import Foundation
import Testing
@testable import CodexBarCore

@Suite(.serialized)
struct CookieHeaderCacheTests {
    private struct WrongEntry: Codable {
        let value: String
    }

    @Test
    func `stores and loads entry`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let provider: UsageProvider = .codex
        let storedAt = Date(timeIntervalSince1970: 0)
        CookieHeaderCache.store(
            provider: provider,
            cookieHeader: "auth=abc",
            sourceLabel: "Chrome",
            now: storedAt)

        let loaded = CookieHeaderCache.load(provider: provider)
        defer { CookieHeaderCache.clear(provider: provider) }

        #expect(loaded?.cookieHeader == "auth=abc")
        #expect(loaded?.sourceLabel == "Chrome")
        #expect(loaded?.storedAt == storedAt)
    }

    @Test
    func `conditional mutation does not overwrite or clear a newer entry`() {
        self.withIsolatedCookieCache {
            CookieHeaderCache.store(
                provider: .claude,
                cookieHeader: "sessionKey=sk-ant-initial",
                sourceLabel: "Chrome")
            let loaded = CookieHeaderCache.load(provider: .claude)
            #expect(loaded != nil)
            guard let initial = loaded else { return }

            let renewed = CookieHeaderCache.storeIfCurrent(
                provider: .claude,
                expected: initial,
                cookieHeader: "sessionKey=sk-ant-newer",
                sourceLabel: "Chrome")
            let staleStore = CookieHeaderCache.storeIfCurrent(
                provider: .claude,
                expected: initial,
                cookieHeader: "sessionKey=sk-ant-older",
                sourceLabel: "Chrome")
            let staleClear = CookieHeaderCache.clearIfCurrent(provider: .claude, expected: initial)

            #expect(renewed)
            #expect(!staleStore)
            #expect(!staleClear)
            #expect(CookieHeaderCache.load(provider: .claude)?.cookieHeader == "sessionKey=sk-ant-newer")
        }
    }

    @Test
    func `conditional clear failure still permits replacing the same entry`() {
        self.withIsolatedCookieCache {
            CookieHeaderCache.store(
                provider: .claude,
                cookieHeader: "sessionKey=sk-ant-stale",
                sourceLabel: "Chrome")
            let loaded = CookieHeaderCache.load(provider: .claude)
            #expect(loaded != nil)
            guard let stale = loaded else { return }

            let cleared = KeychainCacheStore.withClearFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
                CookieHeaderCache.clearIfCurrent(provider: .claude, expected: stale)
            }
            let replaced = CookieHeaderCache.storeIfCurrent(
                provider: .claude,
                expected: stale,
                cookieHeader: "sessionKey=sk-ant-fresh",
                sourceLabel: "Safari")

            #expect(!cleared)
            #expect(replaced)
            #expect(CookieHeaderCache.load(provider: .claude)?.cookieHeader == "sessionKey=sk-ant-fresh")
        }
    }

    @Test
    func `conditional mutation recognizes a legacy entry after migration failure`() {
        self.withIsolatedCookieCache {
            let legacy = CookieHeaderCache.Entry(
                cookieHeader: "sessionKey=sk-ant-legacy",
                storedAt: Date(timeIntervalSince1970: 1),
                sourceLabel: "Chrome")
            CookieHeaderCache.store(legacy, to: CookieHeaderCache.legacyURLForTesting(provider: .claude))

            let loaded = KeychainCacheStore.withStoreFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
                CookieHeaderCache.load(provider: .claude)
            }
            #expect(loaded?.cookieHeader == legacy.cookieHeader)
            guard let loaded else { return }

            let cleared = CookieHeaderCache.clearIfCurrent(provider: .claude, expected: loaded)
            let replaced = CookieHeaderCache.storeIfCurrent(
                provider: .claude,
                expected: nil,
                cookieHeader: "sessionKey=sk-ant-fresh",
                sourceLabel: "Safari")

            #expect(cleared)
            #expect(replaced)
            #expect(CookieHeaderCache.load(provider: .claude)?.cookieHeader == "sessionKey=sk-ant-fresh")
        }
    }

    @Test
    func `stores separate codex entries per managed account scope`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let provider: UsageProvider = .codex
        let accountA = UUID()
        let accountB = UUID()

