: "drama_session=test-session-secret",
      "X-SDK-Common": sdk,
    },
    body: '{"packageId":1,"payType":"alipay"}',
  });
  assert.equal(calls.at(-1).sdk, sdk);
  assert.equal(calls.at(-1).trackerContext, undefined);
});

test("bad credentials and malformed successful login responses never overwrite an existing account cookie", async () => {
  for (const [account, status] of [
    ["wrong", 200],
    ["missing-token", 502],
  ]) {
    const response = await fetch(base + "/api/app/auth/login", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        Cookie: "drama_session=valid-account; drama_registered=1",
      },
      body: JSON.stringify({ account, password: "Secure123" }),
    });
    assert.equal(response.status, status);
    assert.notEqual((await response.json()).code, 200);
    assert.ok(
      !response.headers
        .getSetCookie()
        .some(
          (value) =>
            value.startsWith("drama_session=") ||
            value.startsWith("drama_registered="),
        ),
    );
  }
});

test("proxy rejects unlisted endpoints and wrong methods before calling upstream", async () => {
  const count = calls.length;
  assert.equal(
    (
      await fetch(base + "/api/app/statcenter/sync", {
        method: "POST",
        body: "{}",
      })
    ).status,
    404,
  );
  assert.equal(
    (
      await fetch(base + "/api/app/playlet/home", {
        method: "POST",
        body: "{}",
      })
    ).status,
    404,
  );
  assert.equal(calls.length, count);
});

test("chapter permissions and identifiers are preserved from the API", async () => {
  const response = await fetch(
    base + "/api/app/playlet/chapter/detail?playletId=23456&chapterId=90001",
    { headers: { Cookie: "drama_session=test-session-secret" } },
  );
  const payload = await response.json();
  assert.equal(payload.data.id, 90001);
  assert.equal(payload.data.canWatch, false);
  assert.equal(payload.data.singleCoins, 13);
});

test("confirmed chapter unlock forwards the exact episode and identity and returns the upstream balance", async () => {
  const count = calls.length;
  const response = await fetch(base + "/api/app/playlet/chapter/unlock", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Cookie:
        "drama_session=test-session-secret; drama_device=unlock-test-device",
    },
    body: JSON.stringify({ playletId: 23456, chapterId: 90001 }),
  });
  assert.equal(response.status, 200);
  const payload = await response.json();
  assert.equal(payload.code, 200);
  assert.equal(payload.data.balance, 77);
  assert.equal(calls.length, count + 1);
  const call = calls.at(-1);
  assert.equal(call.path, "/api/app/playlet/chapter/unlock");
  assert.equal(call.auth, "test-session-secret");
  assert.deepEqual(JSON.parse(call.body), {
    playletId: 23456,
    chapterId: 90001,
  });
  assert.ok(call.device.includes("SysType=h5_pc;Ver=1.0.0;"));
});

test("media proxy preserves signed URLs and HLS content while isolating application credentials", async () => {
  const query = "?token=a%2Fb+1&sig=x%252Fy";
  const ua = "browser-media-ua",
    xua = "DevType=client;SysType=h5_pc;Ver=1.0.0;BuildID=web;sid=media-sid";
  const response = await fetch(base + "/h5/m3u8/folder/movie.m3u8" + query, {
    redirect: "manual",
    headers: {
      Authorization: "private",
      Cookie: "drama_session=private",
      "User-Agent": ua,
      "X-User-Agent": xua,
      "X-Forwarded-For": "203.0.113.10, 10.0.0.1",
    },
  });
  assert.equal(response.status, 200);
  assert.equal(response.headers.get("location"), null);
  assert.equal(
    response.headers.get("content-type"),
    "application/vnd.apple.mpegurl",
  );
  assert.equal(await response.text(), playlist);
  assert.equal(response.headers.get("cache-control"), "no-store");
  const upstream = calls.findLast(
    (call) => call.path === "/h5/m3u8/folder/movie.m3u8",
  );
  assert.equal(upstream.search, query);
  assert.equal(upstream.auth, undefined);
  assert.equal(upstream.cookie, undefined);
  assert.equal(upstream.ip, "203.0.113.10");
  assert.equal(upstream.forwarded, undefined);
  assert.equal(upstream.ua, ua);
  assert.equal(upstream.device, xua);
  assert.equal(upstream.accept, "*/*");
});

test("both key endpoint forms proxy exact AES bytes without redirects or credential forwarding", async () => {
  for (const path of ["/enkey", "/enkey/", "/newenkey", "/newenkey/"]) {
    const response = await fetch(base + path + "?token=a%2Fb+1", {
      redirect: "manual",
      headers: { Cookie: "drama_session=private", "X-Real-IP": "203.0.113.11" },
    });
    assert.equal(response.status, 200, path);
    assert.equal(response.headers.get("location"), null);
    assert.equal(
      response.headers.get("content-type"),
      "application/octet-stream",
    );
    assert.equal(response.headers.get("cache-control"), "no-store");
    assert.equal(response.headers.get("access-control-allow-origin"), "*");
    assert.deepEqual(
      Buffer.from(await response.arrayBuffer()),
      Buffer.from(Array.from({ length: 16 }, (_, index) => index)),
    );
    const upstream = calls.at(-1);
    assert.equal(upstream.path, path.replace(/\/$/, ""));
    assert.equal(upstream.search, "?token=a%2Fb+1");
    assert.equal(upstream.cookie, undefined);
    assert.equal(upstream.ip, "203.0.113.11");
    assert.equal(upstream.forwarded, undefined);
  }
});

test("key endpoints support a legacy upstream slash redirect internally without redirecting the browser or losing signatures", async () => {
  upstreamKeySlash = true;
  try {
    for (const path of ["/enkey", "/newenkey"]) {
      const count = calls.length,
        query = "?id=12700&t=123&ticket=a%2Fb+1&ticket=x%252Fy";
      const response = await fetch(base + path + query, {
        redirect: "manual",
        headers: {
          Cookie: "drama_session=private",
          Authorization: "private",
          "X-Real-IP": "203.0.113.12",
        },
      });
      assert.equal(response.status, 200);
      assert.equal(response.headers.get("location"), null);
      assert.equal((await response.arrayBuffer()).byteLength, 16);
      const forwarded = calls.slice(count);
      assert.deepEqual(
        forwarded.map((call) => call.path),
        [path, path + "/"],
      );
      for (const call of forwarded) {
        assert.equal(call.search, query);
        assert.equal(call.ip, "203.0.113.12");
        assert.equal(call.auth, undefined);
        assert.equal(call.cookie, undefined);
        assert.equal(call.forwarded, undefined);
      }
    }
  } finally {
    upstreamKeySlash = false;
  }
});

test("media byte ranges and upstream failure states remain usable by the player", async () => {
  const segment = await fetch(base + "/h5/m3u8/folder/a.ts?token=signed", {
    headers: { Range: "bytes=0-2" },
  });
  assert.equal(segment.status, 206);
  assert.equal(segment.headers.get("content-range"), "bytes 0-2/10");
  assert.equal(segment.headers.get("content-type"), "video/mp2t");
  assert.deepEqual(
    Buffer.from(await segment.arrayBuffer()),
    Buffer.from([9, 8, 7]),
  );
  assert.equal(calls.at(-1).range, "bytes=0-2");
  for (const path of [
    "/h5/m3u8/denied.m3u8",
    "/h5/m3u8/invalid.m3u8",
    "/h5/m3u8/redirect.m3u8",
    "/enkey?invalid=1",
    "/newenkey/?invalid=1",
  ]) {
    const response = await fetch(base + path, { redirect: "manual" });
    assert.equal(response.status, 502, path);
    assert.equal(response.headers.get("location"), null, path);
  }
  assert.equal((await fetch(base + "/h5/m3u8/missing.m3u8")).status, 404);
});

function currentMain(html, id) {
  const match = html.match(
    new RegExp('<main\\b[^>]*\\bid="' + id + '"[^>]*>[\\s\\S]*?<\\/main>'),
  );
  assert.ok(match, "main " + id + " must exist");
  assert.ok(
    !/^<main[^>]*\shidden(?:[=\s>])/.test(match[0]),
    id + " must be visible",
  );
  return match[0];
}

test("public listings return their own cards, page links and titles as initial HTML with one shared metadata/body read", async () => {
  try {
    listPayload = (endpoint, url) => {
      const page = Number(url.searchParams.get("pageNum") || 1),
        id = page === 2 ? 24002 : 24001;
      return {
        name: "栏目专属标题",
        desc: "专题简介",
        list: [
          {
            ...fixture,
            id,
            title: "列表第" + page + "页内容",
            name: "专题第" + page + "页",
            desc: "专题描述",
          },
        ],
        totalCount: 72,
      };
    };
    const routes = [
      ["/shorts/", "playlet/operate/list"],
      ["/shorts/page/2/", "playlet/operate/list"],
      ["/rank/hot/", "playlet/hot/rank/list"],
      ["/rank/new/page/2/", "playlet/hot/rank/list"],
      ["/rank/follow/", "playlet/hot/rank/list"],
      ["/topics/", "playlet/topic/list"],
      ["/topics/7/page/2/", "playlet/topic/detail"],
      ["/theme/8/", "playlet/all/list"],
      ["/tag/9/", "playlet/tag/list"],
    ];
    for (const [path, endpoint] of routes) {
      const start = calls.length,
        response = await fetch(base + path);
      assert.equal(response.status, 200, path);
      const html = await response.text(),
        main = currentMain(html, "channel-page"),
        page = path.includes("/page/2/") ? 2 : 1;
      assert.ok(
        main.includes(
          path === "/topics/" ? "专题第1页" : "列表第" + page + "页内容",
        ),
        path,
      );
      assert.ok(
        main.includes("/page/3/"),
        path + " must contain native pagination links",
      );
      assert.ok(
        !html.includes("后台配置标题"),
        path + " must not embed the homepage",
      );
      const reads = calls.slice(start);
      assert.equal(
        reads.filter((call) => call.path === "/api/app/" + endpoint).length,
        1,
        path + " must share metadata/body data",
      );
      if (!path.startsWith("/topics/"))
        assert.ok(
          !reads.some((call) => call.path === "/api/app/playlet/home"),
          path,
        );
      assertPageLinksHaveTrailingSlash(main);
    }
    for (const slug of ["hot", "new", "follow"]) {
      const main = currentMain(
        await (await fetch(base + "/rank/" + slug + "/")).text(),
        "channel-page",
      );
      assert.match(
        main,
        new RegExp('href="/rank/' + slug + '/" aria-current="page"'),
      );
    }
  } finally {
    listPayload = undefined;
  }
});

