import { createServer, ServerResponse, type IncomingMessage, type Server } from 'node:http';
import { JSONRPCMessage } from '../../src/types.js';
import { SSEClientTransport } from '../../src/client/sse.js';
import { OAuthClientProvider, UnauthorizedError } from '../../src/client/auth.js';
import { OAuthTokens } from '../../src/shared/auth.js';
import { InvalidClientError, InvalidGrantError, UnauthorizedClientError } from '../../src/server/auth/errors.js';
import { Mock, Mocked, MockedFunction, MockInstance } from 'vitest';
import { listenOnRandomPort } from '../helpers/http.js';
import { AddressInfo } from 'node:net';

/**
 * Parses HTTP Basic auth from a request's Authorization header.
 * Returns the decoded client_id and client_secret, or undefined if the header is absent or malformed.
 * client_secret_basic is the default client auth method when server metadata omits
 * token_endpoint_auth_methods_supported (RFC 8414 §2).
 */
function parseBasicAuth(req: IncomingMessage): { clientId: string; clientSecret: string } | undefined {
    const auth = req.headers.authorization;
    if (!auth || !auth.startsWith('Basic ')) return undefined;
    const decoded = Buffer.from(auth.slice(6), 'base64').toString('utf8');
    const sep = decoded.indexOf(':');
    if (sep === -1) return undefined;
    return { clientId: decoded.slice(0, sep), clientSecret: decoded.slice(sep + 1) };
}

describe('SSEClientTransport', () => {
    let resourceServer: Server;
    let authServer: Server;
    let transport: SSEClientTransport;
    let resourceBaseUrl: URL;
    let authBaseUrl: URL;
    let lastServerRequest: IncomingMessage;
    let sendServerMessage: ((message: string) => void) | null = null;

    beforeEach(async () => {
        // Reset state
        lastServerRequest = null as unknown as IncomingMessage;
        sendServerMessage = null;

        authServer = createServer((req, res) => {
            if (req.url === '/.well-known/oauth-authorization-server') {
                res.writeHead(200, {
                    'Content-Type': 'application/json'
                });
                res.end(
                    JSON.stringify({
                        issuer: 'https://auth.example.com',
                        authorization_endpoint: 'https://auth.example.com/authorize',
                        token_endpoint: 'https://auth.example.com/token',
                        registration_endpoint: 'https://auth.example.com/register',
                        response_types_supported: ['code'],
                        code_challenge_methods_supported: ['S256']
                    })
                );
                return;
            }
            res.writeHead(401).end();
        });

        // Create a test server that will receive the EventSource connection
        resourceServer = createServer((req, res) => {
            lastServerRequest = req;

            // Send SSE headers
            res.writeHead(200, {
                'Content-Type': 'text/event-stream',
                'Cache-Control': 'no-cache, no-transform',
                Connection: 'keep-alive'
            });

            // Send the endpoint event
            res.write('event: endpoint\n');
            res.write(`data: ${resourceBaseUrl.href}\n\n`);

            // Store reference to send function for tests
            sendServerMessage = (message: string) => {
                res.write(`data: ${message}\n\n`);
            };

            // Handle request body for POST endpoints
            if (req.method === 'POST') {
                let body = '';
                req.on('data', chunk => {
                    body += chunk;
                });
                req.on('end', () => {
                    (req as IncomingMessage & { body: string }).body = body;
                    res.end();
                });
            }
        });

        // Start server on random port
        await new Promise<void>(resolve => {
            resourceServer.listen(0, '127.0.0.1', () => {
                const addr = resourceServer.address() as AddressInfo;
                resourceBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                resolve();
            });
        });

        vi.spyOn(console, 'error').mockImplementation(() => {});
    });

    afterEach(async () => {
        await transport.close();
        await resourceServer.close();
        await authServer.close();

        vi.clearAllMocks();
    });

    describe('connection handling', () => {
        it('establishes SSE connection and receives endpoint', async () => {
            transport = new SSEClientTransport(resourceBaseUrl);
            await transport.start();

            expect(lastServerRequest.headers.accept).toBe('text/event-stream');
            expect(lastServerRequest.method).toBe('GET');
        });

        it('rejects if server returns non-200 status', async () => {
            // Create a server that returns 403
            await resourceServer.close();

            resourceServer = createServer((req, res) => {
                res.writeHead(403);
                res.end();
            });

            resourceBaseUrl = await listenOnRandomPort(resourceServer);

            transport = new SSEClientTransport(resourceBaseUrl);
            await expect(transport.start()).rejects.toThrow();
        });

        it('closes EventSource connection on close()', async () => {
            transport = new SSEClientTransport(resourceBaseUrl);
            await transport.start();

            const closePromise = new Promise(resolve => {
                lastServerRequest.on('close', resolve);
            });

            await transport.close();
            await closePromise;
        });
    });

    describe('message handling', () => {
        it('receives and parses JSON-RPC messages', async () => {
            const receivedMessages: JSONRPCMessage[] = [];
            transport = new SSEClientTransport(resourceBaseUrl);
            transport.onmessage = msg => receivedMessages.push(msg);

            await transport.start();

            const testMessage: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: 'test-1',
                method: 'test',
                params: { foo: 'bar' }
            };

            sendServerMessage!(JSON.stringify(testMessage));

            // Wait for message processing
            await new Promise(resolve => setTimeout(resolve, 50));

            expect(receivedMessages).toHaveLength(1);
            expect(receivedMessages[0]).toEqual(testMessage);
        });

        it('handles malformed JSON messages', async () => {
            const errors: Error[] = [];
            transport = new SSEClientTransport(resourceBaseUrl);
            transport.onerror = err => errors.push(err);

            await transport.start();

            sendServerMessage!('invalid json');