        CookieHeaderCache.store(
            provider: provider,
            scope: .managedAccount(accountA),
            cookieHeader: "auth=account-a",
            sourceLabel: "Chrome")
        CookieHeaderCache.store(
            provider: provider,
            scope: .managedAccount(accountB),
            cookieHeader: "auth=account-b",
            sourceLabel: "Safari")
        defer {
            CookieHeaderCache.clear(provider: provider, scope: .managedAccount(accountA))
            CookieHeaderCache.clear(provider: provider, scope: .managedAccount(accountB))
        }

        #expect(CookieHeaderCache.load(provider: provider, scope: .managedAccount(accountA))?
            .cookieHeader == "auth=account-a")
        #expect(CookieHeaderCache.load(provider: provider, scope: .managedAccount(accountB))?
            .cookieHeader == "auth=account-b")
        #expect(CookieHeaderCache.load(provider: provider)?.cookieHeader == nil)
    }

    @Test
    func `profile home scopes isolate same email sessions without exposing paths`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let provider: UsageProvider = .codex
        let profileA = CookieHeaderCache.Scope.profileHome("/tmp/codex-profile-a")
        let profileB = CookieHeaderCache.Scope.profileHome("/tmp/codex-profile-b")
        CookieHeaderCache.store(
            provider: provider,
            scope: profileA,
            cookieHeader: "auth=profile-a",
            sourceLabel: "Chrome")
        CookieHeaderCache.store(
            provider: provider,
            scope: profileB,
            cookieHeader: "auth=profile-b",
            sourceLabel: "Chrome")
        defer {
            CookieHeaderCache.clear(provider: provider, scope: profileA)
            CookieHeaderCache.clear(provider: provider, scope: profileB)
        }

        #expect(CookieHeaderCache.load(provider: provider, scope: profileA)?.cookieHeader == "auth=profile-a")
        #expect(CookieHeaderCache.load(provider: provider, scope: profileB)?.cookieHeader == "auth=profile-b")
        #expect(CookieHeaderCache.load(provider: provider) == nil)
        #expect(profileA.isolationIdentifier != profileB.isolationIdentifier)
        #expect(!profileA.isolationIdentifier.contains("codex-profile-a"))
    }

    @Test
    func `provider global scope remains available without managed account`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let provider: UsageProvider = .codex

        CookieHeaderCache.store(
            provider: provider,
            cookieHeader: "auth=system",
            sourceLabel: "Chrome")
        defer { CookieHeaderCache.clear(provider: provider) }

        #expect(CookieHeaderCache.load(provider: provider)?.cookieHeader == "auth=system")
        #expect(CookieHeaderCache.load(provider: provider, scope: .managedAccount(UUID())) == nil)
    }

    @Test
    func `claude cookie scopes isolate browser cache from managed accounts`() {
        self.withIsolatedCookieCache {
            let accountA = UUID()
            let accountB = UUID()

            CookieHeaderCache.store(
                provider: .claude,
                cookieHeader: "sessionKey=sk-ant-browser",
                sourceLabel: "Safari")
            CookieHeaderCache.store(
                provider: .claude,
                scope: .managedAccount(accountA),
                cookieHeader: "sessionKey=sk-ant-account-a",
                sourceLabel: "Chrome")
            CookieHeaderCache.store(
                provider: .claude,
                scope: .managedAccount(accountB),
                cookieHeader: "sessionKey=sk-ant-account-b",
                sourceLabel: "Edge")

            #expect(CookieHeaderCache.load(provider: .claude)?.cookieHeader == "sessionKey=sk-ant-browser")
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(accountA))?
                .cookieHeader == "sessionKey=sk-ant-account-a")
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(accountB))?
                .cookieHeader == "sessionKey=sk-ant-account-b")

            CookieHeaderCache.clear(provider: .claude)
            #expect(CookieHeaderCache.load(provider: .claude) == nil)
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(accountA))?
                .cookieHeader == "sessionKey=sk-ant-account-a")
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(accountB))?
                .cookieHeader == "sessionKey=sk-ant-account-b")

            CookieHeaderCache.clear(provider: .claude, scope: .managedAccount(accountA))
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(accountA)) == nil)
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(accountB))?
                .cookieHeader == "sessionKey=sk-ant-account-b")
        }
    }

    @Test
    func `claude unreadable managed store sentinel is isolated from account cookies`() {
        self.withIsolatedCookieCache {
            let accountID = UUID()