test("standalone lists use H2 card titles while cards within named sections remain H3 in initial HTML", async () => {
  const savedHome = homePayload;
  try {
    listPayload = {
      name: "列表名称",
      list: [{ ...fixture, name: "专题卡片" }],
      totalCount: 72,
    };
    homePayload = {
      ...savedHome,
      homeConfigData: [
        { id: 31, name: "短剧分区", status: true, type: 1, list: [fixture] },
        {
          id: 32,
          name: "专题推荐分区",
          status: true,
          type: 3,
          themeList: [{ id: 8, name: "首页专题卡片" }],
        },
      ],
    };
    for (const path of [
      "/shorts/",
      "/shorts/page/2/",
      "/rank/hot/",
      "/rank/new/page/2/",
      "/rank/follow/",
      "/topics/",
      "/topics/7/",
      "/theme/8/",
      "/tag/9/",
      "/config/31/",
      "/config/32/",
    ]) {
      const response = await fetch(base + path);
      assert.equal(response.status, 200, path);
      const main = currentMain(await response.text(), "channel-page");
      assert.equal((main.match(/<h1\b/g) || []).length, 1, path);
      assert.equal((main.match(/<h2\b/g) || []).length, 1, path);
      assert.ok(!/<h3\b/.test(main), path + " has no intermediate H2 section");
    }
    const home = await (await fetch(base)).text();
    for (const id of [31, 32]) {
      const section = home.match(
        new RegExp(
          '<section\\b[^>]*\\baria-labelledby="home-block-' +
            id +
            '"[^>]*>([\\s\\S]*?)<\\/section>',
        ),
      )?.[1];
      assert.ok(section);
      assert.equal((section.match(/<h2\b/g) || []).length, 1);
      assert.equal(
        (section.match(/<h3\b/g) || []).length,
        1,
        "homepage cards are below their section heading",
      );
    }
    accountListPayload = { list: [fixture], totalCount: 1 };
    const member = await (
      await fetch(base + "/member/center/", {
        headers: { Cookie: "drama_bearer=test-session-secret" },
      })
    ).text();
    const shelf = member.match(
      /<section class="member-library"[^>]*>([\s\S]*?)<\/section>/,
    )?.[1];
    assert.ok(shelf);
    assert.match(shelf, /<h2 id="member-library-title"/);
    assert.match(shelf, /<h3>/);
    const detail = currentMain(
      await (await fetch(base + "/detail/23456/")).text(),
      "drama-play-page",
    );
    assert.match(
      detail,
      /<aside class="play-related"><h2>热门短剧<\/h2>[\s\S]*?<h3>同类推荐短剧<\/h3>/,
    );
    const search = currentMain(
      await (await fetch(base + "/search/关键词/")).text(),
      "search-results-page",
    );
    assert.match(search, /<h1\b/);
    assert.match(search, /<h2>/);
    assert.ok(!/<h3\b/.test(search));
  } finally {
    homePayload = savedHome;
    listPayload = accountListPayload = undefined;
  }
});

test("detail, playback, video and comment pages contain real initial content without exposing private payloads or denied video sources", async () => {
  try {
    detailSeo = {
      desc: "服务端剧集完整简介",
      token: "private-detail-token",
      reportSdkConfig: { secret: "private-sdk-secret" },
    };
    chapterListPayload = {
      list: [
        {
          id: 90001,
          currentEpisode: 1,
          canWatch: true,
          videoUrl: "https://cdn.example/free.mp4",
        },
        {
          id: 90002,
          currentEpisode: 2,
          canWatch: false,
          needUnlock: true,
          payType: 1,
          singleCoins: 13,
          videoUrl: "https://cdn.example/denied-video-secret.mp4",
        },
      ],
    };
    chapterPayload = { ...chapterListPayload.list[1], playletId: 23456 };
    commentPayload = {
      list: [
        {
          id: 45,
          text: "服务端第2页评论",
          userName: "评论用户",
          token: "private-comment-token",
          children: [{ id: 46, text: "嵌套回复" }],
        },
      ],
      totalCount: 25,
    };
    videoPayload = {
      ...fixture,
      id: 23457,
      title: "服务端独立视频",
      video: {
        url: "https://cdn.example/public-video.mp4",
        cover: fixture.cover,
      },
      desc: "视频真实简介",
    };
    for (const path of [
      "/detail/23456/page/2/?commentSort=1",
      "/play/23456/90002/page/2/",
    ]) {
      const start = calls.length,
        response = await fetch(base + path);
      assert.equal(response.status, 200);
      const html = await response.text(),
        main = currentMain(html, "drama-play-page");
      assert.ok(main.includes("服务端第2页评论"));
      assert.ok(main.includes("嵌套回复"));
      assert.ok(main.includes("评论 (25)"));
      assert.ok(main.includes("/page/3/"));
      assert.ok(!html.includes("后台配置标题"));
      for (const secret of [
        "private-detail-token",
        "private-comment-token",
        "private-sdk-secret",
        "denied-video-secret.mp4",
      ])
        assert.ok(!html.includes(secret), secret);
      assert.equal(
        calls
          .slice(start)
          .filter((call) => call.path === "/api/app/comment/list").length,
        1,
        "metadata/body must share comments",
      );
      if (path.startsWith("/video/")) {
        assert.ok(main.includes("服务端独立视频"));
        assert.ok(main.includes("<video "));
      } else {
        assert.ok(main.includes("服务端剧集完整简介"));
        assert.ok(main.includes('href="/play/23456/90001/"'));
        assert.ok(main.includes('data-locked-chapter="90002"'));
        if (path.startsWith("/detail/"))
          assert.ok(main.includes("is-overview"));
        else assert.ok(main.includes("<video "));
      }
      assertPageLinksHaveTrailingSlash(main);
    }
  } finally {
    detailSeo = undefined;
    chapterPayload = undefined;
    chapterListPayload = undefined;
    commentPayload = undefined;
    videoPayload = undefined;
  }
});

test("search paths decode keyword segments once and include keyword/result cards before JavaScript runs", async () => {
  for (const keyword of [
    "都市 爱情",
    "都市 / 爱情 & 100% #1",
    "字面%2F保持原样",
  ]) {
    const start = calls.length,
      path = "/search/" + encodeURIComponent(keyword) + "/";
    const response = await fetch(base + path);
    assert.equal(response.status, 200);
    const html = await response.text(),
      main = currentMain(html, "search-results-page");
    const escaped = keyword.replaceAll("&", "&amp;");
    assert.ok(main.includes(escaped), keyword);
    assert.ok(main.includes('href="/detail/23456/"'));
    assert.ok(main.includes("接口剧名 &lt;script&gt;"));
    assert.ok(!html.includes("后台配置标题"));
    assert.ok(!main.includes("<script>alert(1)</script>"));
    const reads = calls
      .slice(start)
      .filter((call) => call.path === "/api/app/playlet/search");
    assert.equal(reads.length, 1);
    assert.equal(new URLSearchParams(reads[0].search).get("keyword"), keyword);
  }
});

test("search path pagination renders keyword links and rejects empty paginated searches", async () => {
  const keyword = "都市 / 爱情 & 100% #1",
    path = "/search/" + encodeURIComponent(keyword) + "/";
  try {
    searchPayload = { list: [fixture], totalCount: 76, pageSize: 25 };
    const start = calls.length,
      response = await fetch(base + path + "page/2/", { redirect: "manual" });
    assert.equal(response.status, 200);
    assert.equal(response.headers.get("location"), null);
    const html = await response.text(),
      main = currentMain(html, "search-results-page");
    for (const href of [path, path + "page/3/"])
      assert.ok(main.includes('href="' + href + '"'), href);
    assert.ok(!main.includes("/search/?q="));
    assert.ok(html.includes("都市 / 爱情 &amp; 100% #1 · 搜索结果 - 第2页"));
    assert.ok(!html.includes('rel="canonical"'));
    assert.match(html, /<meta name="robots" content="noindex, follow/);
    const read = calls
      .slice(start)
      .find((call) => call.path === "/api/app/playlet/search");
    assert.equal(new URLSearchParams(read.search).get("keyword"), keyword);
    assert.equal(new URLSearchParams(read.search).get("pageNum"), "2");
    const empty = await fetch(base + "/search/page/2/", { redirect: "manual" });
    assert.equal(empty.status, 404);
    assert.equal(empty.headers.get("location"), null);
  } finally {
    searchPayload = undefined;
  }
});

