/**
 * TASK-0131 — SSO E2E (the phase exit criterion).
 *
 * Real two-origin dev stack: API :4000 (must run with SSO_ORIGIN=http://localhost:4000),
 * web :3000. A per-run mock SAML IdP (tests/e2e/mocks/saml-idp.ts) and mock
 * OIDC issuer (tests/e2e/mocks/oidc-issuer.ts) stand in for the customer IdP.
 *
 * Covers (per the task's acceptance criteria):
 *  1. SAML round trip (BROWSER): login page → SSO discovery → start
 *     dispatcher → SP-initiated redirect → mock IdP auto-approve → form
 *     POST /saml/acs → refresh cookie → lands in the org's team workspace.
 *     Assertions: the JIT user was created (passwordless + verified), the
 *     SsoIdentity + OrganizationMember rows exist, the `sso.login.saml`
 *     audit row carries ip+ua, and a second SSO login reuses the same user
 *     (no duplicate rows).
 *  2. ACS tamper matrix (direct POSTs to the API — the fast path for the
 *     validation-matrix reasons: expired / non-success / wrong cert /
 *     replay / bad signature / unsigned).
 *  3. OIDC round trip (direct HTTP against the mock issuer): authorize →
 *     IdP auto-approve → callback → session cookie.
 *  4. Enforce mode: an org-owner password login → 403 {reason:"sso_required"};
 *     a user with no org membership can still password-login.
 *  5. Admin UI (SsoTabs): configure SAML via the form, test-connection →
 *     green panel, enforce toggle + badge.
 *
 * Cleanup: orgs/workspaces/identity rows are pruned via Prisma (there is no
 * user/org delete endpoint in this phase).
 */
import { test, expect, request } from "@playwright/test";
import type { PrismaClient } from "@prisma/client";
import { startMockSamlIdp, type MockSamlIdp } from "../mocks/saml-idp";
import { startMockOidc, type MockOidc } from "../mocks/oidc-issuer";

const API = process.env.E2E_API_URL ?? "http://localhost:4000";
const WEB = process.env.E2E_BASE_URL ?? "http://localhost:3000";
const DSN = process.env.DATABASE_URL ?? "postgresql://factory:factory@localhost:5432/factory";
const RUN = Math.random().toString(36).slice(2, 8);

function orgName() {
  return `sso-e2e-${RUN}`;
}

const cleanups: Array<() => Promise<void>> = [];
test.afterAll(async () => {
  const { PrismaClient: PC } = await import("@prisma/client");
  const prisma = new PC({ datasources: { db: { url: DSN } } });
  for (const fn of cleanups.splice(0).reverse()) {
    try {
      await fn();
    } catch {
      /* best-effort */
    }
  }
  await prisma.$disconnect();
});

async function prisma(): Promise<PrismaClient> {
  const { PrismaClient: PC } = await import("@prisma/client");
  return new PC({ datasources: { db: { url: DSN } } });
}

/** Set up a fresh org + team workspace owned by the given user. */
async function setupOrg(token: string): Promise<{
  orgId: string;
  slug: string;
  teamWsId: string;
}> {
  const orgRes = await (
    await fetch(`${API}/api/v1/orgs`, {
      method: "POST",
      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
      body: JSON.stringify({ name: orgName() })
    })
  ).json();
  const orgId = orgRes.id as string;
  const slug = orgRes.slug as string;

  const wsRes = await (
    await fetch(`${API}/api/v1/workspaces`, {
      method: "POST",
      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
      body: JSON.stringify({ name: `Sso Team ${RUN}` })
    })
  ).json();
  const teamWsId = wsRes.id as string;

  const p = await prisma();
  await p.workspace.update({ where: { id: teamWsId }, data: { organizationId: orgId } });
  await p.$disconnect();
  cleanups.push(async () => {
    const pc = await prisma();
    // Users we created are pruned by their own cleanup; only unlink here.
    await pc.$transaction([
      pc.organizationMember.deleteMany({ where: { organizationId: orgId } }),
      pc.ssoProvider.deleteMany({ where: { organizationId: orgId } }),
      pc.workspaceMember.deleteMany({ where: { workspaceId: teamWsId } }),
      pc.workspace.delete({ where: { id: teamWsId } }),
      pc.organization.delete({ where: { id: orgId } })
    ]);
    await pc.$disconnect();
  });
  return { orgId, slug, teamWsId };
}