            // Wait for message processing
            await new Promise(resolve => setTimeout(resolve, 50));

            expect(errors).toHaveLength(1);
            expect(errors[0].message).toMatch(/JSON/);
        });

        it('handles messages via POST requests', async () => {
            transport = new SSEClientTransport(resourceBaseUrl);
            await transport.start();

            const testMessage: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: 'test-1',
                method: 'test',
                params: { foo: 'bar' }
            };

            await transport.send(testMessage);

            // Wait for request processing
            await new Promise(resolve => setTimeout(resolve, 50));

            expect(lastServerRequest.method).toBe('POST');
            expect(lastServerRequest.headers['content-type']).toBe('application/json');
            expect(JSON.parse((lastServerRequest as IncomingMessage & { body: string }).body)).toEqual(testMessage);
        });

        it('handles POST request failures', async () => {
            // Create a server that returns 500 for POST
            await resourceServer.close();

            resourceServer = createServer((req, res) => {
                if (req.method === 'GET') {
                    res.writeHead(200, {
                        'Content-Type': 'text/event-stream',
                        'Cache-Control': 'no-cache, no-transform',
                        Connection: 'keep-alive'
                    });
                    res.write('event: endpoint\n');
                    res.write(`data: ${resourceBaseUrl.href}\n\n`);
                } else {
                    res.writeHead(500);
                    res.end('Internal error');
                }
            });

            resourceBaseUrl = await listenOnRandomPort(resourceServer);

            transport = new SSEClientTransport(resourceBaseUrl);
            await transport.start();

            const testMessage: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: 'test-1',
                method: 'test',
                params: {}
            };

            await expect(transport.send(testMessage)).rejects.toThrow(/500/);
        });
    });

    describe('header handling', () => {
        it('uses custom fetch implementation from EventSourceInit to add auth headers', async () => {
            const authToken = 'Bearer test-token';

            // Create a fetch wrapper that adds auth header
            const fetchWithAuth = (url: string | URL, init?: RequestInit) => {
                const headers = new Headers(init?.headers);
                headers.set('Authorization', authToken);
                return fetch(url.toString(), { ...init, headers });
            };

            transport = new SSEClientTransport(resourceBaseUrl, {
                eventSourceInit: {
                    fetch: fetchWithAuth
                }
            });

            await transport.start();

            // Verify the auth header was received by the server
            expect(lastServerRequest.headers.authorization).toBe(authToken);
        });

        it('uses custom fetch implementation from options', async () => {
            const authToken = 'Bearer custom-token';

            const fetchWithAuth = vi.fn((url: string | URL, init?: RequestInit) => {
                const headers = new Headers(init?.headers);
                headers.set('Authorization', authToken);
                return fetch(url.toString(), { ...init, headers });
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                fetch: fetchWithAuth
            });

            await transport.start();

            expect(lastServerRequest.headers.authorization).toBe(authToken);

            // Send a message to verify fetchWithAuth used for POST as well
            const message: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: '1',
                method: 'test',
                params: {}
            };

            await transport.send(message);

            expect(fetchWithAuth).toHaveBeenCalledTimes(2);
            expect(lastServerRequest.method).toBe('POST');
            expect(lastServerRequest.headers.authorization).toBe(authToken);
        });

        it('passes custom headers to fetch requests', async () => {
            const customHeaders = {
                Authorization: 'Bearer test-token',
                'X-Custom-Header': 'custom-value'
            };

            transport = new SSEClientTransport(resourceBaseUrl, {
                requestInit: {
                    headers: customHeaders
                }
            });

            await transport.start();

            const originalFetch = global.fetch;
            try {
                global.fetch = vi.fn().mockResolvedValue({ ok: true });

                const message: JSONRPCMessage = {
                    jsonrpc: '2.0',
                    id: '1',
                    method: 'test',
                    params: {}
                };

                await transport.send(message);

                const calledHeaders = (global.fetch as Mock).mock.calls[0][1].headers;
                expect(calledHeaders.get('Authorization')).toBe('Bearer test-token');
                expect(calledHeaders.get('X-Custom-Header')).toBe('custom-value');
                expect(calledHeaders.get('content-type')).toBe('application/json');

                customHeaders['X-Custom-Header'] = 'updated-value';

                await transport.send(message);

                const updatedHeaders = (global.fetch as Mock).mock.calls[1][1].headers;
                expect(updatedHeaders.get('X-Custom-Header')).toBe('updated-value');
            } finally {
                global.fetch = originalFetch;
            }
        });

        it('passes custom headers to fetch requests (Headers class)', async () => {
            const customHeaders = new Headers({
                Authorization: 'Bearer test-token',
                'X-Custom-Header': 'custom-value'
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                requestInit: {
                    headers: customHeaders
                }
            });

            await transport.start();

            const originalFetch = global.fetch;
            try {
                global.fetch = vi.fn().mockResolvedValue({ ok: true });

                const message: JSONRPCMessage = {
                    jsonrpc: '2.0',
                    id: '1',
                    method: 'test',
                    params: {}
                };

                await transport.send(message);

                const calledHeaders = (global.fetch as Mock).mock.calls[0][1].headers;
                expect(calledHeaders.get('Authorization')).toBe('Bearer test-token');
                expect(calledHeaders.get('X-Custom-Header')).toBe('custom-value');
                expect(calledHeaders.get('content-type')).toBe('application/json');

                customHeaders.set('X-Custom-Header', 'updated-value');