            CookieHeaderCache.store(
                provider: .claude,
                cookieHeader: "sessionKey=sk-ant-global",
                sourceLabel: "Safari")
            CookieHeaderCache.store(
                provider: .claude,
                scope: .managedAccount(accountID),
                cookieHeader: "sessionKey=sk-ant-account",
                sourceLabel: "Chrome")
            CookieHeaderCache.store(
                provider: .claude,
                scope: .managedStoreUnreadable,
                cookieHeader: "sessionKey=sk-ant-unreadable-store",
                sourceLabel: "Unreadable managed account store")

            CookieHeaderCache.clear(provider: .claude, scope: .managedAccount(accountID))
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(accountID)) == nil)
            #expect(CookieHeaderCache.load(provider: .claude)?.cookieHeader == "sessionKey=sk-ant-global")
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedStoreUnreadable)?
                .cookieHeader == "sessionKey=sk-ant-unreadable-store")

            CookieHeaderCache.clear(provider: .claude)
            #expect(CookieHeaderCache.load(provider: .claude) == nil)
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedStoreUnreadable)?
                .cookieHeader == "sessionKey=sk-ant-unreadable-store")

            let cleared = CookieHeaderCache.clearAllScopesDetailed(provider: .claude)
            #expect(cleared == CookieHeaderCache.ClearSummary(clearedCount: 1, failedCount: 0))
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedStoreUnreadable) == nil)
        }
    }

    @Test
    func `claude clear all scopes does not remove other provider cookie caches`() {
        self.withIsolatedCookieCache {
            let claudeAccount = UUID()
            let codexAccount = UUID()

            CookieHeaderCache.store(
                provider: .claude,
                cookieHeader: "sessionKey=sk-ant-claude-global",
                sourceLabel: "Safari")
            CookieHeaderCache.store(
                provider: .claude,
                scope: .managedAccount(claudeAccount),
                cookieHeader: "sessionKey=sk-ant-claude-account",
                sourceLabel: "Chrome")
            CookieHeaderCache.store(provider: .codex, cookieHeader: "auth=codex-global", sourceLabel: "Chrome")
            CookieHeaderCache.store(
                provider: .codex,
                scope: .managedAccount(codexAccount),
                cookieHeader: "auth=codex-account",
                sourceLabel: "Safari")
            CookieHeaderCache.store(provider: .perplexity, cookieHeader: "pplx=web", sourceLabel: "Chrome")

            let cleared = CookieHeaderCache.clearAllScopesDetailed(provider: .claude)

            #expect(cleared == CookieHeaderCache.ClearSummary(clearedCount: 2, failedCount: 0))
            #expect(CookieHeaderCache.load(provider: .claude) == nil)
            #expect(CookieHeaderCache.load(provider: .claude, scope: .managedAccount(claudeAccount)) == nil)
            #expect(CookieHeaderCache.load(provider: .codex)?.cookieHeader == "auth=codex-global")
            #expect(CookieHeaderCache.load(provider: .codex, scope: .managedAccount(codexAccount))?
                .cookieHeader == "auth=codex-account")
            #expect(CookieHeaderCache.load(provider: .perplexity)?.cookieHeader == "pplx=web")
        }
    }

    @Test
    func `migrates legacy file to keychain`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            let storedAt = Date(timeIntervalSince1970: 0)
            let entry = CookieHeaderCache.Entry(
                cookieHeader: "auth=legacy",
                storedAt: storedAt,
                sourceLabel: "Legacy")
            let legacyURL = legacyBase.appendingPathComponent("\(provider.rawValue)-cookie.json")

            CookieHeaderCache.store(entry, to: legacyURL)
            #expect(FileManager.default.fileExists(atPath: legacyURL.path) == true)

            let loaded = CookieHeaderCache.load(provider: provider)
            defer { CookieHeaderCache.clear(provider: provider) }

            #expect(loaded?.cookieHeader == "auth=legacy")
            #expect(loaded?.sourceLabel == "Legacy")
            #expect(loaded?.storedAt == storedAt)
            #expect(FileManager.default.fileExists(atPath: legacyURL.path) == false)

            let loadedAgain = CookieHeaderCache.load(provider: provider)
            #expect(loadedAgain?.cookieHeader == "auth=legacy")
        }
    }

    @Test
    func `serialized load migrates legacy file to keychain`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            let legacyURL = legacyBase.appendingPathComponent("\(provider.rawValue)-cookie.json")
            CookieHeaderCache.store(
                CookieHeaderCache.Entry(
                    cookieHeader: "auth=legacy",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Legacy"),
                to: legacyURL)

            let loaded = CookieHeaderCache.loadSerialized(provider: provider)
            defer { CookieHeaderCache.clear(provider: provider) }