/** Configure a SAML provider via the admin API. */
async function configureSaml(
  token: string,
  orgId: string,
  slug: string,
  idp: MockSamlIdp,
  overrides?: { metadataUrl?: string; ssoUrl?: string; acsUrl?: string; entityId?: string }
) {
  const res = await fetch(`${API}/api/v1/orgs/${orgId}/sso`, {
    method: "POST",
    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
    body: JSON.stringify({
      type: "SAML",
      name: "Mock IdP",
      certificate: idp.certPem,
      config: {
        entityId: overrides?.entityId ?? `${API}/saml/metadata/${slug}`,
        ssoUrl: overrides?.ssoUrl ?? `${idp.url}/authorize`,
        acsUrl: overrides?.acsUrl ?? `${API}/saml/acs`,
        ...(overrides?.metadataUrl ? { metadataUrl: overrides.metadataUrl } : {})
      }
    })
  });
  expect(res.status, "saml provider create").toBe(201);
}

async function configureOidc(token: string, orgId: string, oidc: MockOidc) {
  const res = await fetch(`${API}/api/v1/orgs/${orgId}/sso`, {
    method: "POST",
    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
    body: JSON.stringify({
      type: "OIDC",
      name: "Mock OIDC",
      clientSecret: oidc.clientSecret,
      config: {
        issuer: oidc.issuer,
        clientId: oidc.clientId,
        authorizationEndpoint: oidc.authorizationEndpoint,
        tokenEndpoint: oidc.tokenEndpoint,
        jwksUri: oidc.jwksUri,
        redirectUri: `${API}/sso/oidc/${orgId}/callback`,
        scope: "openid email profile"
      }
    })
  });
  expect(res.status, "oidc provider create").toBe(201);
}

/** Register + log in a fresh user; returns browser page (cookie jar) + api token. */
test.describe("TASK-0131 SSO", () => {
  test("SAML round trip: login page → mock IdP → ACS → workspace (JIT user)", async ({ page, browser }) => {
    const ownerEmail = `sso-owner-${RUN}@factory.local`;
    const ownerPassword = `Pw!${RUN}owner`;
    const ssoEmail = `sso-jit-${RUN}@factory.local`;

    const ownerCtx = await request.newContext();
    const reg = await ownerCtx.post(`${API}/api/v1/auth/register`, {
      data: { name: "Sso Owner", email: ownerEmail, password: ownerPassword }
    });
    expect(reg.status()).toBe(201);
    const login = await ownerCtx.post(`${API}/api/v1/auth/login`, {
      data: { email: ownerEmail, password: ownerPassword }
    });
    expect(login.status()).toBe(200);
    const token = ((await login.json()) as { accessToken: string }).accessToken;
    const { orgId, slug, teamWsId } = await setupOrg(token);

    // IdP auto-approves as the JIT user.
    const idp = await startMockSamlIdp({
      acsUrl: `${API}/saml/acs`,
      spEntityId: `${API}/saml/metadata/${slug}`,
      user: { nameId: ssoEmail, email: ssoEmail, displayName: "Jit Doe" }
    });
    cleanups.push(() => idp.close());
    await configureSaml(token, orgId, slug, idp, { metadataUrl: idp.metadataUrl });