                await transport.send(message);

                const updatedHeaders = (global.fetch as Mock).mock.calls[1][1].headers;
                expect(updatedHeaders.get('X-Custom-Header')).toBe('updated-value');
            } finally {
                global.fetch = originalFetch;
            }
        });

        it('passes custom headers to fetch requests (array of tuples)', async () => {
            transport = new SSEClientTransport(resourceBaseUrl, {
                requestInit: {
                    headers: [
                        ['Authorization', 'Bearer test-token'],
                        ['X-Custom-Header', 'custom-value']
                    ]
                }
            });

            await transport.start();

            const originalFetch = global.fetch;
            try {
                global.fetch = vi.fn().mockResolvedValue({ ok: true });

                await transport.send({ jsonrpc: '2.0', id: '1', method: 'test', params: {} });

                const calledHeaders = (global.fetch as Mock).mock.calls[0][1].headers;
                expect(calledHeaders.get('Authorization')).toBe('Bearer test-token');
                expect(calledHeaders.get('X-Custom-Header')).toBe('custom-value');
                expect(calledHeaders.get('content-type')).toBe('application/json');
            } finally {
                global.fetch = originalFetch;
            }
        });
    });

    describe('auth handling', () => {
        const authServerMetadataUrls = ['/.well-known/oauth-authorization-server', '/.well-known/openid-configuration'];

        let mockAuthProvider: Mocked<OAuthClientProvider>;

        beforeEach(() => {
            mockAuthProvider = {
                get redirectUrl() {
                    return 'http://localhost/callback';
                },
                get clientMetadata() {
                    return { redirect_uris: ['http://localhost/callback'] };
                },
                clientInformation: vi.fn(() => ({ client_id: 'test-client-id', client_secret: 'test-client-secret' })),
                tokens: vi.fn(),
                saveTokens: vi.fn(),
                redirectToAuthorization: vi.fn(),
                saveCodeVerifier: vi.fn(),
                codeVerifier: vi.fn(),
                invalidateCredentials: vi.fn()
            };
        });

        it('attaches auth header from provider on SSE connection', async () => {
            mockAuthProvider.tokens.mockResolvedValue({
                access_token: 'test-token',
                token_type: 'Bearer'
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider
            });

            await transport.start();

            expect(lastServerRequest.headers.authorization).toBe('Bearer test-token');
            expect(mockAuthProvider.tokens).toHaveBeenCalled();
        });

        it('attaches custom header from provider on initial SSE connection', async () => {
            mockAuthProvider.tokens.mockResolvedValue({
                access_token: 'test-token',
                token_type: 'Bearer'
            });
            const customHeaders = {
                'X-Custom-Header': 'custom-value'
            };

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider,
                requestInit: {
                    headers: customHeaders
                }
            });

            await transport.start();

            expect(lastServerRequest.headers.authorization).toBe('Bearer test-token');
            expect(lastServerRequest.headers['x-custom-header']).toBe('custom-value');
            expect(mockAuthProvider.tokens).toHaveBeenCalled();
        });

        it('attaches auth header from provider on POST requests', async () => {
            mockAuthProvider.tokens.mockResolvedValue({
                access_token: 'test-token',
                token_type: 'Bearer'
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider
            });

            await transport.start();

            const message: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: '1',
                method: 'test',
                params: {}
            };

            await transport.send(message);

            expect(lastServerRequest.headers.authorization).toBe('Bearer test-token');
            expect(mockAuthProvider.tokens).toHaveBeenCalled();
        });

        it('attempts auth flow on 401 during SSE connection', async () => {
            // Create server that returns 401s
            resourceServer.close();
            authServer.close();

            // Start auth server on random port
            await new Promise<void>(resolve => {
                authServer.listen(0, '127.0.0.1', () => {
                    const addr = authServer.address() as AddressInfo;
                    authBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            resourceServer = createServer((req, res) => {
                lastServerRequest = req;

                if (req.url === '/.well-known/oauth-protected-resource') {
                    res.writeHead(200, {
                        'Content-Type': 'application/json'
                    }).end(
                        JSON.stringify({
                            resource: resourceBaseUrl.href,
                            authorization_servers: [`${authBaseUrl}`]
                        })
                    );
                    return;
                }

                if (req.url !== '/') {
                    res.writeHead(404).end();
                } else {
                    res.writeHead(401).end();
                }
            });

            resourceBaseUrl = await listenOnRandomPort(resourceServer);

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider
            });

            await expect(() => transport.start()).rejects.toThrow(UnauthorizedError);
            expect(mockAuthProvider.redirectToAuthorization.mock.calls).toHaveLength(1);
        });

        it('attempts auth flow on 401 during POST request', async () => {
            // Create server that accepts SSE but returns 401 on POST
            resourceServer.close();
            authServer.close();

            await new Promise<void>(resolve => {
                authServer.listen(0, '127.0.0.1', () => {
                    const addr = authServer.address() as AddressInfo;
                    authBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            resourceServer = createServer((req, res) => {
                lastServerRequest = req;

                switch (req.method) {
                    case 'GET':
                        if (req.url === '/.well-known/oauth-protected-resource') {
                            res.writeHead(200, {
                                'Content-Type': 'application/json'
                            }).end(
                                JSON.stringify({
                                    resource: resourceBaseUrl.href,
                                    authorization_servers: [`${authBaseUrl}`]
                                })
                            );
                            return;
                        }

                        if (req.url !== '/') {
                            res.writeHead(404).end();
                            return;
                        }