test("Chinese content slugs generate ID-based links in rendered pages and structured data", async () => {
  const savedHome = homePayload;
  try {
    const drama = { ...fixture, slug: "都市故事" };
    homePayload = {
      homeBannerData: [drama],
      hotSearch: [{ keyword: "都市爱情" }],
      homeConfigData: [
        {
          id: 31,
          slug: "精选好剧",
          name: "精选好剧",
          status: true,
          type: 1,
          list: [drama],
        },
        {
          id: 32,
          slug: "专题合集",
          name: "专题合集",
          status: true,
          type: 3,
          themeList: [{ id: 7, slug: "都市专题", name: "都市专题" }],
        },
      ],
    };
    const home = await (await fetch(base + "/")).text();
    for (const href of [
      "/detail/23456/",
      "/topics/7/",
      "/config/31/",
      "/search/" + encodeURIComponent("都市爱情") + "/",
    ])
      assert.ok(home.includes('href="' + href + '"'), href);
    detailSeo = {
      slug: "都市故事",
      title: "都市故事",
      tagNames: ["都市", "无标识标签"],
      tagIds: [9],
      tagSlugs: ["都市", "中文标签"],
    };
    chapterPayload = {
      id: 90001,
      playletId: 23456,
      currentEpisode: 1,
      canWatch: true,
      videoUrl: "https://media.drama.test/1.mp4",
    };
    const detail = await (await fetch(base + "/play/23456/90001/")).text();
    assert.ok(detail.includes('href="/tag/9/"'));
    assert.ok(detail.includes("<span>无标识标签</span>"));
    assert.ok(!detail.includes('href="/tag//"'));
    assert.ok(
      detail.includes(
        'rel="canonical" href="https://default.drama.test/play/23456/90001/"',
      ),
    );
    for (const html of [home, detail]) {
      for (const [, href] of html.matchAll(/<a\b[^>]*href="(\/[^"#?]*)/g))
        if (!href.startsWith("/search/"))
          assert.ok(!/[^\x00-\x7f]/.test(decodeURIComponent(href)), href);
    }
  } finally {
    homePayload = savedHome;
    detailSeo = chapterPayload = undefined;
  }
});

test("a search service outage returns a server error instead of a successful empty search page", async () => {
  try {
    searchFailure = true;
    const response = await fetch(
      base + "/search/" + encodeURIComponent("服务异常") + "/",
    );
    assert.equal(response.status, 500);
    const html = await response.text();
    assert.ok(!html.includes("后台配置标题"));
    assert.ok(!html.includes('rel="canonical"'));
  } finally {
    searchFailure = false;
  }
});

test("missing resources return actual 404 responses for browsers and crawlers, without redirects or content canonical", async () => {
  try {
    for (const agent of ["Mozilla/5.0 Chrome/130", "Googlebot", "YandexBot"]) {
      for (const [path, endpoint, override] of [
        ["/detail/23456/", "playlet/detail", { status: 404 }],
        ["/detail/23456/", "playlet/detail", { code: 404 }],
        ["/detail/23456/", "playlet/detail", { code: 410 }],
        ["/detail/23456/", "playlet/detail", { code: 5009 }],
        ["/detail/23456/", "playlet/detail", { data: null }],
        ["/play/23456/90001/", "playlet/chapter/detail", { status: 404 }],
        ["/play/23456/90001/", "playlet/chapter/detail", { data: null }],
        ["/play/23456/90001/", "playlet/chapter/detail", { code: 5009 }],
        ["/topics/7/", "playlet/topic/detail", { code: 404 }],
        ["/topics/7/", "playlet/topic/detail", { code: 5009 }],
        [
          "/topics/7/",
          "playlet/topic/detail",
          { data: { id: 8, name: "其他专题", list: [], totalCount: 0 } },
        ],
        ["/theme/7/", "playlet/all/list", { status: 404 }],
        ["/tag/7/", "playlet/tag/list", { code: 410 }],
      ]) {
        responseOverrides = { [endpoint]: override };
        const response = await fetch(base + path, {
            redirect: "manual",
            headers: { "User-Agent": agent },
          }),
          html = await response.text();
        assert.equal(
          response.status,
          404,
          agent + " " + path + " " + JSON.stringify(override),
        );
        assert.equal(response.headers.get("location"), null);
        assert.ok(html.includes("noindex"));
        assert.match(response.headers.get("cache-control"), /no-store/);
        assert.ok(!html.includes('rel="canonical"'));
        assert.ok(!/<script\b[^>]*data-site-json-ld=/.test(html));
        assert.ok(html.includes("返回首页"));
      }
    }
    responseOverrides = {};
    for (const path of [
      "/config/999999/",
      "/detail/999999/",
      "/play/23456/999999/",
      "/tag/999999/",
    ]) {
      const response = await fetch(base + path, { redirect: "manual" });
      assert.equal(response.status, 404, path);
      await response.text();
    }
    for (const path of ["/detail/23456/", "/play/23456/90001/"]) {
      const response = await fetch(base + path);
      assert.equal(
        response.status,
        200,
        "valid/locked content stays available",
      );
      await response.text();
    }
  } finally {
    responseOverrides = {};
  }
});

test("known pagination limits return 404 while existing empty first pages remain 200", async () => {
  try {
    listPayload = { list: [], totalCount: 0 };
    for (const path of [
      "/shorts/",
      "/rank/hot/",
      "/rank/new/",
      "/rank/follow/",
      "/topics/",
      "/topics/7/",
      "/theme/8/",
      "/tag/9/",
    ]) {
      const first = await fetch(base + path);
      assert.equal(first.status, 200, path);
      const emptyHtml = await first.text();
      assert.match(
        emptyHtml,
        /<meta name="robots" content="noindex,\s*follow"/,
      );
      assert.ok(!emptyHtml.includes('rel="canonical"'));
      assert.ok(!/<script\b[^>]*data-site-json-ld=/.test(emptyHtml));
      const overflow = await fetch(base + path + "page/2/", {
        redirect: "manual",
      });
      assert.equal(overflow.status, 404, path);
      await overflow.text();
    }
    listPayload = { list: [fixture], totalCount: 48 };
    commentPayload = transactionsPayload = { list: [], totalCount: 20 };
    accountListPayload = { list: [], totalCount: 48 };
    searchPayload = { list: [fixture], totalCount: 48, pageSize: 24 };
    for (const path of [
      "/shorts/",
      "/rank/hot/",
      "/rank/new/",
      "/rank/follow/",
      "/topics/",
      "/topics/7/",
      "/theme/8/",
      "/tag/9/",
      "/detail/23456/",
      "/play/23456/90001/",
      "/search/关键词/",
      "/member/history/",
      "/member/favorites/",
      "/member/purchased/",
      "/info/deposit/",
      "/info/deposit/vip/",
    ]) {
      for (const [page, status] of [
        [2, 200],
        [3, 404],
      ]) {
        const privatePath=/^\/(member\/|info\/deposit)/.test(path);
        const response = await fetch(base + path + "page/" + page + "/", {
            redirect: "manual",
            headers: privatePath
              ? { Cookie: "drama_bearer=test-session-secret" }
              : undefined,
          }),
          html = await response.text();
        assert.equal(response.status, status, path + " page " + page);
        assert.equal(response.headers.get("location"), null);
        if (status === 404) {
          assert.ok(html.includes("noindex"));
          assert.ok(!html.includes('rel="canonical"'));
          assert.ok(!html.includes('rel="next"'));
        }
      }
    }
    const config = await fetch(base + "/config/31/page/2/");
    assert.equal(config.status, 404);
    await config.text();
    searchPayload = { list: [], totalCount: 0 };
    const emptySearch = await fetch(base + "/search/没有匹配项/");
    assert.equal(emptySearch.status, 200);
    assert.ok((await emptySearch.text()).includes("搜索无结果"));
  } finally {
    listPayload =
      commentPayload =
      transactionsPayload =
      accountListPayload =
      searchPayload =
        undefined;
  }
});

test("independent theme/topic resources and leading-zero IDs retain their primary canonical", async () => {
  try {
    themePayload = { list: [{ id: 7, name: "同一题材" }] };
    listPayload = {
      name: "同一专题",
      desc: "同一专题介绍",
      list: [fixture],
      totalCount: 72,
    };
    for (const [path, target] of [
      ["/theme/007/", "/theme/7/"],
      ["/theme/007/page/2/", "/theme/7/page/2/"],
      ["/topics/007/", "/topics/7/"],
      ["/detail/023456/", "/detail/23456/"],
    ]) {
      const start = calls.length,
        response = await fetch(base + path + "?utm_source=campaign", {
          redirect: "manual",
        }),
        html = await response.text();
      assert.equal(response.status, 200, path);
      assert.equal(response.headers.get("location"), null);
      assert.ok(
        html.includes(
          `rel="canonical" href="https://default.drama.test${target}"`,
        ),
        path,
      );
      assert.match(html, /<meta name="robots" content="index,\s*follow/);
      assert.ok(
        html.includes(
          path.startsWith("/detail/")
            ? "play-detail-title"
            : path.startsWith("/theme/")
              ? "同一题材"
              : "同一专题",
        ),
      );
      if (path.startsWith("/theme/"))
        assert.equal(
          calls
            .slice(start)
            .filter((call) => call.path === "/api/app/playlet/all/list").length,
          1,
        );
    }
  } finally {
    listPayload = themePayload = undefined;
  }
});

test("comment pages stay usable but noindex, while ordinary catalog pagination remains indexable", async () => {
  try {
    commentPayload = {
      list: [{ id: 321, text: "第二页的真实评论" }],
      totalCount: 25,
    };
    chapterPayload = {
      id: 90001,
      playletId: 23456,
      currentEpisode: 2,
      canWatch: true,
      videoUrl: "https://media.drama.test/2.mp4",
    };
    for (const path of ["/detail/23456/page/2/", "/play/23456/90001/page/2/"]) {
      const response = await fetch(base + path, {
          redirect: "manual",
          headers: { "User-Agent": "YandexBot" },
        }),
        html = await response.text();
      assert.equal(response.status, 200);
      assert.equal(response.headers.get("location"), null);
      assert.match(html, /<meta name="robots" content="noindex,\s*follow"/);
      assert.ok(!html.includes('rel="canonical"'));
      assert.ok(!/<script\b[^>]*data-site-json-ld=/.test(html));
      assert.ok(html.includes("第二页的真实评论"));
      assert.ok(
        html.includes('href="' + path.replace("/page/2/", "/page/3/") + '"'),
      );
    }
    listPayload = { list: [fixture], totalCount: 72 };
    const html = await (await fetch(base + "/shorts/page/2/")).text();
    assert.match(html, /<meta name="robots" content="index,\s*follow/);
    assert.ok(
      html.includes(
        'rel="canonical" href="https://default.drama.test/shorts/page/2/"',
      ),
    );
  } finally {
    commentPayload = chapterPayload = listPayload = undefined;
  }
});