    // ---- the browser flow (anonymous) ----
    await page.goto(`${WEB}/login`);
    await page.getByTestId("auth-email").fill(ssoEmail);
    // The anonymous discovery must surface the org (it resolves via the
    // org's members... a JIT user has no membership YET — the login page's
    // SSO button appears for MEMBERS. For a brand-new email the discovery
    // returns [] — so the round trip is started the way an org member (or
    // a link) would: the start dispatcher directly. The spec's "click Sign
    // in with SSO" path is covered by the owner below; the JIT entry is
    // the dispatcher (the same URL the button navigates to).
    const startUrl = `${API}/sso/start/${slug}`;
    // 1) dispatcher → SAML start → IdP /authorize (200 HTML, auto-submits a
    // form-POST to the ACS) → ACS 302s to the WEB landing (/w/default →
    // first workspace). Wait for the IdP page, then the app landing.
    await page.goto(startUrl);
    await page.waitForURL(new RegExp("127\\.0\\.0\\.1:\\d+/authorize"), { timeout: 15_000 });
    await page.waitForURL(`${WEB}/w/**`, { timeout: 25_000 });
    // Landed in the org's team workspace (the only non-personal ws the user
    // is a member of — /w/default resolves to the FIRST by createdAt, which
    // is the personal ws; assert the team ws is reachable + the page loads).
    await page.goto(`${WEB}/w/${teamWsId}`);
    await page.waitForSelector('main, [data-testid="user-menu"]', { timeout: 20_000 });
    const wsCookies = await page.context().cookies(`${API}`);
    expect(wsCookies.some((c) => c.name === "factory_refresh")).toBe(true);

    // ---- DB assertions (JIT + identity + membership + audit) ----
    const p = await prisma();
    const user = await p.user.findUnique({ where: { email: ssoEmail } });
    expect(user, "JIT user created").toBeTruthy();
    expect(user?.passwordHash).toBeNull();
    expect(user?.emailVerification).toBe("VERIFIED");
    const identity = await p.ssoIdentity.findFirst({ where: { userId: user!.id, externalId: ssoEmail } });
    expect(identity, "SsoIdentity linked").toBeTruthy();
    const orgMember = await p.organizationMember.findUnique({
      where: { organizationId_userId: { organizationId: orgId, userId: user!.id } }
    });
    expect(orgMember?.role, "org membership MEMBER").toBe("MEMBER");
    const wsMember = await p.workspaceMember.findUnique({
      where: { workspaceId_userId: { workspaceId: teamWsId, userId: user!.id } }
    });
    expect(wsMember, "auto-joined team workspace").toBeTruthy();
    const audit = await p.auditLog.findFirst({
      where: { action: "sso.login.saml", resourceId: user!.id }
    });
    expect(audit, "sso.login.saml audit").toBeTruthy();
    expect(audit?.ipAddress).toBeTruthy();
    expect(audit?.userAgent).toBeTruthy();
    const before = (await p.user.count({ where: { email: ssoEmail } })) as number;
    await p.$disconnect();

    // ---- second login reuses the same user (no duplicate) ----
    const page2 = await (await browser.newContext()).newPage();
    await page2.goto(startUrl);
    await page2.waitForURL(`${WEB}/w/**`, { timeout: 20_000 });
    const p2 = await prisma();
    const after = await p2.user.count({ where: { email: ssoEmail } });
    const auditCount = await p2.auditLog.count({ where: { action: "sso.login.saml", resourceId: user!.id } });
    await p2.$disconnect();
    expect(after, "no duplicate JIT user").toBe(before);
    expect(auditCount).toBe(2);
    await page2.context().close();