                        res.writeHead(200, {
                            'Content-Type': 'text/event-stream',
                            'Cache-Control': 'no-cache, no-transform',
                            Connection: 'keep-alive'
                        });
                        res.write('event: endpoint\n');
                        res.write(`data: ${resourceBaseUrl.href}\n\n`);
                        break;

                    case 'POST':
                        res.writeHead(401);
                        res.end();
                        break;
                }
            });

            await new Promise<void>(resolve => {
                resourceServer.listen(0, '127.0.0.1', () => {
                    const addr = resourceServer.address() as AddressInfo;
                    resourceBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider
            });

            await transport.start();

            const message: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: '1',
                method: 'test',
                params: {}
            };

            await expect(() => transport.send(message)).rejects.toThrow(UnauthorizedError);
            expect(mockAuthProvider.redirectToAuthorization.mock.calls).toHaveLength(1);
        });

        it('respects custom headers when using auth provider', async () => {
            mockAuthProvider.tokens.mockResolvedValue({
                access_token: 'test-token',
                token_type: 'Bearer'
            });

            const customHeaders = {
                'X-Custom-Header': 'custom-value'
            };

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider,
                requestInit: {
                    headers: customHeaders
                }
            });

            await transport.start();

            const message: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: '1',
                method: 'test',
                params: {}
            };

            await transport.send(message);

            expect(lastServerRequest.headers.authorization).toBe('Bearer test-token');
            expect(lastServerRequest.headers['x-custom-header']).toBe('custom-value');
        });

        it('refreshes expired token during SSE connection', async () => {
            // Mock tokens() to return expired token until saveTokens is called
            let currentTokens: OAuthTokens = {
                access_token: 'expired-token',
                token_type: 'Bearer',
                refresh_token: 'refresh-token'
            };
            mockAuthProvider.tokens.mockImplementation(() => currentTokens);
            mockAuthProvider.saveTokens.mockImplementation(tokens => {
                currentTokens = tokens;
            });

            // Create server that returns 401 for expired token, then accepts new token
            resourceServer.close();
            authServer.close();

            authServer = createServer((req, res) => {
                if (req.url && authServerMetadataUrls.includes(req.url)) {
                    res.writeHead(404).end();
                    return;
                }

                if (req.url === '/token' && req.method === 'POST') {
                    // Handle token refresh request
                    let body = '';
                    req.on('data', chunk => {
                        body += chunk;
                    });
                    req.on('end', () => {
                        const params = new URLSearchParams(body);
                        const basicAuth = parseBasicAuth(req);
                        if (
                            params.get('grant_type') === 'refresh_token' &&
                            params.get('refresh_token') === 'refresh-token' &&
                            basicAuth?.clientId === 'test-client-id' &&
                            basicAuth?.clientSecret === 'test-client-secret'
                        ) {
                            res.writeHead(200, { 'Content-Type': 'application/json' });
                            res.end(
                                JSON.stringify({
                                    access_token: 'new-token',
                                    token_type: 'Bearer',
                                    refresh_token: 'new-refresh-token'
                                })
                            );
                        } else {
                            res.writeHead(400).end();
                        }
                    });
                    return;
                }

                res.writeHead(401).end();
            });

            // Start auth server on random port
            await new Promise<void>(resolve => {
                authServer.listen(0, '127.0.0.1', () => {
                    const addr = authServer.address() as AddressInfo;
                    authBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            let connectionAttempts = 0;
            resourceServer = createServer((req, res) => {
                lastServerRequest = req;

                if (req.url === '/.well-known/oauth-protected-resource') {
                    res.writeHead(200, {
                        'Content-Type': 'application/json'
                    }).end(
                        JSON.stringify({
                            resource: resourceBaseUrl.href,
                            authorization_servers: [`${authBaseUrl}`]
                        })
                    );
                    return;
                }

                if (req.url !== '/') {
                    res.writeHead(404).end();
                    return;
                }

                const auth = req.headers.authorization;
                if (auth === 'Bearer expired-token') {
                    res.writeHead(401).end();
                    return;
                }

                if (auth === 'Bearer new-token') {
                    res.writeHead(200, {
                        'Content-Type': 'text/event-stream',
                        'Cache-Control': 'no-cache, no-transform',
                        Connection: 'keep-alive'
                    });
                    res.write('event: endpoint\n');
                    res.write(`data: ${resourceBaseUrl.href}\n\n`);
                    connectionAttempts++;
                    return;
                }

                res.writeHead(401).end();
            });

            await new Promise<void>(resolve => {
                resourceServer.listen(0, '127.0.0.1', () => {
                    const addr = resourceServer.address() as AddressInfo;
                    resourceBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider
            });

            await transport.start();

            expect(mockAuthProvider.saveTokens).toHaveBeenCalledWith({
                access_token: 'new-token',
                token_type: 'Bearer',
                refresh_token: 'new-refresh-token'
            });
            expect(connectionAttempts).toBe(1);
            expect(lastServerRequest.headers.authorization).toBe('Bearer new-token');
        });

        it('refreshes expired token during POST request', async () => {
            // Mock tokens() to return expired token until saveTokens is called
            let currentTokens: OAuthTokens = {
                access_token: 'expired-token',
                token_type: 'Bearer',
                refresh_token: 'refresh-token'
            };
            mockAuthProvider.tokens.mockImplementation(() => currentTokens);
            mockAuthProvider.saveTokens.mockImplementation(tokens => {
                currentTokens = tokens;
            });