            #expect(loaded?.cookieHeader == "auth=legacy")
            #expect(FileManager.default.fileExists(atPath: legacyURL.path) == false)
            #expect(CookieHeaderCache.load(provider: provider)?.cookieHeader == "auth=legacy")
        }
    }

    #if os(macOS)
    @Test
    func `temporary keychain unavailability returns nil without migrating legacy file`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            let legacyURL = legacyBase.appendingPathComponent("\(provider.rawValue)-cookie.json")
            CookieHeaderCache.store(
                CookieHeaderCache.Entry(
                    cookieHeader: "auth=legacy",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Legacy"),
                to: legacyURL)
            #expect(FileManager.default.fileExists(atPath: legacyURL.path) == true)

            let loaded = KeychainCacheStore.withLoadFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
                CookieHeaderCache.load(provider: provider)
            }

            #expect(loaded == nil)
            #expect(FileManager.default.fileExists(atPath: legacyURL.path) == true)

            switch KeychainCacheStore.load(
                key: .cookie(provider: provider.instanceID),
                as: CookieHeaderCache.Entry.self)
            {
            case .missing:
                #expect(true)
            case .found, .temporarilyUnavailable, .invalid:
                #expect(Bool(false), "Expected temporary miss not to migrate legacy cache")
            }
        }
    }
    #endif

    @Test
    func `invalid keychain cache is cleared`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            let key = KeychainCacheStore.Key.cookie(provider: provider.instanceID)
            KeychainCacheStore.store(key: key, entry: WrongEntry(value: "not-a-cookie-entry"))

            #expect(CookieHeaderCache.load(provider: provider) == nil)

            switch KeychainCacheStore.load(key: key, as: CookieHeaderCache.Entry.self) {
            case .missing:
                #expect(true)
            case .found, .temporarilyUnavailable, .invalid:
                #expect(Bool(false), "Expected invalid cookie cache to be cleared")
            }
        }
    }

    @Test
    func `clear all scopes removes global scoped invalid and legacy cookie entries`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            let accountID = UUID()
            CookieHeaderCache.store(provider: provider, cookieHeader: "auth=global", sourceLabel: "Chrome")
            CookieHeaderCache.store(
                provider: provider,
                scope: .managedAccount(accountID),
                cookieHeader: "auth=scoped",
                sourceLabel: "Chrome")
            KeychainCacheStore.store(
                key: .cookie(provider: provider.instanceID, scopeIdentifier: "managed-store-unreadable"),
                entry: WrongEntry(value: "invalid"))
            CookieHeaderCache.store(
                CookieHeaderCache.Entry(
                    cookieHeader: "auth=legacy",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Legacy"),
                to: CookieHeaderCache.legacyURLForTesting(provider: provider))

            let cleared = CookieHeaderCache.clearAllScopesDetailed(provider: provider)

            #expect(cleared == CookieHeaderCache.ClearSummary(clearedCount: 4, failedCount: 0))
            #expect(!CookieHeaderCache.hasKeychainEntryForTesting(provider: provider))
            #expect(!CookieHeaderCache.hasKeychainEntryForTesting(
                provider: provider,
                scope: .managedAccount(accountID)))
            #expect(!CookieHeaderCache.hasKeychainEntryForTesting(provider: provider, scope: .managedStoreUnreadable))
            #expect(!CookieHeaderCache.hasLegacyEntryForTesting(provider: provider))
        }
    }

    @Test
    func `loadForDisplay memoizes keychain lookups`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=abc", sourceLabel: "Chrome")

        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=abc")

        // Remove the backing entry without going through CookieHeaderCache: the strict load
        // sees the change, the display path keeps serving the memoized snapshot.
        KeychainCacheStore.clear(key: .cookie(provider: provider.instanceID))
        #expect(CookieHeaderCache.load(provider: provider) == nil)
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=abc")
    }

    @Test
    func `loadForDisplay memoizes missing entries`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)

        KeychainCacheStore.store(
            key: .cookie(provider: provider.instanceID),
            entry: CookieHeaderCache.Entry(
                cookieHeader: "auth=behind-the-back",
                storedAt: Date(timeIntervalSince1970: 0),
                sourceLabel: "Chrome"))
        defer { KeychainCacheStore.clear(key: .cookie(provider: provider.instanceID)) }
        #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)
    }