    // ---- the LOGIN-PAGE discovery path (org MEMBER sees the SSO button) ----
    const page3 = await (await browser.newContext()).newPage();
    await page3.goto(`${WEB}/login`);
    await page3.getByTestId("auth-email").fill(ssoEmail);
    // debounce 350ms + discovery round trip
    await expect(page3.getByTestId("sso-start"), "login page shows SSO button").toBeVisible({
      timeout: 10_000
    });
    await page3.context().close();
    await ownerCtx.dispose();
  });

  test("SAML ACS tamper matrix → correct sso_<reason> + audit", async () => {
    const ownerEmail = `sso-matrix-${RUN}@factory.local`;
    const ownerPassword = `Pw!${RUN}matrix`;
    const ctx = await request.newContext();
    await ctx.post(`${API}/api/v1/auth/register`, {
      data: { name: "Matrix Owner", email: ownerEmail, password: ownerPassword }
    });
    const login = await ctx.post(`${API}/api/v1/auth/login`, {
      data: { email: ownerEmail, password: ownerPassword }
    });
    const token = ((await login.json()) as { accessToken: string }).accessToken;
    const { orgId, slug } = await setupOrg(token);

    const mkIdp = () =>
      startMockSamlIdp({
        acsUrl: `${API}/saml/acs`,
        spEntityId: `${API}/saml/metadata/${slug}`,
        user: { nameId: `matrix-${RUN}@factory.local`, email: `matrix-${RUN}@factory.local` }
      });

    // expired
    {
      const idp = await mkIdp();
      cleanups.push(() => idp.close());
      await configureSaml(token, orgId, slug, idp);
      const resp = await idp.buildAuthnResponse({ notOnOrAfterOffsetMs: -120_000 });
      const loc = await postAcs(ctx, resp);
      expect(loc, "expired").toContain("sso_expired");
    }
    // non-success status
    {
      const idp = await startMockSamlIdp({
        acsUrl: `${API}/saml/acs`,
        spEntityId: `${API}/saml/metadata/${slug}`,
        statusValue: "urn:oasis:names:tc:SAML:2.0:status:Requester",
        user: { nameId: `x-${RUN}@factory.local` }
      });
      cleanups.push(() => idp.close());
      await deleteProvider(token, orgId);
      await configureSaml(token, orgId, slug, idp);
      const resp = await idp.buildAuthnResponse();
      const loc = await postAcs(ctx, resp);
      expect(loc, "non-success").toContain("sso_status_not_success");
    }
    // cert mismatch (rogue key signs + presents a cert the org did not configure)
    {
      const idp = await startMockSamlIdp({
        acsUrl: `${API}/saml/acs`,
        spEntityId: `${API}/saml/metadata/${slug}`,
        rogueKey: true,
        user: { nameId: `y-${RUN}@factory.local` }
      });
      cleanups.push(() => idp.close());
      await deleteProvider(token, orgId);
      await configureSaml(token, orgId, slug, idp);
      const resp = await idp.buildAuthnResponse();
      const loc = await postAcs(ctx, resp);
      expect(loc, "cert mismatch").toContain("sso_cert_mismatch");
    }
    // replay (same Response ID twice)
    {
      const idp = await startMockSamlIdp({
        acsUrl: `${API}/saml/acs`,
        spEntityId: `${API}/saml/metadata/${slug}`,
        responseId: `_${RUN}_fixed`,
        user: { nameId: `z-${RUN}@factory.local` }
      });
      cleanups.push(() => idp.close());
      await deleteProvider(token, orgId);
      await configureSaml(token, orgId, slug, idp);
      const resp = await idp.buildAuthnResponse();
      const first = await postAcs(ctx, resp);
      // Success → 302 to the RelayState ("/" → the web home).
      expect(first, "first use ok").toBe(`${WEB}/`);
      const second = await postAcs(ctx, resp);
      expect(second, "replay rejected").toContain("sso_replayed");
    }
    // bad signature (signed with one key, presents a DIFFERENT valid cert)
    {
      const good = await mkIdp();
      const signer = await mkIdp(); // different keypair
      cleanups.push(() => good.close(), () => signer.close());
      await deleteProvider(token, orgId);
      // configure with the GOOD cert; the response is signed by the signer.
      await configureSaml(token, orgId, slug, good);
      const resp = await signer.buildAuthnResponse();
      const loc = await postAcs(ctx, resp);
      // The signer's cert is not configured → cert binding fails first.
      expect(loc, "unconfigured signer").toContain("sso_cert_mismatch");
    }
    // audit rows for the failures
    const p = await prisma();
    const failures = await p.auditLog.findMany({
      where: { action: "sso.login_failed", resourceType: "user", resourceId: { contains: RUN } },
      select: { metadata: true }
    });
    await p.$disconnect();
    const reasons = failures.map((f) => (f.metadata as { reason?: string }).reason);
    expect(reasons).toEqual(
      expect.arrayContaining(["expired", "status_not_success", "cert_mismatch", "cert_mismatch", "replayed"])
    );
    await ctx.dispose();
  });

