aws.test.ts

import { describe, it, expect, beforeEach } from "vitest";
import { Hono } from "@emulators/core";
import { Store, WebhookDispatcher, type AppEnv } from "@emulators/core";
import { awsPlugin, seedFromConfig, getAwsStore } from "../index.js";
import { createTestApp, testAuthHeaders as authHeaders, testBaseUrl as base } from "./helpers.js";

describe("AWS plugin - S3 Buckets", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("lists default buckets", async () => {
    const res = await app.request(`${base}/`, { method: "GET", headers: authHeaders() });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("emulate-default");
    expect(text).toContain("ListAllMyBucketsResult");
  });

  it("creates a bucket", async () => {
    const res = await app.request(`${base}/my-test-bucket`, {
      method: "PUT",
      headers: authHeaders(),
    });
    expect(res.status).toBe(200);

    // Verify bucket appears in list
    const listRes = await app.request(`${base}/`, { method: "GET", headers: authHeaders() });
    const text = await listRes.text();
    expect(text).toContain("my-test-bucket");
  });

  it("rejects duplicate bucket", async () => {
    await app.request(`${base}/dup-bucket`, { method: "PUT", headers: authHeaders() });
    const res = await app.request(`${base}/dup-bucket`, { method: "PUT", headers: authHeaders() });
    expect(res.status).toBe(409);
    const text = await res.text();
    expect(text).toContain("BucketAlreadyOwnedByYou");
  });

  it("deletes a bucket", async () => {
    await app.request(`${base}/del-bucket`, { method: "PUT", headers: authHeaders() });
    const res = await app.request(`${base}/del-bucket`, { method: "DELETE", headers: authHeaders() });
    expect(res.status).toBe(204);
  });

  it("rejects deleting non-empty bucket", async () => {
    await app.request(`${base}/full-bucket`, { method: "PUT", headers: authHeaders() });
    await app.request(`${base}/full-bucket/file.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "hello",
    });
    const res = await app.request(`${base}/full-bucket`, { method: "DELETE", headers: authHeaders() });
    expect(res.status).toBe(409);
    const text = await res.text();
    expect(text).toContain("BucketNotEmpty");
  });

  it("checks bucket existence with HEAD", async () => {
    const res = await app.request(`${base}/emulate-default`, { method: "HEAD", headers: authHeaders() });
    expect(res.status).toBe(200);

    const notFound = await app.request(`${base}/nonexistent`, { method: "HEAD", headers: authHeaders() });
    expect(notFound.status).toBe(404);
  });
});

describe("AWS plugin - S3 Objects", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("puts and gets an object", async () => {
    const putRes = await app.request(`${base}/emulate-default/test.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "hello world",
    });
    expect(putRes.status).toBe(200);
    expect(putRes.headers.get("ETag")).toBeDefined();

    const getRes = await app.request(`${base}/emulate-default/test.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(getRes.status).toBe(200);
    const body = await getRes.text();
    expect(body).toBe("hello world");
    expect(getRes.headers.get("Content-Type")).toBe("text/plain");
  });

  it("returns 404 for missing object", async () => {
    const res = await app.request(`${base}/emulate-default/missing.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(res.status).toBe(404);
    const text = await res.text();
    expect(text).toContain("NoSuchKey");
  });

  it("overwrites an existing object", async () => {
    await app.request(`${base}/emulate-default/overwrite.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "version 1",
    });
    await app.request(`${base}/emulate-default/overwrite.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "version 2",
    });

    const res = await app.request(`${base}/emulate-default/overwrite.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    const body = await res.text();
    expect(body).toBe("version 2");
  });

  it("deletes an object", async () => {
    await app.request(`${base}/emulate-default/to-delete.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "delete me",
    });

    const delRes = await app.request(`${base}/emulate-default/to-delete.txt`, {
      method: "DELETE",
      headers: authHeaders(),
    });
    expect(delRes.status).toBe(204);

    const getRes = await app.request(`${base}/emulate-default/to-delete.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(getRes.status).toBe(404);
  });

  it("lists objects in a bucket", async () => {
    await app.request(`${base}/emulate-default/dir/a.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "a",
    });
    await app.request(`${base}/emulate-default/dir/b.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "b",
    });