            // Create server that returns 401 for expired token, then accepts new token
            resourceServer.close();
            authServer.close();

            authServer = createServer((req, res) => {
                if (req.url && authServerMetadataUrls.includes(req.url)) {
                    res.writeHead(404).end();
                    return;
                }

                if (req.url === '/token' && req.method === 'POST') {
                    // Handle token refresh request
                    let body = '';
                    req.on('data', chunk => {
                        body += chunk;
                    });
                    req.on('end', () => {
                        const params = new URLSearchParams(body);
                        const basicAuth = parseBasicAuth(req);
                        if (
                            params.get('grant_type') === 'refresh_token' &&
                            params.get('refresh_token') === 'refresh-token' &&
                            basicAuth?.clientId === 'test-client-id' &&
                            basicAuth?.clientSecret === 'test-client-secret'
                        ) {
                            res.writeHead(200, { 'Content-Type': 'application/json' });
                            res.end(
                                JSON.stringify({
                                    access_token: 'new-token',
                                    token_type: 'Bearer',
                                    refresh_token: 'new-refresh-token'
                                })
                            );
                        } else {
                            res.writeHead(400).end();
                        }
                    });
                    return;
                }

                res.writeHead(401).end();
            });

            // Start auth server on random port
            await new Promise<void>(resolve => {
                authServer.listen(0, '127.0.0.1', () => {
                    const addr = authServer.address() as AddressInfo;
                    authBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            let postAttempts = 0;
            resourceServer = createServer((req, res) => {
                lastServerRequest = req;

                if (req.url === '/.well-known/oauth-protected-resource') {
                    res.writeHead(200, {
                        'Content-Type': 'application/json'
                    }).end(
                        JSON.stringify({
                            resource: resourceBaseUrl.href,
                            authorization_servers: [`${authBaseUrl}`]
                        })
                    );
                    return;
                }

                switch (req.method) {
                    case 'GET':
                        if (req.url !== '/') {
                            res.writeHead(404).end();
                            return;
                        }

                        res.writeHead(200, {
                            'Content-Type': 'text/event-stream',
                            'Cache-Control': 'no-cache, no-transform',
                            Connection: 'keep-alive'
                        });
                        res.write('event: endpoint\n');
                        res.write(`data: ${resourceBaseUrl.href}\n\n`);
                        break;

                    case 'POST': {
                        if (req.url !== '/') {
                            res.writeHead(404).end();
                            return;
                        }

                        const auth = req.headers.authorization;
                        if (auth === 'Bearer expired-token') {
                            res.writeHead(401).end();
                            return;
                        }

                        if (auth === 'Bearer new-token') {
                            res.writeHead(200).end();
                            postAttempts++;
                            return;
                        }

                        res.writeHead(401).end();
                        break;
                    }
                }
            });

            await new Promise<void>(resolve => {
                resourceServer.listen(0, '127.0.0.1', () => {
                    const addr = resourceServer.address() as AddressInfo;
                    resourceBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider
            });

            await transport.start();

            const message: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: '1',
                method: 'test',
                params: {}
            };

            await transport.send(message);

            expect(mockAuthProvider.saveTokens).toHaveBeenCalledWith({
                access_token: 'new-token',
                token_type: 'Bearer',
                refresh_token: 'new-refresh-token'
            });
            expect(postAttempts).toBe(1);
            expect(lastServerRequest.headers.authorization).toBe('Bearer new-token');
        });

        it('redirects to authorization if refresh token flow fails', async () => {
            // Mock tokens() to return expired token until saveTokens is called
            let currentTokens: OAuthTokens = {
                access_token: 'expired-token',
                token_type: 'Bearer',
                refresh_token: 'refresh-token'
            };
            mockAuthProvider.tokens.mockImplementation(() => currentTokens);
            mockAuthProvider.saveTokens.mockImplementation(tokens => {
                currentTokens = tokens;
            });

            // Create server that returns 401 for all tokens
            resourceServer.close();
            authServer.close();

            authServer = createServer((req, res) => {
                if (req.url && authServerMetadataUrls.includes(req.url)) {
                    res.writeHead(404).end();
                    return;
                }

                if (req.url === '/token' && req.method === 'POST') {
                    // Handle token refresh request - always fail
                    res.writeHead(400).end();
                    return;
                }

                res.writeHead(401).end();
            });

            // Start auth server on random port
            await new Promise<void>(resolve => {
                authServer.listen(0, '127.0.0.1', () => {
                    const addr = authServer.address() as AddressInfo;
                    authBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            resourceServer = createServer((req, res) => {
                lastServerRequest = req;

                if (req.url === '/.well-known/oauth-protected-resource') {
                    res.writeHead(200, {
                        'Content-Type': 'application/json'
                    }).end(
                        JSON.stringify({
                            resource: resourceBaseUrl.href,
                            authorization_servers: [`${authBaseUrl}`]
                        })
                    );
                    return;
                }

                if (req.url !== '/') {
                    res.writeHead(404).end();
                    return;
                }
                res.writeHead(401).end();
            });

            await new Promise<void>(resolve => {
                resourceServer.listen(0, '127.0.0.1', () => {
                    const addr = resourceServer.address() as AddressInfo;
                    resourceBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });

            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider
            });

            await expect(() => transport.start()).rejects.toThrow(UnauthorizedError);
            expect(mockAuthProvider.redirectToAuthorization).toHaveBeenCalled();
        });

        it('invalidates all credentials on InvalidClientError during token refresh', async () => {
            // Mock tokens() to return token with refresh token
            mockAuthProvider.tokens.mockResolvedValue({
                access_token: 'expired-token',
                token_type: 'Bearer',
                refresh_token: 'refresh-token'
            });

            let baseUrl = resourceBaseUrl;