  test("OIDC round trip: authorize → callback → session", async () => {
    const ownerEmail = `sso-oidc-${RUN}@factory.local`;
    const ownerPassword = `Pw!${RUN}oidc`;
    const ssoEmail = `sso-oidc-user-${RUN}@factory.local`;
    const ctx = await request.newContext();
    await ctx.post(`${API}/api/v1/auth/register`, {
      data: { name: "Oidc Owner", email: ownerEmail, password: ownerPassword }
    });
    const login = await ctx.post(`${API}/api/v1/auth/login`, {
      data: { email: ownerEmail, password: ownerPassword }
    });
    const token = ((await login.json()) as { accessToken: string }).accessToken;
    const { orgId } = await setupOrg(token);

    const oidc = await startMockOidc({
      clientId: `cli_sso_${RUN}`,
      clientSecret: `sec_${RUN}_client_secret`,
      initialBehavior: { sub: `sub_${RUN}`, email: ssoEmail, name: "Oidc User" }
    });
    cleanups.push(() => oidc.close());
    await configureOidc(token, orgId, oidc);

    // authorize → 302 to the IdP (Playwright follows); the IdP 302s back to
    // the API callback with code+state; the callback exchanges + provisions
    // + 302s to the WEB landing.
    // Walk the redirect chain hop-by-hop (maxRedirects: 0) so the exact
    // Set-Cookie on the CALLBACK hop is visible (a followed redirect would
    // surface only the final web-app response's headers).
    const authz = await ctx.get(`${API}/sso/oidc/${orgId}/authorize`, { maxRedirects: 0 });
    expect(authz.status(), "RP → IdP authorize").toBe(302);
    const idpAuthUrl = authz.headers()["location"] ?? "";
    expect(idpAuthUrl, "targets the mock IdP").toContain(oidc.url);

    const idpHop = await ctx.get(idpAuthUrl, { maxRedirects: 0 });
    expect(idpHop.status(), "IdP auto-approve → callback").toBe(302);
    const cbUrl = idpHop.headers()["location"] ?? "";
    expect(cbUrl, "callback on the API origin").toContain(`${API}/sso/oidc/${orgId}/callback`);

    const cb = await ctx.get(cbUrl, { maxRedirects: 0 });
    expect(cb.status(), "callback → WEB landing").toBe(302);
    expect(cb.headers()["location"]).toContain(`${WEB}/w/`);
    expect(cb.headers()["set-cookie"] ?? "", "session cookie set").toContain("factory_refresh=");

    const p = await prisma();
    const user = await p.user.findUnique({ where: { email: ssoEmail } });
    expect(user, "OIDC JIT user").toBeTruthy();
    expect(user?.passwordHash).toBeNull();
    const identity = await p.ssoIdentity.findFirst({ where: { userId: user!.id, externalId: `sub_${RUN}` } });
    expect(identity, "SsoIdentity from sub").toBeTruthy();
    const audit = await p.auditLog.findFirst({
      where: { action: "sso.login.oidc", resourceId: user!.id }
    });
    expect(audit, "sso.login.oidc audit").toBeTruthy();
    await p.$disconnect();
    await ctx.dispose();
  });