test("SSR applies more-list content rules and real episode access rules without exposing locked media", async () => {
  const savedHome = homePayload;
  try {
    const block = {
      id: 31,
      status: true,
      name: "都市精选",
      type: 1,
      list: [fixture],
    };
    for (const [desc, indexable] of [
      ["", false],
      ["精选都市短剧与独立栏目介绍", true],
    ]) {
      homePayload = { ...savedHome, homeConfigData: [{ ...block, desc }] };
      const response = await fetch(base + "/config/31/"),
        html = await response.text();
      assert.equal(response.status, 200);
      assert.equal(/<meta name="robots" content="index,/.test(html), indexable);
      assert.equal(html.includes('rel="canonical"'), indexable);
      assert.ok(currentMain(html, "channel-page").includes("都市精选"));
    }
    detailSeo = { desc: "剧集共用简介", onlineAt: "2025-10-18 10:30:00" };
    const chapter = {
      id: 90001,
      playletId: 23456,
      currentEpisode: 3,
      payType: 1,
      videoUrl: "https://media.drama.test/paid-episode.m3u8",
    };
    for (const allowed of [false, true]) {
      chapterPayload = { ...chapter, canWatch: allowed, needUnlock: !allowed };
      const response = await fetch(base + "/play/23456/90001/"),
        html = await response.text();
      assert.equal(response.status, 200);
      assert.equal(/<meta name="robots" content="index,/.test(html), allowed);
      assert.equal(html.includes('rel="canonical"'), allowed);
      assert.equal(html.includes(chapter.videoUrl), allowed);
      assert.ok(html.includes('class="play-screen play-paywalled-content"'));
      if (allowed) {
        const graph = JSON.parse(
          html.match(
            /<script\b[^>]*data-site-json-ld=""[^>]*>([\s\S]*?)<\/script>/,
          )[1],
        )["@graph"];
        const page = graph.find((node) => node["@type"] === "WebPage");
        assert.equal(page.isAccessibleForFree, false);
        assert.equal(page.hasPart.cssSelector, ".play-paywalled-content");
        assert.equal(
          graph.find((node) => node["@type"] === "VideoObject")
            .isAccessibleForFree,
          false,
        );
      } else assert.ok(!/<script\b[^>]*data-site-json-ld=/.test(html));
    }
    chapterPayload = {
      ...chapter,
      canWatch: true,
      needUnlock: false,
      payType: 0,
      videoUrl: "",
    };
    const html = await (await fetch(base + "/play/23456/90001/")).text();
    assert.match(html, /<meta name="robots" content="noindex/);
    assert.ok(!html.includes('rel="canonical"'));
  } finally {
    homePayload = savedHome;
    detailSeo = chapterPayload = undefined;
  }
});

test("primary data outages and malformed responses return 5xx rather than 200 or a permanent 404", async () => {
  try {
    for (const agent of ["Mozilla/5.0 Chrome/130", "Googlebot", "YandexBot"]) {
      for (const [path, endpoint, override] of [
        ["/", "playlet/home", { status: 503 }],
        ["/", "playlet/home", { data: null }],
        ["/", "playlet/home", { raw: "invalid json" }],
        ["/shorts/", "playlet/operate/list", { status: 503 }],
        ["/shorts/page/9/", "playlet/operate/list", { code: 5100 }],
        ["/shorts/", "playlet/operate/list", { status: 404 }],
        ["/shorts/", "playlet/operate/list", { data: null }],
        ["/detail/23456/", "playlet/detail", { status: 503 }],
        ["/detail/23456/", "playlet/detail", { code: 5100 }],
        ["/detail/23456/", "playlet/detail", { raw: "invalid json" }],
        ["/detail/23456/", "playlet/detail", { data: "bad" }],
        ["/detail/23456/", "playlet/detail", { data: { id: 23456 } }],
        ["/play/23456/90001/", "playlet/chapter/detail", { status: 503 }],
        ["/topics/7/", "playlet/topic/detail", { status: 503 }],
        ["/search/关键词/", "playlet/search", { code: 5100 }],
        ["/apps/", "applist/list", { status: 503 }],
        ["/navigation/", "config/info", { status: 503 }],
        ["/home-road/", "config/info", { status: 503 }],
        ["/tag/9/", "playlet/tag/options", { status: 503 }],
        ["/tag/9/", "playlet/tag/options", { status: 404 }],
        ["/tag/9/", "playlet/tag/options", { code: 5009 }],
      ]) {
        responseOverrides = { [endpoint]: override };
        const response = await fetch(base + path, {
            redirect: "manual",
            headers: { "User-Agent": agent },
          }),
          html = await response.text();
        assert.equal(
          response.status,
          500,
          agent + " " + path + " " + JSON.stringify(override),
        );
        assert.equal(response.headers.get("location"), null);
        assert.match(response.headers.get("cache-control"), /no-store/);
        assert.ok(!html.includes('rel="canonical"'));
        assert.ok(!/<script\b[^>]*data-site-json-ld=/.test(html));
        assert.ok(!html.includes("test-session-secret"));
      }
    }
    responseOverrides = {};
    const recovered = await fetch(base + "/shorts/");
    assert.equal(recovered.status, 200);
    await recovered.text();
  } finally {
    responseOverrides = {};
  }
});

test("HEAD requests report the same missing-resource and temporary-error statuses as GET requests", async () => {
  try {
    for (const [path, endpoint, override, status] of [
      ["/detail/23456/", "playlet/detail", { code: 5009 }, 404],
      [
        "/tag/999999/",
        "playlet/tag/list",
        { data: { list: [], totalCount: 0 } },
        404,
      ],
      [
        "/shorts/page/2/",
        "playlet/operate/list",
        { data: { list: [], totalCount: 0 } },
        404,
      ],
      ["/detail/23456/", "playlet/detail", { status: 503 }, 500],
      ["/", "playlet/home", { status: 503 }, 500],
    ]) {
      responseOverrides = { [endpoint]: override };
      const response = await fetch(base + path, {
        method: "HEAD",
        redirect: "manual",
      });
      assert.equal(response.status, status, path);
      assert.equal(response.headers.get("location"), null);
      assert.equal(await response.text(), "");
    }
  } finally {
    responseOverrides = {};
  }
});

test("optional data failures preserve real detail content and do not manufacture pagination 404s", async () => {
  try {
    responseOverrides = {
      "comment/list": { status: 503 },
      "playlet/chapter/list": { status: 503 },
      "playlet/guess-like/list": { status: 503 },
    };
    for (const path of ["/detail/23456/", "/play/23456/90001/"]) {
      const response = await fetch(base + path);
      assert.equal(response.status, 200, path);
      const html = await response.text();
      assert.ok(html.includes("接口剧名"));
      assert.ok(html.includes("评论暂不可用"));
      const commentsPage = await fetch(base + path + "page/2/");
      assert.equal(
        commentsPage.status,
        500,
        "unknown comments count must not become 404",
      );
      await commentsPage.text();
    }
    responseOverrides = { "coin/trans/list": { status: 503 } };
    const wallet = await fetch(base + "/info/deposit/", {
      headers: { Cookie: "drama_bearer=test-session-secret" },
    });
    assert.equal(wallet.status, 200);
    await wallet.text();
    const page = await fetch(base + "/info/deposit/page/2/", {
      headers: { Cookie: "drama_bearer=test-session-secret" },
    });
    assert.equal(page.status, 500);
    await page.text();
  } finally {
    responseOverrides = {};
  }
});

test("current Swagger contracts drive SSR listings, flat topic detail, home more and detail recommendations", async () => {
  const start = calls.length;
  try {
    strictContract = true;
    listPayload = {
      name: "专题真实标题",
      desc: "顶层专题简介",
      list: [{ ...fixture, id: 24001 }],
      totalCount: 72,
    };
    for (const path of [
      "/shorts/page/2/?sort=2",
      "/rank/new/page/2/",
      "/topics/7/page/2/?sort=2",
      "/theme/8/",
      "/tag/9/?sort=2",
    ]) {
      const response = await fetch(base + path);
      assert.equal(response.status, 200, path);
      const html = await response.text();
      assert.ok(html.includes('href="/detail/24001/"'), path);
      if (path.includes("/topics/7/"))
        assert.ok(currentMain(html, "channel-page").includes("顶层专题简介"));
      if (path.startsWith("/theme/"))
        assert.ok(currentMain(html, "channel-page").includes("题材8"));
    }
    let html = await (await fetch(base + "/config/31/")).text();
    assert.ok(currentMain(html, "channel-page").includes("后台配置标题"));
    assert.ok(
      currentMain(html, "channel-page").includes('href="/detail/23456/"'),
    );
    assert.ok(!currentMain(html, "channel-page").includes("/page/2/"));
    html = await (await fetch(base + "/detail/23456/")).text();
    assert.ok(currentMain(html, "drama-play-page").includes("同类推荐短剧"));
    const related = calls
      .slice(start)
      .find((call) => call.path === "/api/app/playlet/guess-like/list");
    assert.equal(new URLSearchParams(related.search).get("playletId"), "23456");
    assert.ok(
      !calls
        .slice(start)
        .some((call) =>
          /\/video\/|playlet\/hot\/list|home\/config\/detail/.test(call.path),
        ),
    );
  } finally {
    strictContract = false;
    listPayload = undefined;
  }
});