            // Create server that returns InvalidClientError on token refresh
            const server = createServer((req, res) => {
                lastServerRequest = req;

                // Handle OAuth metadata discovery
                if (req.url === '/.well-known/oauth-authorization-server' && req.method === 'GET') {
                    res.writeHead(200, { 'Content-Type': 'application/json' });
                    res.end(
                        JSON.stringify({
                            issuer: baseUrl.href,
                            authorization_endpoint: `${baseUrl.href}authorize`,
                            token_endpoint: `${baseUrl.href}token`,
                            response_types_supported: ['code'],
                            code_challenge_methods_supported: ['S256']
                        })
                    );
                    return;
                }

                if (req.url === '/token' && req.method === 'POST') {
                    // Handle token refresh request - return InvalidClientError
                    const error = new InvalidClientError('Client authentication failed');
                    res.writeHead(400, { 'Content-Type': 'application/json' }).end(JSON.stringify(error.toResponseObject()));
                    return;
                }

                if (req.url !== '/') {
                    res.writeHead(404).end();
                    return;
                }
                res.writeHead(401).end();
            });

            baseUrl = await listenOnRandomPort(server);

            transport = new SSEClientTransport(baseUrl, {
                authProvider: mockAuthProvider
            });

            await expect(() => transport.start()).rejects.toThrow(InvalidClientError);
            expect(mockAuthProvider.invalidateCredentials).toHaveBeenCalledWith('all');
        });

        it('invalidates all credentials on UnauthorizedClientError during token refresh', async () => {
            // Mock tokens() to return token with refresh token
            mockAuthProvider.tokens.mockResolvedValue({
                access_token: 'expired-token',
                token_type: 'Bearer',
                refresh_token: 'refresh-token'
            });

            let baseUrl = resourceBaseUrl;

            const server = createServer((req, res) => {
                lastServerRequest = req;

                // Handle OAuth metadata discovery
                if (req.url === '/.well-known/oauth-authorization-server' && req.method === 'GET') {
                    res.writeHead(200, { 'Content-Type': 'application/json' });
                    res.end(
                        JSON.stringify({
                            issuer: baseUrl.href,
                            authorization_endpoint: `${baseUrl.href}authorize`,
                            token_endpoint: `${baseUrl.href}token`,
                            response_types_supported: ['code'],
                            code_challenge_methods_supported: ['S256']
                        })
                    );
                    return;
                }

                if (req.url === '/token' && req.method === 'POST') {
                    // Handle token refresh request - return UnauthorizedClientError
                    const error = new UnauthorizedClientError('Client not authorized');
                    res.writeHead(400, { 'Content-Type': 'application/json' }).end(JSON.stringify(error.toResponseObject()));
                    return;
                }

                if (req.url !== '/') {
                    res.writeHead(404).end();
                    return;
                }
                res.writeHead(401).end();
            });

            baseUrl = await listenOnRandomPort(server);

            transport = new SSEClientTransport(baseUrl, {
                authProvider: mockAuthProvider
            });

            await expect(() => transport.start()).rejects.toThrow(UnauthorizedClientError);
            expect(mockAuthProvider.invalidateCredentials).toHaveBeenCalledWith('all');
        });

        it('invalidates tokens on InvalidGrantError during token refresh', async () => {
            // Mock tokens() to return token with refresh token
            mockAuthProvider.tokens.mockResolvedValue({
                access_token: 'expired-token',
                token_type: 'Bearer',
                refresh_token: 'refresh-token'
            });
            let baseUrl = resourceBaseUrl;

            const server = createServer((req, res) => {
                lastServerRequest = req;

                // Handle OAuth metadata discovery
                if (req.url === '/.well-known/oauth-authorization-server' && req.method === 'GET') {
                    res.writeHead(200, { 'Content-Type': 'application/json' });
                    res.end(
                        JSON.stringify({
                            issuer: baseUrl.href,
                            authorization_endpoint: `${baseUrl.href}authorize`,
                            token_endpoint: `${baseUrl.href}token`,
                            response_types_supported: ['code'],
                            code_challenge_methods_supported: ['S256']
                        })
                    );
                    return;
                }

                if (req.url === '/token' && req.method === 'POST') {
                    // Handle token refresh request - return InvalidGrantError
                    const error = new InvalidGrantError('Invalid refresh token');
                    res.writeHead(400, { 'Content-Type': 'application/json' }).end(JSON.stringify(error.toResponseObject()));
                    return;
                }

                if (req.url !== '/') {
                    res.writeHead(404).end();
                    return;
                }
                res.writeHead(401).end();
            });

            baseUrl = await listenOnRandomPort(server);

            transport = new SSEClientTransport(baseUrl, {
                authProvider: mockAuthProvider
            });

            await expect(() => transport.start()).rejects.toThrow(InvalidGrantError);
            expect(mockAuthProvider.invalidateCredentials).toHaveBeenCalledWith('tokens');
        });
    });

    describe('custom fetch in auth code paths', () => {
        let customFetch: MockedFunction<typeof fetch>;
        let globalFetchSpy: MockInstance;
        let mockAuthProvider: Mocked<OAuthClientProvider>;
        let resourceServerHandler: Mock;