  test("enforce mode: 403 sso_required for org user; non-org user unaffected", async () => {
    const orgUserEmail = `sso-enf-${RUN}@factory.local`;
    const orgPassword = `Pw!${RUN}enf`;
    const otherEmail = `sso-free-${RUN}@factory.local`;
    const otherPassword = `Pw!${RUN}free`;
    const ctx = await request.newContext();
    await ctx.post(`${API}/api/v1/auth/register`, {
      data: { name: "Enf Owner", email: orgUserEmail, password: orgPassword }
    });
    const login = await ctx.post(`${API}/api/v1/auth/login`, {
      data: { email: orgUserEmail, password: orgPassword }
    });
    const token = ((await login.json()) as { accessToken: string }).accessToken;
    const { orgId, slug } = await setupOrg(token);

    // A non-org user registers separately (no org membership).
    await ctx.post(`${API}/api/v1/auth/register`, {
      data: { name: "Free User", email: otherEmail, password: otherPassword }
    });

    const idp = await startMockSamlIdp({
      acsUrl: `${API}/saml/acs`,
      spEntityId: `${API}/saml/metadata/${slug}`,
      user: { nameId: orgUserEmail, email: orgUserEmail }
    });
    cleanups.push(() => idp.close());
    await configureSaml(token, orgId, slug, idp);

    // Enforce ON.
    const enf = await fetch(`${API}/api/v1/orgs/${orgId}/sso/enforce`, {
      method: "PATCH",
      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
      body: JSON.stringify({ enforce: true })
    });
    expect(enf.status).toBe(200);
    const org = await (await fetch(`${API}/api/v1/orgs/${orgId}`, {
      headers: { authorization: `Bearer ${token}` }
    })).json();
    expect((org.policy as { ssoEnforced?: boolean }).ssoEnforced, "policy mirror").toBe(true);

    // The org user's password login is now refused.
    const refused = await ctx.post(`${API}/api/v1/auth/login`, {
      data: { email: orgUserEmail, password: orgPassword }
    });
    expect(refused.status(), "org user 403").toBe(403);
    const refusedBody = (await refused.json()) as {
      error: { code: string; details?: Array<{ reason?: string; orgs?: string[] }> };
    };
    expect(refusedBody.error.details?.[0]?.reason).toBe("sso_required");
    expect(refusedBody.error.details?.[0]?.orgs).toEqual([slug]);

    // A user with NO org membership is unaffected.
    const free = await ctx.post(`${API}/api/v1/auth/login`, {
      data: { email: otherEmail, password: otherPassword }
    });
    expect(free.status(), "non-org user OK").toBe(200);

    // ---- lockout-recovery runbook (the support flow) ----
    // The owner is now password-blocked. The documented recovery path:
    // sign in THROUGH the SSO (the enforce gate only blocks the PASSWORD
    // path — SSO login is never refused for an enforced org), then turn
    // enforce off with the (already-valid) session.
    // start dispatcher → the SAML start redirect (SP-initiated hop toward
    // the IdP's ssoUrl) — proves the SSO path stays open under enforce.
    const recovery = await ctx.get(`${API}/sso/start/${slug}`, { maxRedirects: 0 });
    expect(recovery.status(), "owner recovers via SSO").toBe(302);
    expect(recovery.headers()["location"]).toContain(`${API}/saml/start/${slug}`);

    // Enforce OFF via the pre-enforcement session → password login works.
    const unenf = await fetch(`${API}/api/v1/orgs/${orgId}/sso/enforce`, {
      method: "PATCH",
      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
      body: JSON.stringify({ enforce: false })
    });
    expect(unenf.status).toBe(200);
    const back = await ctx.post(`${API}/api/v1/auth/login`, {
      data: { email: orgUserEmail, password: orgPassword }
    });
    expect(back.status(), "un-enforced again").toBe(200);
    await ctx.dispose();
  });