    @Test
    func `loadForDisplay migrates legacy cache asynchronously`() async throws {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        try await CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            CookieHeaderCache.store(
                CookieHeaderCache.Entry(
                    cookieHeader: "auth=legacy-display",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Legacy"),
                to: CookieHeaderCache.legacyURLForTesting(provider: provider))

            #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=legacy-display")
            for _ in 0..<500 {
                if !CookieHeaderCache.hasLegacyEntryForTesting(provider: provider),
                   CookieHeaderCache.hasKeychainEntryForTesting(provider: provider)
                {
                    break
                }
                try await Task.sleep(for: .milliseconds(10))
            }
            #expect(!CookieHeaderCache.hasLegacyEntryForTesting(provider: provider))
            #expect(CookieHeaderCache.hasKeychainEntryForTesting(provider: provider))
            CookieHeaderCache.clear(provider: provider)
        }
    }

    @Test
    func `delayed legacy migration cannot restore a cleared cache`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            CookieHeaderCache.store(
                CookieHeaderCache.Entry(
                    cookieHeader: "auth=legacy-display",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Legacy"),
                to: CookieHeaderCache.legacyURLForTesting(provider: provider))

            CookieHeaderCache.clear(provider: provider)
            #expect(CookieHeaderCache.migrateLegacyEntryIfNeededForTesting(provider: provider) == nil)
            #expect(!CookieHeaderCache.hasLegacyEntryForTesting(provider: provider))
            #expect(!CookieHeaderCache.hasKeychainEntryForTesting(provider: provider))
        }
    }

    @Test
    func `legacy URL override supports concurrent teardown reads`() {
        let legacyBases = [
            FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true),
            FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true),
        ]
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBases[0]) {
            DispatchQueue.concurrentPerform(iterations: 5000) { index in
                if index.isMultiple(of: 3) {
                    CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBases[index % legacyBases.count]) {
                        _ = CookieHeaderCache.legacyURLForTesting(provider: .codex)
                    }
                } else if index.isMultiple(of: 5) {
                    CookieHeaderCache.withLegacyBaseURLOverrideForTesting(nil) {
                        _ = CookieHeaderCache.legacyURLForTesting(provider: .codex)
                    }
                } else {
                    _ = CookieHeaderCache.legacyURLForTesting(provider: .codex)
                }
            }

            #expect(
                CookieHeaderCache.legacyURLForTesting(provider: .codex)
                    == legacyBases[0].appendingPathComponent("codex-cookie.json"))
        }
    }

    #if os(macOS)
    @Test
    func `loadForDisplay throttles temporary keychain unavailability then retries`() async throws {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }
        try await CookieHeaderCache.withDisplayUnavailableRetryIntervalOverrideForTesting(0.05) {
            let provider: UsageProvider = .codex
            KeychainCacheStore.store(
                key: .cookie(provider: provider.instanceID),
                entry: CookieHeaderCache.Entry(
                    cookieHeader: "auth=available-after-retry",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Chrome"))

            let unavailable = KeychainCacheStore.withLoadFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
                CookieHeaderCache.loadForDisplay(provider: provider)
            }

            #expect(unavailable == nil)
            #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)

            try await Task.sleep(for: .milliseconds(60))
            var retried: CookieHeaderCache.Entry?
            for _ in 0..<500 {
                retried = CookieHeaderCache.loadForDisplay(provider: provider)
                if retried != nil { break }
                try await Task.sleep(for: .milliseconds(10))
            }
            #expect(retried?.cookieHeader == "auth=available-after-retry")
        }
    }

    @Test
    func `temporary first display read returns a concurrent store`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        _ = CookieHeaderCache.beginDisplayReadGenerationForTesting(provider: provider)
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=concurrent", sourceLabel: "Chrome")

        #expect(CookieHeaderCache.currentDisplayEntryForTesting(provider: provider)?
            .cookieHeader == "auth=concurrent")
    }

    @Test
    func `failed keychain mutations preserve the display snapshot`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=old", sourceLabel: "Chrome")
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=old")

        KeychainCacheStore.withStoreFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
            CookieHeaderCache.store(provider: provider, cookieHeader: "auth=new", sourceLabel: "Safari")
        }
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=old")

        let cleared = KeychainCacheStore.withClearFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
            CookieHeaderCache.clearDetailed(provider: provider)
        }
        #expect(cleared == CookieHeaderCache.ClearSummary(clearedCount: 0, failedCount: 1))
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=old")
        #expect(CookieHeaderCache.load(provider: provider)?.cookieHeader == "auth=old")
    }