        /**
         * Helper function to create a mock auth provider with configurable behavior
         */
        const createMockAuthProvider = (
            config: {
                hasTokens?: boolean;
                tokensExpired?: boolean;
                hasRefreshToken?: boolean;
                clientRegistered?: boolean;
                authorizationCode?: string;
            } = {}
        ): Mocked<OAuthClientProvider> => {
            const tokens = config.hasTokens
                ? {
                      access_token: config.tokensExpired ? 'expired-token' : 'valid-token',
                      token_type: 'Bearer' as const,
                      ...(config.hasRefreshToken && { refresh_token: 'refresh-token' })
                  }
                : undefined;

            const clientInfo = config.clientRegistered
                ? {
                      client_id: 'test-client-id',
                      client_secret: 'test-client-secret'
                  }
                : undefined;

            return {
                get redirectUrl() {
                    return 'http://localhost/callback';
                },
                get clientMetadata() {
                    return {
                        redirect_uris: ['http://localhost/callback'],
                        client_name: 'Test Client'
                    };
                },
                clientInformation: vi.fn().mockResolvedValue(clientInfo),
                tokens: vi.fn().mockResolvedValue(tokens),
                saveTokens: vi.fn(),
                redirectToAuthorization: vi.fn(),
                saveCodeVerifier: vi.fn(),
                codeVerifier: vi.fn().mockResolvedValue('test-verifier'),
                invalidateCredentials: vi.fn()
            };
        };

        const createCustomFetchMockAuthServer = async () => {
            authServer = createServer((req, res) => {
                if (req.url === '/.well-known/oauth-authorization-server') {
                    res.writeHead(200, { 'Content-Type': 'application/json' });
                    res.end(
                        JSON.stringify({
                            issuer: `http://127.0.0.1:${(authServer.address() as AddressInfo).port}`,
                            authorization_endpoint: `http://127.0.0.1:${(authServer.address() as AddressInfo).port}/authorize`,
                            token_endpoint: `http://127.0.0.1:${(authServer.address() as AddressInfo).port}/token`,
                            registration_endpoint: `http://127.0.0.1:${(authServer.address() as AddressInfo).port}/register`,
                            response_types_supported: ['code'],
                            code_challenge_methods_supported: ['S256']
                        })
                    );
                    return;
                }

                if (req.url === '/token' && req.method === 'POST') {
                    // Handle token exchange request
                    let body = '';
                    req.on('data', chunk => {
                        body += chunk;
                    });
                    req.on('end', () => {
                        const params = new URLSearchParams(body);
                        const basicAuth = parseBasicAuth(req);
                        if (
                            params.get('grant_type') === 'authorization_code' &&
                            params.get('code') === 'test-auth-code' &&
                            basicAuth?.clientId === 'test-client-id' &&
                            basicAuth?.clientSecret === 'test-client-secret'
                        ) {
                            res.writeHead(200, { 'Content-Type': 'application/json' });
                            res.end(
                                JSON.stringify({
                                    access_token: 'new-access-token',
                                    token_type: 'Bearer',
                                    expires_in: 3600,
                                    refresh_token: 'new-refresh-token'
                                })
                            );
                        } else {
                            res.writeHead(400).end();
                        }
                    });
                    return;
                }

                res.writeHead(404).end();
            });

            // Start auth server on random port
            await new Promise<void>(resolve => {
                authServer.listen(0, '127.0.0.1', () => {
                    const addr = authServer.address() as AddressInfo;
                    authBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });
        };

        const createCustomFetchMockResourceServer = async () => {
            // Set up resource server that provides OAuth metadata
            resourceServer = createServer((req, res) => {
                lastServerRequest = req;

                if (req.url === '/.well-known/oauth-protected-resource') {
                    res.writeHead(200, { 'Content-Type': 'application/json' });
                    res.end(
                        JSON.stringify({
                            resource: resourceBaseUrl.href,
                            authorization_servers: [authBaseUrl.href]
                        })
                    );
                    return;
                }

                resourceServerHandler(req, res);
            });

            // Start resource server on random port
            await new Promise<void>(resolve => {
                resourceServer.listen(0, '127.0.0.1', () => {
                    const addr = resourceServer.address() as AddressInfo;
                    resourceBaseUrl = new URL(`http://127.0.0.1:${addr.port}`);
                    resolve();
                });
            });
        };

        beforeEach(async () => {
            // Close existing servers to set up custom auth flow servers
            resourceServer.close();
            authServer.close();

            const originalFetch = fetch;

            // Create custom fetch spy that delegates to real fetch
            customFetch = vi.fn((url, init) => {
                return originalFetch(url.toString(), init);
            });

            // Spy on global fetch to detect unauthorized usage
            globalFetchSpy = vi.spyOn(global, 'fetch');

            // Create mock auth provider with default configuration
            mockAuthProvider = createMockAuthProvider({
                hasTokens: false,
                clientRegistered: true
            });

            // Set up auth server that handles OAuth discovery and token requests
            await createCustomFetchMockAuthServer();

            // Set up resource server
            resourceServerHandler = vi.fn(
                (
                    _req: IncomingMessage,
                    res: ServerResponse<IncomingMessage> & {
                        req: IncomingMessage;
                    }
                ) => {
                    res.writeHead(404).end();
                }
            );
            await createCustomFetchMockResourceServer();
        });

        afterEach(() => {
            globalFetchSpy.mockRestore();
        });

        it('uses custom fetch during auth flow on SSE connection 401 - no global fetch fallback', async () => {
            // Set up resource server that returns 401 on SSE connection and provides OAuth metadata
            resourceServerHandler.mockImplementation((req: IncomingMessage, res: ServerResponse) => {
                if (req.url === '/') {
                    // Return 401 to trigger auth flow
                    res.writeHead(401, {
                        'WWW-Authenticate': `Bearer realm="mcp", resource_metadata="${resourceBaseUrl.href}.well-known/oauth-protected-resource"`
                    });
                    res.end();
                    return;
                }

                res.writeHead(404).end();
            });