test("new Swagger modules, grouped topics, config pagination and direct topic slugs render complete SSR pages", async () => {
  const savedHome = homePayload;
  try {
    strictContract = true;
    const works = Array.from({ length: 49 }, (_, index) => ({
      ...fixture,
      id: 24000 + index,
      slug: "work-" + index,
    }));
    homePayload = {
      homeBannerData: [works[0]],
      modules: [
        {
          id: 31,
          slug: "editors",
          title: "新首页栏目",
          desc: "独立栏目简介",
          moduleType: 1,
          style: "A",
          limit: 3,
          list: works,
        },
        {
          id: 32,
          title: "题材模块",
          desc: "题材介绍",
          moduleType: 2,
          style: "E",
          topicList: [{ id: 9, slug: "urban", name: "都市题材" }],
        },
      ],
    };
    themePayload = {
      list: [
        {
          id: 9,
          slug: "urban",
          name: "都市题材",
          seoInfo: { title: "题材独立标题" },
        },
      ],
    };
    const groups = [
      {
        id: 201,
        name: "热门剧单",
        desc: "专题区块介绍",
        totalCount: 49,
        list: [{ id: 7, slug: "city-topic", name: "都市专题" }],
      },
      {
        id: 202,
        name: "近期专题",
        totalCount: 25,
        list: [{ id: 8, name: "古装专题" }],
      },
    ];
    listPayload = (endpoint) =>
      endpoint === "playlet/topic/list"
        ? {
            list: groups,
            pageNum: 2,
            pageSize: 24,
            seoInfo: { title: "专题独立标题" },
          }
        : endpoint === "playlet/topic/detail"
          ? {
              id: 7,
              slug: "city-topic",
              name: "都市专题",
              list: [works[0]],
              totalCount: 49,
            }
          : { list: [works[0]], totalCount: 49 };
    let response = await fetch(base + "/"),
      html = await response.text();
    assert.equal(response.status, 200);
    for (const text of [
      "新首页栏目",
      "题材模块",
      'href="/theme/urban/"',
      'href="/config/editors/"',
    ])
      assert.ok(html.includes(text), text);
    assert.ok(html.includes('data-home-style="A"'));
    assert.ok(html.includes('data-home-style="E"'));
    assert.ok(html.includes('href="/detail/work-2/"'));
    assert.ok(!html.includes('href="/detail/work-6/"'));
    response = await fetch(base + "/config/editors/page/2/");
    html = await response.text();
    assert.equal(response.status, 200);
    const main = currentMain(html, "channel-page");
    assert.ok(main.includes("/detail/work-24/"));
    assert.ok(!main.includes("/detail/work-0/"));
    assert.ok(main.includes("/config/editors/page/3/"));
    const configRead = calls.findLast(
      (call) => call.path === "/api/app/playlet/home-config/list",
    );
    assert.equal(new URLSearchParams(configRead.search).get("pageNum"), "2");
    response = await fetch(base + "/topics/page/2/");
    html = await response.text();
    assert.equal(response.status, 200);
    for (const text of [
      "热门剧单",
      "近期专题",
      'href="/topics/city-topic/"',
      "/topics/page/3/",
    ])
      assert.ok(currentMain(html, "channel-page").includes(text), text);
    assert.ok(!currentMain(html, "channel-page").includes("/topics/page/4/"));
    const start = calls.length;
    response = await fetch(base + "/topics/city-topic/");
    assert.equal(response.status, 200);
    await response.text();
    assert.ok(
      !calls
        .slice(start)
        .some((call) => call.path === "/api/app/playlet/topic/list"),
    );
    assert.equal(
      new URLSearchParams(
        calls.findLast((call) => call.path === "/api/app/playlet/topic/detail")
          .search,
      ).get("topicSlug"),
      "city-topic",
    );
    response = await fetch(base + "/theme/urban/?sort=3&updateStatus=2");
    html = await response.text();
    assert.equal(response.status, 200);
    const themeQuery = new URLSearchParams(
      calls.findLast((call) => call.path === "/api/app/playlet/all/list")
        .search,
    );
    assert.equal(themeQuery.get("themeSlug"), "urban");
    assert.equal(themeQuery.get("updateStatus"), "2");
    assert.equal(themeQuery.get("sortType"), "3");
    assert.match(html, /<meta name="robots" content="noindex/);
    assert.ok(!html.includes('rel="canonical"'));
  } finally {
    homePayload = savedHome;
    themePayload = listPayload = undefined;
    strictContract = false;
  }
});

test("homepage SSR renders each category style directly from API configuration", async () => {
  const savedHome = homePayload;
  try {
    const styles = ["D", "A", "E", "C", "B"];
    const counts = { A: 3, B: 9, C: 8, D: 7, E: 5 };
    homePayload = {
      modules: styles.map((style, index) => ({
        id: 31 + index,
        title: "后台分类",
        slug: "section-" + style.toLowerCase(),
        style,
        limit: counts[style],
        moduleType: style === "E" ? 2 : 1,
        label: "上新推荐",
        list: Array.from({ length: 12 }, (_, item) => ({
          ...fixture,
          id: 25000 + index * 100 + item,
          slug: "style-" + style.toLowerCase() + "-" + item,
        })),
        topicList: Array.from({ length: 12 }, (_, item) => ({
          id: 100 + item,
          name: "主题 " + item,
          slug: "topic-" + item,
        })),
      })),
    };
    const response = await fetch(base + "/"),
      html = await response.text();
    assert.equal(response.status, 200);
    const blocks = [
      ...html.matchAll(
        /<section\b[^>]*\bdata-home-style="([A-E])"[^>]*>[\s\S]*?<\/section>/g,
      ),
    ];
    assert.deepEqual(
      blocks.map((match) => match[1]),
      styles,
    );
    assert.ok(html.includes('class="topic-section romance-editorial home-block" data-home-style="A"'));
    assert.ok(html.includes('id="library" class="home-block" data-home-style="B"'));
    assert.ok(html.includes('class="topic-section topic-recommendations home-block" data-home-style="E"'));
    for (const [markup, style] of blocks) {
      assert.equal(
        (markup.match(/data-track-item/g) || []).length,
        counts[style],
        style,
      );
      assert.ok(
        markup.includes(`href="/config/section-${style.toLowerCase()}/"`),
      );
      if (style === "C")
        assert.ok(markup.includes('class="curated-card drama-data-card"'));
      if (style === "D")
        assert.ok(markup.includes('aria-label="第 7 名，查看'));
      if (style === "E") assert.ok(markup.includes('href="/theme/topic-0/"'));
    }
  } finally {
    homePayload = savedHome;
  }
});

test("removed series and standalone video URLs return 404 without slash redirects or content reads", async () => {
  const before = calls.length;
  for (const path of [
    "/series",
    "/series/",
    "/series/page/2",
    "/series/page/2/",
    "/video/23456",
    "/video/23456/",
    "/video/23456/page/2",
    "/video/23456/page/2/",
  ]) {
    const response = await fetch(base + path + "?from=old-menu", {
      redirect: "manual",
    });
    assert.equal(response.status, 404, path);
    assert.equal(response.headers.get("location"), null, path);
    const html = await response.text();
    assert.match(html, /<meta name="robots" content="noindex/);
  }
  assert.equal(calls.length, before);
  const html = await (await fetch(base)).text();
  assert.ok(!html.includes('href="/series/"'));
  assert.ok(!html.includes('data-page="series"'));
  const runtime = await (await fetch(base + "/scripts/site-runtime.js")).text();
  assert.ok(!runtime.includes("/series/"));
  assert.ok(html.includes('href="/shorts/"'));
});

function navigationHtml(html, surface) {
  const start = html.indexOf('data-site-navigation="' + surface + '"');
  assert.ok(start >= 0);
  return html.slice(start, html.indexOf("</nav>", start));
}

test("top and sidebar use API names, order, destinations and groups in initial HTML without fixed entries", async () => {
  const before = calls.length;
  try {
    listPayload = { list: [fixture], totalCount: 48 };
    headerPayload = {
      categoryList: [
        {
          id: 80,
          categoryType: 1,
          name: "精选专题 <精品>",
          urlValue: "/topics/",
        },
        {
          id: 81,
          categoryType: 2,
          name: "发现好剧",
          translationList: [
            { id: 82, name: "新剧排行", urlValue: "/rank/new/" },
            {
              id: 83,
              name: "官方社区",
              urlValue: "https://example.net/community",
            },
          ],
        },
        {
          id: 84,
          categoryType: 1,
          name: "全部好剧",
          urlValue: "/shorts/",
          icon: "/assets/nav-custom.webp",
        },
        {
          id: 85,
          categoryType: 3,
          name: "只在底部",
          urlValue: "/info/about-us/",
        },
        { id: 86, categoryType: 1, name: "旧剧集", urlValue: "/series/" },
        {
          id: 87,
          categoryType: 1,
          name: "恶意地址",
          urlValue: "javascript:alert(1)",
        },
      ],
    };
    const html = await (await fetch(base + "/shorts/page/2/")).text();
    for (const surface of ["top", "sidebar"]) {
      const nav = navigationHtml(html, surface);
      assert.ok(nav.indexOf("精选专题 &lt;精品&gt;") < nav.indexOf("发现好剧"));
      assert.ok(nav.indexOf("发现好剧") < nav.indexOf("全部好剧"));
      assert.ok(nav.includes('href="/rank/new/"'));
      assert.ok(nav.includes('href="/shorts/"'));
      assert.ok(nav.includes('data-site-nav="' + surface + '"'));
      assert.ok(nav.includes("<details"));
      assert.ok(nav.includes('rel="sponsored nofollow noopener noreferrer"'));
      assert.ok(nav.includes('aria-current="page"'));
      for (const value of [
        "只在底部",
        "旧剧集",
        "恶意地址",
        'href="/home-road/"',
        'href="/apps/"',
      ])
        assert.ok(!nav.includes(value), value);
    }
    assert.ok(
      navigationHtml(html, "sidebar").includes(
        'data-src="/assets/nav-custom.webp"',
      ),
    );
    assert.equal(
      calls
        .slice(before)
        .filter((call) => call.path === "/api/app/navigation/header").length,
      1,
    );
    headerPayload = { categoryList: [] };
    const empty = await (await fetch(base + "/shorts/")).text();
    assert.ok(!navigationHtml(empty, "top").includes("<a "));
    assert.ok(!navigationHtml(empty, "sidebar").includes("<a "));
  } finally {
    headerPayload = defaultHeader;
    listPayload = undefined;
  }
});