    @Test
    func `legacy removal invalidates a snapshot after failed keychain clear`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        KeychainCacheStore.withServiceOverrideForTesting("legacy-clear-\(UUID().uuidString)") {
            let legacyBase = FileManager.default.temporaryDirectory
                .appendingPathComponent(UUID().uuidString, isDirectory: true)
            CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
                let provider: UsageProvider = .codex
                CookieHeaderCache.store(
                    CookieHeaderCache.Entry(
                        cookieHeader: "auth=legacy",
                        storedAt: Date(timeIntervalSince1970: 0),
                        sourceLabel: "Legacy"),
                    to: CookieHeaderCache.legacyURLForTesting(provider: provider))

                let displayed = KeychainCacheStore
                    .withStoreFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
                        CookieHeaderCache.loadForDisplay(provider: provider)
                    }
                #expect(displayed?.cookieHeader == "auth=legacy")

                let cleared = KeychainCacheStore.withClearFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
                    CookieHeaderCache.clearDetailed(provider: provider)
                }

                #expect(cleared == CookieHeaderCache.ClearSummary(clearedCount: 1, failedCount: 1))
                #expect(!CookieHeaderCache.hasLegacyEntryForTesting(provider: provider))
                #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)
            }
        }
    }

    @Test
    func `clear all reports keychain enumeration failure`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let summary = KeychainCacheStore.withKeysFailureStatusOverrideForTesting(errSecInteractionNotAllowed) {
            CookieHeaderCache.clearAllDetailed()
        }

        #expect(summary.failedCount >= 1)
    }

    @Test
    func `clear reports legacy file deletion failure`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        let legacyBase = FileManager.default.temporaryDirectory
            .appendingPathComponent(UUID().uuidString, isDirectory: true)
        CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
            let provider: UsageProvider = .codex
            CookieHeaderCache.store(
                CookieHeaderCache.Entry(
                    cookieHeader: "auth=legacy",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Legacy"),
                to: CookieHeaderCache.legacyURLForTesting(provider: provider))

            let summary = CookieHeaderCache.withLegacyRemovalFailureForTesting {
                CookieHeaderCache.clearDetailed(provider: provider)
            }

            #expect(summary.failedCount == 1)
            #expect(CookieHeaderCache.hasLegacyEntryForTesting(provider: provider))
        }
    }
    #endif

    @Test
    func `store and clear update the display snapshot immediately`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=first", sourceLabel: "Chrome")
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=first")

        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=second", sourceLabel: "Safari")
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=second")

        CookieHeaderCache.clear(provider: provider)
        #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)
    }

    @Test
    func `stale refresh cannot overwrite a newer store`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=old", sourceLabel: "Chrome")
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=old")

        // A refresh scheduled now races with a store that lands before it commits.
        let staleGeneration = CookieHeaderCache.beginDisplayReadGenerationForTesting(provider: provider)
        let staleEntry = CookieHeaderCache.load(provider: provider)
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=new", sourceLabel: "Safari")

        let committed = CookieHeaderCache.commitDisplaySnapshotIfCurrentForTesting(
            provider: provider,
            entry: staleEntry,
            generation: staleGeneration)

        #expect(committed?.cookieHeader == "auth=new")
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=new")
    }

    @Test
    func `stale refresh cannot resurrect a cleared snapshot`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=secret", sourceLabel: "Chrome")
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=secret")

        let staleGeneration = CookieHeaderCache.beginDisplayReadGenerationForTesting(provider: provider)
        let staleEntry = CookieHeaderCache.load(provider: provider)
        CookieHeaderCache.clear(provider: provider)

        let committed = CookieHeaderCache.commitDisplaySnapshotIfCurrentForTesting(
            provider: provider,
            entry: staleEntry,
            generation: staleGeneration)

        #expect(committed == nil)
        #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)
    }

    @Test
    func `stale refresh cannot survive clear all`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        CookieHeaderCache.store(provider: provider, cookieHeader: "auth=secret", sourceLabel: "Chrome")
        #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=secret")

        let staleGeneration = CookieHeaderCache.beginDisplayReadGenerationForTesting(provider: provider)
        let staleEntry = CookieHeaderCache.load(provider: provider)
        CookieHeaderCache.clearAll()