            // Create transport with custom fetch and auth provider
            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider,
                fetch: customFetch
            });

            // Attempt to start - should trigger auth flow and eventually fail with UnauthorizedError
            await expect(transport.start()).rejects.toThrow(UnauthorizedError);

            // Verify custom fetch was used
            expect(customFetch).toHaveBeenCalled();

            // Verify specific OAuth endpoints were called with custom fetch
            const customFetchCalls = customFetch.mock.calls;
            const callUrls = customFetchCalls.map(([url]) => url.toString());

            // Should have called resource metadata discovery
            expect(callUrls.some(url => url.includes('/.well-known/oauth-protected-resource'))).toBe(true);

            // Should have called OAuth authorization server metadata discovery
            expect(callUrls.some(url => url.includes('/.well-known/oauth-authorization-server'))).toBe(true);

            // Verify auth provider was called to redirect to authorization
            expect(mockAuthProvider.redirectToAuthorization).toHaveBeenCalled();

            // Global fetch should never have been called
            expect(globalFetchSpy).not.toHaveBeenCalled();
        });

        it('uses custom fetch during auth flow on POST request 401 - no global fetch fallback', async () => {
            // Set up resource server that accepts SSE connection but returns 401 on POST
            resourceServerHandler.mockImplementation((req: IncomingMessage, res: ServerResponse) => {
                switch (req.method) {
                    case 'GET':
                        if (req.url === '/') {
                            // Accept SSE connection
                            res.writeHead(200, {
                                'Content-Type': 'text/event-stream',
                                'Cache-Control': 'no-cache, no-transform',
                                Connection: 'keep-alive'
                            });
                            res.write('event: endpoint\n');
                            res.write(`data: ${resourceBaseUrl.href}\n\n`);
                            return;
                        }
                        break;

                    case 'POST':
                        if (req.url === '/') {
                            // Return 401 to trigger auth retry
                            res.writeHead(401, {
                                'WWW-Authenticate': `Bearer realm="mcp", resource_metadata="${resourceBaseUrl.href}.well-known/oauth-protected-resource"`
                            });
                            res.end();
                            return;
                        }
                        break;
                }

                res.writeHead(404).end();
            });

            // Create transport with custom fetch and auth provider
            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: mockAuthProvider,
                fetch: customFetch
            });

            // Start the transport (should succeed)
            await transport.start();

            // Send a message that should trigger 401 and auth retry
            const message: JSONRPCMessage = {
                jsonrpc: '2.0',
                id: '1',
                method: 'test',
                params: {}
            };

            // Attempt to send message - should trigger auth flow and eventually fail
            await expect(transport.send(message)).rejects.toThrow(UnauthorizedError);

            // Verify custom fetch was used
            expect(customFetch).toHaveBeenCalled();

            // Verify specific OAuth endpoints were called with custom fetch
            const customFetchCalls = customFetch.mock.calls;
            const callUrls = customFetchCalls.map(([url]) => url.toString());

            // Should have called resource metadata discovery
            expect(callUrls.some(url => url.includes('/.well-known/oauth-protected-resource'))).toBe(true);

            // Should have called OAuth authorization server metadata discovery
            expect(callUrls.some(url => url.includes('/.well-known/oauth-authorization-server'))).toBe(true);

            // Should have attempted the POST request that triggered the 401
            const postCalls = customFetchCalls.filter(
                ([url, options]) => url.toString() === resourceBaseUrl.href && options?.method === 'POST'
            );
            expect(postCalls.length).toBeGreaterThan(0);

            // Verify auth provider was called to redirect to authorization
            expect(mockAuthProvider.redirectToAuthorization).toHaveBeenCalled();

            // Global fetch should never have been called
            expect(globalFetchSpy).not.toHaveBeenCalled();
        });

        it('uses custom fetch in finishAuth method - no global fetch fallback', async () => {
            // Create mock auth provider that expects to save tokens
            const authProviderWithCode = createMockAuthProvider({
                clientRegistered: true,
                authorizationCode: 'test-auth-code'
            });

            // Create transport with custom fetch and auth provider
            transport = new SSEClientTransport(resourceBaseUrl, {
                authProvider: authProviderWithCode,
                fetch: customFetch
            });

            // Call finishAuth with authorization code
            await transport.finishAuth('test-auth-code');

            // Verify custom fetch was used
            expect(customFetch).toHaveBeenCalled();

            // Verify specific OAuth endpoints were called with custom fetch
            const customFetchCalls = customFetch.mock.calls;
            const callUrls = customFetchCalls.map(([url]) => url.toString());

            // Should have called resource metadata discovery
            expect(callUrls.some(url => url.includes('/.well-known/oauth-protected-resource'))).toBe(true);

            // Should have called OAuth authorization server metadata discovery
            expect(callUrls.some(url => url.includes('/.well-known/oauth-authorization-server'))).toBe(true);

            // Should have called token endpoint for authorization code exchange
            const tokenCalls = customFetchCalls.filter(([url, options]) => url.toString().includes('/token') && options?.method === 'POST');
            expect(tokenCalls.length).toBeGreaterThan(0);

            // Verify tokens were saved
            expect(authProviderWithCode.saveTokens).toHaveBeenCalledWith({
                access_token: 'new-access-token',
                token_type: 'Bearer',
                expires_in: 3600,
                refresh_token: 'new-refresh-token'
            });

            // Global fetch should never have been called
            expect(globalFetchSpy).not.toHaveBeenCalled();
        });
    });
});