    const res = await app.request(`${base}/emulate-default?prefix=dir/`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("dir/a.txt");
    expect(text).toContain("dir/b.txt");
  });

  it("handles HEAD for objects", async () => {
    await app.request(`${base}/emulate-default/head-test.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "head test",
    });

    const res = await app.request(`${base}/emulate-default/head-test.txt`, {
      method: "HEAD",
      headers: authHeaders(),
    });
    expect(res.status).toBe(200);
    expect(res.headers.get("Content-Type")).toBe("text/plain");
  });

  it("copies an object with x-amz-copy-source", async () => {
    await app.request(`${base}/emulate-default/source.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "copy me",
    });

    const copyRes = await app.request(`${base}/emulate-default/dest.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "x-amz-copy-source": "/emulate-default/source.txt" },
    });
    expect(copyRes.status).toBe(200);
    const copyText = await copyRes.text();
    expect(copyText).toContain("CopyObjectResult");

    const getRes = await app.request(`${base}/emulate-default/dest.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(getRes.status).toBe(200);
    const body = await getRes.text();
    expect(body).toBe("copy me");
  });

  it("round-trips a binary object byte-for-byte", async () => {
    // Bytes that are NOT valid UTF-8 (0x80, 0xff, 0xfe) plus a NUL and PNG
    // magic. The old handler called `.text()`, which decodes the body as
    // UTF-8 and replaces every non-UTF-8 byte with U+FFFD (EF BF BD) — so
    // binary uploads (audio, images, gzip, …) came back corrupted and longer
    // than they went in. Storing the body base64 round-trips any byte exactly.
    const binary = new Uint8Array([0x00, 0x01, 0x02, 0x80, 0xff, 0xfe, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a]);

    const putRes = await app.request(`${base}/emulate-default/audio.bin`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "application/octet-stream" },
      body: binary,
    });
    expect(putRes.status).toBe(200);

    const getRes = await app.request(`${base}/emulate-default/audio.bin`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(getRes.status).toBe(200);
    expect(getRes.headers.get("Content-Type")).toBe("application/octet-stream");

    const received = new Uint8Array(await getRes.arrayBuffer());
    expect(Array.from(received)).toEqual(Array.from(binary));
    // Content-Length must reflect the raw byte count, not the inflated
    // U+FFFD-substituted or base64 length.
    expect(getRes.headers.get("Content-Length")).toBe(String(binary.byteLength));
  });
});

describe("AWS plugin - S3 ListObjectsV2 pagination", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("paginates with max-keys and continuation-token", async () => {
    // Upload 5 objects
    for (let i = 0; i < 5; i++) {
      await app.request(`${base}/emulate-default/page-${String(i).padStart(2, "0")}.txt`, {
        method: "PUT",
        headers: { ...authHeaders(), "Content-Type": "text/plain" },
        body: `file ${i}`,
      });
    }

    // First page: max-keys=2
    const page1 = await app.request(`${base}/emulate-default?max-keys=2`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(page1.status).toBe(200);
    const text1 = await page1.text();
    expect(text1).toContain("<IsTruncated>true</IsTruncated>");
    expect(text1).toContain("<KeyCount>2</KeyCount>");
    expect(text1).toContain("NextContinuationToken");

    // Extract continuation token
    const tokenMatch = text1.match(/<NextContinuationToken>(.*?)<\/NextContinuationToken>/);
    expect(tokenMatch).toBeTruthy();
    const token = tokenMatch![1];

    // Second page
    const page2 = await app.request(
      `${base}/emulate-default?max-keys=2&continuation-token=${encodeURIComponent(token)}`,
      { method: "GET", headers: authHeaders() },
    );
    expect(page2.status).toBe(200);
    const text2 = await page2.text();
    expect(text2).toContain("<KeyCount>2</KeyCount>");
    expect(text2).toContain("<ContinuationToken>");