test("navigation failure leaves page content available and never restores a hardcoded menu", async () => {
  try {
    headerFailure = true;
    const response = await fetch(base),
      html = await response.text();
    assert.equal(response.status, 200);
    assert.ok(html.includes("后台配置标题"));
    assert.ok(navigationHtml(html, "top").includes("导航暂不可用"));
    assert.ok(navigationHtml(html, "sidebar").includes("导航暂不可用"));
    assert.ok(!navigationHtml(html, "top").includes("<a "));
  } finally {
    headerFailure = false;
  }
});

test("applications, return-home, feedback and contacts arrive as complete HTML without a loading shell", async () => {
  try {
    appsPayload = {
      categoryList: [
        {
          id: 80,
          title: "接口应用分类",
          appList: [
            {
              id: 81,
              name: "接口应用",
              url: "https://apps.example/download",
              logo: "https://apps.example/logo.webp",
            },
          ],
        },
      ],
    };
    for (const [path, panel, marker] of [
      ["/apps/", "channel-page", "接口应用分类"],
      ["/home-road/", "channel-page", "return-home-directory"],
      ["/info/feedback/", "info-page", 'id="feedback-form"'],
      ["/info/about-us/", "info-page", "https://example.com/contact"],
    ]) {
      const start = calls.length,
        response = await fetch(base + path);
      assert.equal(response.status, 200, path);
      const html = await response.text(),
        main = currentMain(html, panel);
      assert.ok(main.includes(marker), path);
      assert.ok(!/api-loading|正在加载|加载中/.test(main), path);
      if (path === "/apps/")
        assert.equal(
          calls
            .slice(start)
            .filter((call) => call.path === "/api/app/applist/list").length,
          1,
        );
    }
  } finally {
    appsPayload = undefined;
  }
});

test("fresh private pages render real guest records with the same persisted identity and no credentials in HTML", async () => {
  try {
    accountListPayload = {
      list: [
        {
          ...fixture,
          title: "游客自己的历史",
          password: "private-list-password",
        },
      ],
      totalCount: 72,
    };
    const start = calls.length,
      response = await fetch(base + "/member/history/page/2/", {
        headers: { Cookie: "drama_bearer=test-session-secret" },
      }),
      html = await response.text(),
      main = currentMain(html, "info-page");
    assert.equal(response.status, 200);
    assert.match(response.headers.get("cache-control"), /no-store/);
    assert.ok(main.includes("游客自己的历史"));
    assert.ok(main.includes("接口昵称") || main.includes("真实接口用户"));
    assert.ok(main.includes('href="/member/history/page/3/"'));
    assert.ok(!/api-loading|正在加载|加载中/.test(main));
    for (const secret of ["test-session-secret", "private-list-password"])
      assert.ok(!html.includes(secret));
    const reads = calls.slice(start);
    assert.equal(
      reads.filter((call) => call.path === "/api/app/auth/guest").length,
      0,
    );
    assert.ok(
      reads.some((call) => call.path === "/api/app/auth/getInfo"),
    );
    assert.equal(
      reads.find((call) => call.path === "/api/app/playlet/history/list").auth,
      "test-session-secret",
    );
  } finally {
    accountListPayload = undefined;
  }
});

test("likes pages render the current account list, native links and pagination before JavaScript without shared caching", async () => {
  try {
    strictContract = true;
    accountListPayload = (path, request) => ({
      list: [
        {
          ...fixture,
          slug: "liked-story",
          title:
            request.headers.authorization === "registered-user-a-secret"
              ? "甲的点赞短剧"
              : "乙的点赞短剧",
          token: "private-liked-token",
        },
      ],
      totalCount: 72,
    });
    for (const [token, title, other] of [
      ["registered-user-a-secret", "甲的点赞短剧", "乙的点赞短剧"],
      ["registered-user-b-secret", "乙的点赞短剧", "甲的点赞短剧"],
    ]) {
      const start = calls.length;
      const response = await fetch(base + "/member/likes/page/2/", {
          headers: {
            Cookie: "drama_session=" + token + "; drama_registered=1",
          },
        }),
        html = await response.text(),
        main = currentMain(html, "info-page");
      assert.equal(response.status, 200);
      assert.match(response.headers.get("cache-control"), /private.*no-store/);
      assert.match(html, /<meta name="robots" content="noindex,\s*nofollow"/);
      assert.match(main, /<h1\b[^>]*>我的点赞<\/h1>/);
      assert.ok(main.includes(title));
      assert.ok(!main.includes(other));
      assert.ok(main.includes('href="/member/likes/" aria-current="page"'));
      assert.ok(main.includes('href="/member/likes/page/3/"'));
      assert.ok(main.includes('href="/detail/liked-story/"'));
      assert.ok(main.includes("共 72 部短剧"));
      assert.ok(!/api-loading|正在加载|加载中/.test(main));
      for (const secret of [token, "private-liked-token"])
        assert.ok(!html.includes(secret));
      const reads = calls
        .slice(start)
        .filter((call) => call.path === "/api/app/playlet/like/list");
      assert.equal(reads.length, 1);
      assert.equal(reads[0].auth, token);
      assert.equal(reads[0].cookie, undefined);
      assert.equal(new URLSearchParams(reads[0].search).get("pageNum"), "2");
      assert.equal(new URLSearchParams(reads[0].search).get("pageSize"), "24");
    }
    const response = await fetch(
      base + "/api/app/playlet/like/list?pageNum=3&pageSize=24",
      {
        headers: {
          Cookie: "drama_session=registered-user-a-secret; drama_registered=1",
        },
      },
    );
    assert.equal(response.status, 200);
    assert.match(response.headers.get("cache-control"), /no-store/);
    assert.equal((await response.json()).code, 200);
    assert.equal(calls.at(-1).auth, "registered-user-a-secret");
  } finally {
    accountListPayload = undefined;
    strictContract = false;
  }
});

test("likes distinguish empty records, out-of-range pages, backend failures and expired accounts", async () => {
  const headers = {
    Cookie: "drama_session=registered-user-a-secret; drama_registered=1",
  };
  try {
    accountListPayload = { list: [], totalCount: 0 };
    const emptyResponse = await fetch(base + "/member/likes/", { headers }),
      emptyHtml = await emptyResponse.text();
    assert.equal(emptyResponse.status, 200);
    assert.ok(emptyHtml.includes("暂无点赞的短剧"));
    assert.ok(emptyHtml.includes('href="/shorts/">去发现好剧</a>'));
    assert.equal(
      (await fetch(base + "/member/likes/page/2/", { headers })).status,
      404,
    );
    responseOverrides = { "playlet/like/list": { status: 503, code: 503 } };
    const failed = await fetch(base + "/member/likes/", { headers }),
      failedHtml = await failed.text();
    assert.equal(failed.status, 500);
    assert.match(failedHtml, /<meta name="robots" content="noindex/);
    assert.ok(!failedHtml.includes("暂无点赞的短剧"));
    responseOverrides = {};
    const start = calls.length;
    const expiredResponse = await fetch(base + "/member/likes/", {
        headers: { Cookie: "drama_session=expired; drama_registered=1" },
      }),
      expiredHtml = await expiredResponse.text();
    assert.ok(expiredHtml.includes("请先登录账号"));
    assert.ok(expiredHtml.includes('data-auth-mode="login"'));
    assert.ok(
      !calls
        .slice(start)
        .some((call) =>
          ["/api/app/auth/guest", "/api/app/playlet/like/list"].includes(
            call.path,
          ),
        ),
    );
  } finally {
    accountListPayload = undefined;
    responseOverrides = {};
  }
});

test("private settings isolate two users and ignore forged SSR identity headers", async () => {
  const start = calls.length;
  for (const [token, name, other] of [
    ["registered-user-a-secret", "用户甲", "用户乙"],
    ["registered-user-b-secret", "用户乙", "用户甲"],
  ]) {
    const forged = Buffer.from(
      JSON.stringify({ userId: 999, nickName: "伪造管理员" }),
    ).toString("base64url");
    const response = await fetch(base + "/member/settings/", {
      headers: {
        Cookie: "drama_session=" + token + "; drama_registered=1",
        "x-drama-ssr-session": "ready",
        "x-drama-ssr-user": forged,
      },
    });
    const html = await response.text(),
      main = currentMain(html, "info-page");
    assert.ok(main.includes(name));
    assert.ok(!html.includes(other));
    assert.ok(!html.includes("伪造管理员"));
    for (const secret of [token, "must-not-leak"])
      assert.ok(!html.includes(secret));
    assert.ok(!main.includes("api-loading"));
  }
  assert.equal(
    calls.slice(start).filter((call) => call.path === "/api/app/auth/getInfo")
      .length,
    2,
  );
  assert.ok(
    !calls.slice(start).some((call) => call.path === "/api/app/auth/guest"),
  );
});