        CookieHeaderCache.commitDisplaySnapshotIfCurrentForTesting(
            provider: provider,
            entry: staleEntry,
            generation: staleGeneration)

        #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)
    }

    @Test
    func `clear all invalidates an in flight first display population`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }

        let provider: UsageProvider = .codex
        KeychainCacheStore.store(
            key: .cookie(provider: provider.instanceID),
            entry: CookieHeaderCache.Entry(
                cookieHeader: "auth=secret",
                storedAt: Date(timeIntervalSince1970: 0),
                sourceLabel: "Chrome"))

        // A first display load registers its key, then reads the Keychain outside the lock.
        let staleGeneration = CookieHeaderCache.beginDisplayReadGenerationForTesting(provider: provider)
        let staleEntry = CookieHeaderCache.load(provider: provider)
        CookieHeaderCache.clearAll()

        let committed = CookieHeaderCache.commitDisplaySnapshotIfCurrentForTesting(
            provider: provider,
            entry: staleEntry,
            generation: staleGeneration)

        #expect(committed == nil)
        #expect(CookieHeaderCache.loadForDisplay(provider: provider) == nil)
    }

    @Test
    func `stale display snapshot revalidates off the calling path`() async throws {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }
        CookieHeaderCache.resetDisplayCacheForTesting()
        defer { CookieHeaderCache.resetDisplayCacheForTesting() }
        try await CookieHeaderCache.withDisplayStalenessIntervalOverrideForTesting(0) {
            let provider: UsageProvider = .codex
            KeychainCacheStore.store(
                key: .cookie(provider: provider.instanceID),
                entry: CookieHeaderCache.Entry(
                    cookieHeader: "auth=old",
                    storedAt: Date(timeIntervalSince1970: 0),
                    sourceLabel: "Chrome"))
            #expect(CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=old")

            KeychainCacheStore.store(
                key: .cookie(provider: provider.instanceID),
                entry: CookieHeaderCache.Entry(
                    cookieHeader: "auth=new",
                    storedAt: Date(timeIntervalSince1970: 1),
                    sourceLabel: "Chrome"))

            // The stale lookup returns the old snapshot and schedules a revalidation.
            _ = CookieHeaderCache.loadForDisplay(provider: provider)
            var refreshed = false
            for _ in 0..<200 {
                if CookieHeaderCache.loadForDisplay(provider: provider)?.cookieHeader == "auth=new" {
                    refreshed = true
                    break
                }
                try await Task.sleep(nanoseconds: 10_000_000)
            }
            #expect(refreshed)
        }
    }

    @Test
    func `clear all removes every provider cookie key without decoding entries`() {
        KeychainCacheStore.setTestStoreForTesting(true)
        defer { KeychainCacheStore.setTestStoreForTesting(false) }

        KeychainCacheStore.withServiceOverrideForTesting("cookie-clear-all-\(UUID().uuidString)") {
            CookieHeaderCache.store(provider: .claude, cookieHeader: "auth=claude", sourceLabel: "Chrome")
            CookieHeaderCache.store(
                provider: .codex,
                scope: .managedAccount(UUID()),
                cookieHeader: "auth=codex",
                sourceLabel: "Chrome")
            KeychainCacheStore.store(
                key: .cookie(provider: .cursor),
                entry: WrongEntry(value: "invalid"))

            let cleared = CookieHeaderCache.clearAllDetailed()

            #expect(cleared.clearedCount >= 3)
            #expect(cleared.failedCount == 0)
            #expect(KeychainCacheStore.keys(category: "cookie").isEmpty)
        }
    }

    private func withIsolatedCookieCache<T>(_ operation: () -> T) -> T {
        KeychainCacheStore.withServiceOverrideForTesting("cookie-isolation-\(UUID().uuidString)") {
            let legacyBase = FileManager.default.temporaryDirectory
                .appendingPathComponent(UUID().uuidString, isDirectory: true)
            return CookieHeaderCache.withLegacyBaseURLOverrideForTesting(legacyBase) {
                KeychainCacheStore.setTestStoreForTesting(true)
                defer { KeychainCacheStore.setTestStoreForTesting(false) }
                CookieHeaderCache.resetDisplayCacheForTesting()
                defer { CookieHeaderCache.resetDisplayCacheForTesting() }
                return operation()
            }
        }
    }
}