    // Third page (last)
    const tokenMatch2 = text2.match(/<NextContinuationToken>(.*?)<\/NextContinuationToken>/);
    expect(tokenMatch2).toBeTruthy();
    const page3 = await app.request(
      `${base}/emulate-default?max-keys=2&continuation-token=${encodeURIComponent(tokenMatch2![1])}`,
      { method: "GET", headers: authHeaders() },
    );
    const text3 = await page3.text();
    expect(text3).toContain("<IsTruncated>false</IsTruncated>");
    expect(text3).toContain("<KeyCount>1</KeyCount>");
    expect(text3).not.toContain("NextContinuationToken");
  });

  it("supports start-after parameter", async () => {
    await app.request(`${base}/emulate-default/sa-a.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "a",
    });
    await app.request(`${base}/emulate-default/sa-b.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "b",
    });
    await app.request(`${base}/emulate-default/sa-c.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "c",
    });

    const res = await app.request(`${base}/emulate-default?start-after=sa-a.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).not.toContain("<Key>sa-a.txt</Key>");
    expect(text).toContain("<Key>sa-b.txt</Key>");
    expect(text).toContain("<Key>sa-c.txt</Key>");
    expect(text).toContain("<StartAfter>sa-a.txt</StartAfter>");
  });
});

describe("AWS plugin - S3 Presigned POST", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("uploads a file via presigned POST", async () => {
    const form = new FormData();
    form.append("key", "upload.txt");
    form.append("Content-Type", "text/plain");
    form.append("file", new Blob(["hello upload"], { type: "text/plain" }));

    const res = await app.request(`${base}/emulate-default`, {
      method: "POST",
      body: form,
    });
    expect(res.status).toBe(204);

    // Verify the object was stored
    const getRes = await app.request(`${base}/emulate-default/upload.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(getRes.status).toBe(200);
    const body = await getRes.text();
    expect(body).toBe("hello upload");
  });

  it("returns 201 XML when success_action_status is 201", async () => {
    const form = new FormData();
    form.append("key", "upload-201.txt");
    form.append("Content-Type", "text/plain");
    form.append("success_action_status", "201");
    form.append("file", new Blob(["data"], { type: "text/plain" }));

    const res = await app.request(`${base}/emulate-default`, {
      method: "POST",
      body: form,
    });
    expect(res.status).toBe(201);
    const text = await res.text();
    expect(text).toContain("<PostResponse>");
    expect(text).toContain("<Key>upload-201.txt</Key>");
    expect(text).toContain("<ETag>");
  });

  it("validates policy with content-length-range", async () => {
    const policy = Buffer.from(
      JSON.stringify({
        expiration: new Date(Date.now() + 60_000).toISOString(),
        conditions: [{ bucket: "emulate-default" }, ["content-length-range", 0, 5]],
      }),
    ).toString("base64");

    const form = new FormData();
    form.append("key", "too-big.txt");
    form.append("Policy", policy);
    form.append("X-Amz-Signature", "fake");
    form.append("file", new Blob(["this is way too big for the limit"], { type: "text/plain" }));

    const res = await app.request(`${base}/emulate-default`, {
      method: "POST",
      body: form,
    });
    expect(res.status).toBe(400);
    const text = await res.text();
    expect(text).toContain("EntityTooLarge");
  });

  it("validates policy with starts-with on Content-Type", async () => {
    const policy = Buffer.from(
      JSON.stringify({
        expiration: new Date(Date.now() + 60_000).toISOString(),
        conditions: [{ bucket: "emulate-default" }, ["starts-with", "$Content-Type", "image/"]],
      }),
    ).toString("base64");

    const form = new FormData();
    form.append("key", "wrong-type.txt");
    form.append("Content-Type", "text/plain");
    form.append("Policy", policy);
    form.append("X-Amz-Signature", "fake");
    form.append("file", new Blob(["data"], { type: "text/plain" }));

    const res = await app.request(`${base}/emulate-default`, {
      method: "POST",
      body: form,
    });
    expect(res.status).toBe(403);
    const text = await res.text();
    expect(text).toContain("AccessDenied");
    expect(text).toContain("starts-with");
  });

  it("rejects expired policy", async () => {
    const policy = Buffer.from(
      JSON.stringify({
        expiration: new Date(Date.now() - 60_000).toISOString(),
        conditions: [{ bucket: "emulate-default" }],
      }),
    ).toString("base64");