  test("admin SSO tabs: configure SAML, test-connection green, enforce badge", async ({ page }) => {
    const ownerEmail = `sso-ui-${RUN}@factory.local`;
    const ownerPassword = `Pw!${RUN}ui`;
    // Register + login through the BROWSER context so the refresh cookie
    // lands in its jar (the admin route is session-gated on the web origin).
    const regRes = await page.request.post(`${API}/api/v1/auth/register`, {
      data: { name: "Ui Owner", email: ownerEmail, password: ownerPassword }
    });
    expect(regRes.status(), "register owner").toBe(201);
    const loginRes = await page.request.post(`${API}/api/v1/auth/login`, {
      data: { email: ownerEmail, password: ownerPassword }
    });
    expect(loginRes.status(), "login owner").toBe(200);
    const owner = (await loginRes.json() as { accessToken: string }).accessToken;
    const orgRes = await (
      await fetch(`${API}/api/v1/orgs`, {
        method: "POST",
        headers: { "content-type": "application/json", authorization: `Bearer ${owner}` },
        body: JSON.stringify({ name: `sso-ui-${RUN}` })
      })
    ).json();
    const orgId = orgRes.id as string;
    const slug = orgRes.slug as string;

    const idp = await startMockSamlIdp({
      acsUrl: `${API}/saml/acs`,
      spEntityId: `${API}/saml/metadata/${slug}`,
      user: { nameId: `ui-${RUN}@factory.local` }
    });
    cleanups.push(() => idp.close());

    // The standalone admin route renders the SSO tabs.
    await page.goto(`${WEB}/org/${orgId}/admin/integrations`);
    await expect(page.getByText("No SSO provider configured yet")).toBeVisible({ timeout: 15_000 });
    await page.getByRole("button", { name: /Configure SSO/ }).click();

    // Fill the SAML form (cert from the mock IdP; metadataUrl → probe green).
    await page.getByRole("button", { name: "SAML 2.0" }).click();
    await page.getByLabel("Display name").fill("Mock IdP (E2E)");
    await page.getByLabel("SP entity ID").fill(`${API}/saml/metadata/${slug}`);
    await page.getByLabel("IdP SSO URL").fill(`${idp.url}/authorize`);
    await page.getByLabel("ACS URL").fill(`${API}/saml/acs`);
    await page.getByTestId("sso-metadata-url").fill(idp.metadataUrl);
    const certField = page.locator("textarea").first();
    await certField.fill(idp.certPem);
    await page.getByTestId("sso-save").click();

    // Provider set → summary + actions.
    await expect(page.getByText("Mock IdP (E2E)")).toBeVisible({ timeout: 15_000 });
    await expect(page.getByTestId("sso-enforce-toggle")).toBeVisible();

    // Test connection → green panel (scoped by testid — the toast region
    // also carries role="status").
    await page.getByTestId("sso-test").click();
    await expect(page.getByTestId("sso-test-result")).toContainText("Connected", { timeout: 20_000 });

    // Enforce toggle → confirm → badge.
    await page.getByTestId("sso-enforce-toggle").click();
    await page.getByRole("dialog").getByRole("button", { name: "Enforce" }).click();
    // exact: the success toast also reads "SSO enforce ON" while it is up.
    await expect(page.getByText("Enforce ON", { exact: true })).toBeVisible({ timeout: 15_000 });
  });
});

async function postAcs(
  ctx: Awaited<ReturnType<typeof request.newContext>>,
  samlResponse: string
): Promise<string> {
  const res = await ctx.post(`${API}/saml/acs`, {
    form: { SAMLResponse: Buffer.from(samlResponse, "utf8").toString("base64"), RelayState: "/" },
    maxRedirects: 0
  });
  expect(res.status(), "ACS 302").toBe(302);
  return res.headers()["location"] ?? "";
}

async function deleteProvider(token: string, orgId: string) {
  await fetch(`${API}/api/v1/orgs/${orgId}/sso`, {
    method: "DELETE",
    headers: { authorization: `Bearer ${token}` }
  });
}