test("registered expiry renders sign-in immediately without guest downgrade", async () => {
  const start = calls.length,
    response = await fetch(base + "/member/settings/", {
      headers: { Cookie: "drama_session=expired; drama_registered=1" },
    }),
    html = await response.text(),
    main = currentMain(html, "info-page");
  assert.ok(main.includes("请先登录账号"));
  assert.ok(main.includes('data-auth-mode="login"'));
  assert.ok(!main.includes('id="profile-form"'));
  assert.ok(!main.includes("api-loading"));
  assert.ok(
    !calls.slice(start).some((call) => call.path === "/api/app/auth/guest"),
  );
});

test("wallet SSR contains configured packages and transactions without creating an order or leaking extra fields", async () => {
  try {
    packagesPayload = {
      coinList: [
        {
          id: 91,
          name: "真实金币套餐",
          price: 1000,
          baseCoin: 100,
          giftCoin: 5,
          totalCoin: 105,
          packageType: 2,
          payMethods: [{ type: "alipay", typeName: "支付宝" }],
          token: "private-package-token",
        },
      ],
      vipList: [],
    };
    transactionsPayload = {
      list: [
        {
          title: "真实交易明细",
          changeAmount: 25,
          createdAt: "2026-10-21 10:30:00",
          token: "private-transaction-token",
        },
      ],
      totalCount: 18,
    };
    const start = calls.length,
      response = await fetch(base + "/info/deposit/", {
        headers: { Cookie: "drama_bearer=test-session-secret" },
      }),
      html = await response.text(),
      main = currentMain(html, "info-page");
    assert.ok(main, "main info-page must exist");
    assert.ok(main.includes("100金币"));
    assert.ok(main.includes("真实交易明细"));
    assert.ok(main.includes('href="/info/deposit/page/2/"'));
    assert.ok(
      !calls.slice(start).some((call) => call.path === "/api/app/auth/guest"),
    );
    assert.ok(!/api-loading|正在加载|加载中/.test(main));
    for (const secret of [
      "private-package-token",
      "private-transaction-token",
      "test-session-secret",
    ])
      assert.ok(!html.includes(secret));
    const reads = calls.slice(start);
    assert.equal(
      reads.filter((call) => call.path === "/api/app/recharge/package/list")
        .length,
      1,
    );
    assert.equal(
      reads.filter((call) => call.path === "/api/app/coin/trans/list").length,
      1,
    );
    assert.ok(
      !reads.some((call) =>
        [
          "/api/app/coin/buy",
          "/api/app/vip/pay",
          "/api/app/playlet/chapter/unlock",
        ].includes(call.path),
      ),
    );
  } finally {
    packagesPayload = undefined;
    transactionsPayload = undefined;
  }
});

test("header and complete page content share the server-prepared identity before scripts run", async () => {
  const start = calls.length,
    response = await fetch(base + "/shorts/", {
      headers: { Cookie: "drama_bearer=test-session-secret" },
    }),
    html = await response.text();
  assert.ok(
    html.indexOf('id="global-site-header"') <
      html.indexOf('<main class="shell"'),
  );
  assert.ok(html.includes('class="hg-header-brand"'));
  assert.ok(html.includes("接口昵称") || html.includes("真实接口用户"));
  assert.ok(!html.includes("正在连接"));
  assert.equal(
    calls.slice(start).filter((call) => call.path === "/api/app/auth/guest")
      .length,
    0,
  );
  assert.ok(
    calls.slice(start).some((call) => call.path === "/api/app/auth/getInfo"),
  );
  for (const secret of ["test-session-secret", "drama_session"])
    assert.ok(!html.includes(secret));
});

test("slug details and episodes render directly with numeric dependent reads, slug links and matching canonical schema", async () => {
  try {
    strictContract = true;
    detailSeo = {
      slug: "city-story",
      title: "都市故事",
      desc: "作品独立介绍",
      tagNames: ["都市"],
      tagIds: [9],
      tagSlugs: ["urban"],
      onlineAt: "2026-10-20",
    };
    chapterPayload = {
      id: 90001,
      playletId: 23456,
      currentEpisode: 3,
      canWatch: true,
      videoUrl: "https://media.drama.test/3.mp4",
    };
    commentPayload = { list: [], totalCount: 25 };
    for (const [path, chapter] of [
      ["/detail/city-story/", false],
      ["/play/city-story/90001/", true],
    ]) {
      const start = calls.length,
        response = await fetch(base + path, { redirect: "manual" }),
        html = await response.text();
      assert.equal(response.status, 200, path);
      assert.equal(response.headers.get("location"), null);
      const main = currentMain(html, "drama-play-page");
      assert.ok(main.includes("都市故事"));
      assert.ok(main.includes('href="/play/city-story/90001/"'));
      assert.ok(main.includes(`href="${path}page/2/"`));
      assert.ok(
        html.includes(
          `rel="canonical" href="https://default.drama.test${path}"`,
        ),
      );
      const reads = calls.slice(start),
        detail = reads.filter(
          (call) => call.path === "/api/app/playlet/detail",
        );
      assert.equal(detail.length, 1);
      assert.equal(
        new URLSearchParams(detail[0].search).get("slug"),
        "city-story",
      );
      assert.equal(new URLSearchParams(detail[0].search).has("id"), false);
      assert.equal(
        new URLSearchParams(
          reads.find((call) => call.path === "/api/app/playlet/chapter/list")
            .search,
        ).get("playletSlug"),
        "city-story",
      );
      assert.equal(
        new URLSearchParams(
          reads.find((call) => call.path === "/api/app/playlet/guess-like/list")
            .search,
        ).get("playletId"),
        "23456",
      );
      const comments = new URLSearchParams(
        reads.find((call) => call.path === "/api/app/comment/list").search,
      );
      assert.equal(comments.get("objectId"), "23456");
      assert.equal(comments.get("objectType"), "10");
      if (chapter) {
        assert.ok(main.includes('href="/tag/urban/"'));
        assert.ok(main.includes('href="/detail/city-story/"'));
      }
      const graph = JSON.parse(
        html.match(
          /<script\b[^>]*data-site-json-ld=""[^>]*>([\s\S]*?)<\/script>/,
        )[1],
      )["@graph"];
      assert.equal(
        graph.find((node) => node["@type"] === "TVSeries").url,
        "https://default.drama.test/detail/city-story/",
      );
      if (chapter)
        assert.equal(
          graph.find((node) => node["@type"] === "TVEpisode").url,
          "https://default.drama.test/play/city-story/90001/",
        );
    }
    const legacy = await fetch(base + "/detail/23456/", { redirect: "manual" }),
      html = await legacy.text();
    assert.equal(legacy.status, 200);
    assert.equal(legacy.headers.get("location"), null);
    assert.ok(
      html.includes(
        'rel="canonical" href="https://default.drama.test/detail/city-story/"',
      ),
    );
    assert.ok(html.includes('href="/detail/city-story/page/2/"'));
    detailSeo = { ...detailSeo, slug: "都市 / 剧?#%2F" };
    const path = "/play/" + encodeURIComponent(detailSeo.slug) + "/90001/";
    const special = await fetch(base + path);
    assert.equal(special.status, 200);
    const specialHtml = await special.text();
    assert.ok(
      specialHtml.includes(
        'rel="canonical" href="https://default.drama.test/play/23456/90001/"',
      ),
    );
    assert.ok(specialHtml.includes('href="/play/23456/90001/"'));
  } finally {
    strictContract = false;
    detailSeo = chapterPayload = commentPayload = undefined;
  }
});

test("home, topics, aliases, tags, more and search generate slug-first destinations and serve refreshed slug URLs", async () => {
  const savedHome = homePayload;
  try {
    strictContract = true;
    const drama = { ...fixture, slug: "city-story" },
      topic = { id: 7, slug: "urban-topic", name: "都市专题" };
    homePayload = {
      homeBannerData: [drama],
      homeConfigData: [
        {
          id: 31,
          slug: "editors-choice",
          name: "编辑精选",
          desc: "独立精选介绍",
          status: true,
          type: 1,
          list: [drama],
        },
        {
          id: 32,
          slug: "collections",
          name: "专题合集",
          desc: "专题介绍",
          status: true,
          type: 3,
          themeList: [topic],
        },
      ],
    };
    listPayload = (endpoint) =>
      endpoint === "playlet/topic/list"
        ? { list: [topic], totalCount: 1 }
        : {
            id: 7,
            slug: "urban-topic",
            name: "都市专题",
            desc: "专题内容介绍",
            list: [drama],
            totalCount: 72,
          };
    tagOptionsPayload = { list: [{ id: 9, slug: "urban", name: "都市" }] };
    for (const path of [
      "/",
      "/topics/",
      "/topics/urban-topic/",
      "/theme/urban-topic/",
      "/topics/urban-topic/page/2/",
      "/tag/urban/",
      "/tag/urban/page/2/",
      "/config/editors-choice/",
    ]) {
      const start = calls.length,
        response = await fetch(base + path, { redirect: "manual" }),
        html = await response.text();
      assert.equal(response.status, 200, path);
      assert.equal(response.headers.get("location"), null);
      if (path === "/")
        for (const href of [
          "/detail/city-story/",
          "/topics/urban-topic/",
          "/config/editors-choice/",
        ])
          assert.ok(html.includes(`href="${href}"`));
      if (path.startsWith("/topics/urban") || path.startsWith("/theme/")) {
        assert.ok(
          html.includes(
            `rel="canonical" href="https://default.drama.test${path}"`,
          ),
        );
        const query = new URLSearchParams(
          calls
            .slice(start)
            .find(
              (call) =>
                call.path ===
                "/api/app/" +
                  (path.startsWith("/theme/")
                    ? "playlet/all/list"
                    : "playlet/topic/detail"),
            ).search,
        );
        assert.equal(
          query.get(path.startsWith("/theme/") ? "themeSlug" : "topicSlug"),
          "urban-topic",
        );
        assert.equal(query.has("id"), false);
      }
      if (path.startsWith("/tag/"))
        assert.equal(
          new URLSearchParams(
            calls
              .slice(start)
              .find((call) => call.path === "/api/app/playlet/tag/list").search,
          ).get("tagSlug"),
          "urban",
        );
      if (path === "/config/editors-choice/")
        assert.ok(html.includes('href="/detail/city-story/"'));
    }
    searchPayload = { list: [drama], totalCount: 1, pageSize: 25 };
    const html = await (await fetch(base + "/search/city/")).text();
    assert.ok(
      currentMain(html, "search-results-page").includes(
        'href="/detail/city-story/"',
      ),
    );
  } finally {
    homePayload = savedHome;
    strictContract = false;
    listPayload = tagOptionsPayload = searchPayload = undefined;
  }
});

test("missing slugs stay real 404 responses and topic directory outages stay server errors", async () => {
  try {
    detailSeo = { slug: "known-story" };
    listPayload = { list: [{ id: 7, slug: "known-topic" }], totalCount: 1 };
    for (const path of [
      "/detail/unknown-story/",
      "/play/unknown-story/90001/",
      "/topics/unknown-topic/",
      "/tag/unknown-tag/",
      "/config/unknown-config/",
    ]) {
      const response = await fetch(base + path, { redirect: "manual" }),
        html = await response.text();
      assert.equal(response.status, 404, path);
      assert.equal(response.headers.get("location"), null);
      assert.ok(!html.includes('rel="canonical"'));
      assert.match(html, /<meta name="robots" content="noindex/);
    }
    responseOverrides = { "playlet/topic/detail": { status: 503, code: 503 } };
    const response = await fetch(base + "/topics/known-topic/");
    assert.equal(response.status, 500);
    assert.match(await response.text(), /<meta name="robots" content="noindex/);
  } finally {
    detailSeo = listPayload = undefined;
    responseOverrides = {};
  }
});

test("detail, episode, chapter list, comments and recommendations are requested before detail finishes", async () => {
  let release;
  blockedDetail = { promise: new Promise((resolve) => (release = resolve)) };
  const start = calls.length;
  const pending = fetch(base + "/play/23456/90001/");
  try {
    const paths = [
      "playlet/detail",
      "playlet/chapter/detail",
      "playlet/chapter/list",
      "comment/list",
      "playlet/guess-like/list",
    ].map((path) => "/api/app/" + path);
    for (let attempt = 0; attempt < 100; attempt++) {
      if (
        paths.every((path) =>
          calls.slice(start).some((call) => call.path === path),
        )
      )
        break;
      await delay(10);
    }
    for (const path of paths)
      assert.ok(
        calls.slice(start).some((call) => call.path === path),
        path + " must not wait for detail",
      );
  } finally {
    release();
    blockedDetail = undefined;
  }
  const html = await (await pending).text();
  assert.ok(currentMain(html, "drama-play-page").includes("play-detail-title"));
});

test("public payloads are reused across page requests while two accounts and permissions stay uncached", async () => {
  await stopNext();
  await startNext({ PUBLIC_DATA_CACHE_TTL_MS: "60000" });
  const previousHeader = headerPayload;
  try {
    seoConfig = {
      reportSdkConfig: "private-shared-sdk-cipher",
      config: { secret: "private-shared-config-secret" },
    };
    footerPayload = {
      footerInfo: {
        brand: { content: "真实直出页脚" },
        contactList: [{ name: "服务时间", value: "每天" }],
        token: "private-footer-token",
      },
    };
    const start = calls.length;
    const pages = await Promise.all(
      ["/shorts/", "/topics/", "/home-road/"].map(async (path) =>
        (await fetch(base + path)).text(),
      ),
    );
    for (const path of [
      "config/info",
      "config/footer/info",
      "navigation/header",
      "translation/category/list",
    ])
      assert.equal(
        calls.slice(start).filter((call) => call.path === "/api/app/" + path)
          .length,
        1,
        path,
      );
    for (const html of pages) {
      assert.ok(html.includes("真实直出页脚"));
      for (const secret of [
        "private-shared-sdk-cipher",
        "private-shared-config-secret",
        "private-footer-token",
      ])
        assert.ok(!html.includes(secret));
    }
    await (await fetch(base)).text();
    await (await fetch(base)).text();
    assert.equal(
      calls.slice(start).filter((call) => call.path === "/api/app/playlet/home")
        .length,
      1,
    );
    headerPayload = { categoryList: [] };
    assert.ok(
      navigationHtml(
        await (await fetch(base + "/shorts/")).text(),
        "top",
      ).includes("短剧"),
      "public navigation remains valid within TTL",
    );
    const privateStart = calls.length;
    for (const [token, name, other] of [
      ["registered-user-a-secret", "用户甲", "用户乙"],
      ["registered-user-b-secret", "用户乙", "用户甲"],
    ]) {
      const html = await (
        await fetch(base + "/member/settings/", {
          headers: {
            Cookie: "drama_session=" + token + "; drama_registered=1",
          },
        })
      ).text();
      assert.ok(currentMain(html, "info-page").includes(name));
      assert.ok(!html.includes(other));
    }
    assert.equal(
      calls
        .slice(privateStart)
        .filter((call) => call.path === "/api/app/auth/getInfo").length,
      2,
    );
    const permissionStart = calls.length;
    await (await fetch(base + "/play/23456/90001/")).text();
    await (await fetch(base + "/play/23456/90001/")).text();
    for (const path of ["playlet/detail", "playlet/chapter/detail"])
      assert.equal(
        calls
          .slice(permissionStart)
          .filter((call) => call.path === "/api/app/" + path).length,
        2,
        path + " must stay realtime",
      );
  } finally {
    seoConfig = {};
    footerPayload = undefined;
    headerPayload = previousHeader;
    await stopNext();
    await startNext();
  }
});

test("current-origin ingress separates direct Go responses from Next session cookies while serving SSR and media", async () => {
  await stopNext();
  await startNext({ UPSTREAM_API_URL: "current" });
  // Emulate Nginx: preserve the visitor Host and route only backend paths to Go.
  const ingress = createServer((request, response) => {
    const backend = /^\/(?:api\/app\/|h5\/|(?:new)?enkey(?:\?|\/|$))/.test(
      request.url,
    );
    const target = new URL(request.url, backend ? mockOrigin : base);
    const forwarded = httpRequest(
      target,
      {
        method: request.method,
        headers: { ...request.headers, "x-forwarded-proto": "http" },
      },
      (result) => {
        response.writeHead(result.statusCode, result.headers);
        result.pipe(response);
      },
    );
    forwarded.on("error", () => {
      response.writeHead(502);
      response.end();
    });
    request.pipe(forwarded);
  });
  const origin = "http://127.0.0.1:" + (await listen(ingress));
  try {
    const start = calls.length;
    const homepage = await fetch(origin + "/"),
      html = await homepage.text();
    assert.equal(homepage.status, 200);
    assert.ok(html.includes("后台配置标题"));
    // Direct-Go ingress + jha-1048: HTML SSR must not invent a guest token.
    assert.ok(
      !calls.slice(start).some((call) => call.path === "/api/app/auth/guest"),
    );
    assert.ok(
      calls.slice(start).some((call) => call.path === "/api/app/playlet/home"),
    );
    const config = await fetch(origin + "/api/app/config/info");
    assert.equal(config.status, 200);
    assert.equal((await config.json()).code, 200);
    // This ingress sends /api/app/* straight to Go, bypassing Next's cookie handling.
    const directSession = await fetch(origin + "/api/app/auth/guest", {
      method: "POST",
      headers: { "Content-Type": "application/json", Origin: origin },
      body: "{}",
    });
    assert.equal(directSession.status, 200);
    assert.equal(directSession.headers.get("set-cookie"), null);
    const directPayload = await directSession.json();
    assert.equal(directPayload.code, 200);
    assert.equal(directPayload.data.token, "test-session-secret");
    // The compatibility alias reaches Next, which converts the token into an HttpOnly cookie.
    const session = await fetch(origin + "/api/auth/guest", {
      method: "POST",
      headers: { "Content-Type": "application/json", Origin: origin },
      body: "{}",
    });
    assert.equal(session.status, 200);
    assert.match(session.headers.get("set-cookie"), /drama_session=/);
    const sessionPayload = await session.json();
    assert.equal(sessionPayload.code, 200);
    assert.equal(sessionPayload.data.token, undefined);
    const privatePage = await fetch(origin + "/member/settings/", {
      headers: {
        Cookie: "drama_session=registered-user-a-secret; drama_registered=1",
      },
    });
    assert.equal(privatePage.status, 200);
    assert.ok(
      currentMain(await privatePage.text(), "info-page").includes("用户甲"),
    );
    assert.equal(calls.at(-1).cookie, undefined);
    const key = await fetch(origin + "/enkey?id=12700&ticket=a%2Fb+1");
    assert.equal(key.status, 200);
    assert.equal((await key.arrayBuffer()).byteLength, 16);
    assert.equal(calls.at(-1).search, "?id=12700&ticket=a%2Fb+1");
    const media = await fetch(origin + "/h5/m3u8/video.m3u8?md=signed+value");
    assert.equal(media.status, 200);
    assert.match(await media.text(), /#EXTM3U/);
    // A direct Node URL has no Go forwarding. It must fail once, rather than recurse.
    const loop = await fetch(base + "/api/app/config/info");
    assert.equal(loop.status, 502);
    assert.match((await loop.json()).msg, /转发配置/);
    const keyLoop = await fetch(base + "/enkey?id=12700&ticket=original");
    assert.equal(keyLoop.status, 502);
  } finally {
    await new Promise((resolve) => ingress.close(resolve));
    await stopNext();
    await startNext();
  }
});