    const form = new FormData();
    form.append("key", "expired.txt");
    form.append("Policy", policy);
    form.append("X-Amz-Signature", "fake");
    form.append("file", new Blob(["data"], { type: "text/plain" }));

    const res = await app.request(`${base}/emulate-default`, {
      method: "POST",
      body: form,
    });
    expect(res.status).toBe(403);
    const text = await res.text();
    expect(text).toContain("AccessDenied");
    expect(text).toContain("expired");
  });

  it("returns 404 for non-existent bucket", async () => {
    const form = new FormData();
    form.append("key", "file.txt");
    form.append("file", new Blob(["data"], { type: "text/plain" }));

    const res = await app.request(`${base}/no-such-bucket`, {
      method: "POST",
      body: form,
    });
    expect(res.status).toBe(404);
    const text = await res.text();
    expect(text).toContain("NoSuchBucket");
  });
});

describe("AWS plugin - SQS", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("creates a queue", async () => {
    const res = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateQueue&QueueName=test-queue",
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("test-queue");
    expect(text).toContain("CreateQueueResponse");
  });

  it("lists queues", async () => {
    const res = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=ListQueues",
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("emulate-default-queue");
  });

  it("sends and receives a message", async () => {
    // Get queue URL
    const urlRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetQueueUrl&QueueName=emulate-default-queue",
    });
    const urlText = await urlRes.text();
    const queueUrl = urlText.match(/<QueueUrl>(.*?)<\/QueueUrl>/)?.[1] ?? "";

    // Send message
    const sendRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=SendMessage&QueueUrl=${encodeURIComponent(queueUrl)}&MessageBody=test+message`,
    });
    expect(sendRes.status).toBe(200);
    const sendText = await sendRes.text();
    expect(sendText).toContain("SendMessageResponse");
    expect(sendText).toContain("MessageId");

    // Receive message
    const recvRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=ReceiveMessage&QueueUrl=${encodeURIComponent(queueUrl)}&MaxNumberOfMessages=1`,
    });
    expect(recvRes.status).toBe(200);
    const recvText = await recvRes.text();
    expect(recvText).toContain("test message");
    expect(recvText).toContain("ReceiptHandle");
  });

  it("deletes a message", async () => {
    const urlRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetQueueUrl&QueueName=emulate-default-queue",
    });
    const urlText = await urlRes.text();
    const queueUrl = urlText.match(/<QueueUrl>(.*?)<\/QueueUrl>/)?.[1] ?? "";

    // Send message
    await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=SendMessage&QueueUrl=${encodeURIComponent(queueUrl)}&MessageBody=delete+me`,
    });

    // Receive to get receipt handle
    const recvRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=ReceiveMessage&QueueUrl=${encodeURIComponent(queueUrl)}`,
    });
    const recvText = await recvRes.text();
    const receiptHandle = recvText.match(/<ReceiptHandle>(.*?)<\/ReceiptHandle>/)?.[1] ?? "";

    // Delete message
    const delRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=DeleteMessage&QueueUrl=${encodeURIComponent(queueUrl)}&ReceiptHandle=${encodeURIComponent(receiptHandle)}`,
    });
    expect(delRes.status).toBe(200);
    const delText = await delRes.text();
    expect(delText).toContain("DeleteMessageResponse");
  });

  it("purges a queue", async () => {
    const urlRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetQueueUrl&QueueName=emulate-default-queue",
    });
    const urlText = await urlRes.text();
    const queueUrl = urlText.match(/<QueueUrl>(.*?)<\/QueueUrl>/)?.[1] ?? "";

    // Send some messages
    for (let i = 0; i < 3; i++) {
      await app.request(`${base}/sqs/`, {
        method: "POST",
        headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
        body: `Action=SendMessage&QueueUrl=${encodeURIComponent(queueUrl)}&MessageBody=msg${i}`,
      });
    }

    // Purge
    const purgeRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=PurgeQueue&QueueUrl=${encodeURIComponent(queueUrl)}`,
    });
    expect(purgeRes.status).toBe(200);

    // Verify empty
    const recvRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=ReceiveMessage&QueueUrl=${encodeURIComponent(queueUrl)}`,
    });
    const recvText = await recvRes.text();
    expect(recvText).not.toContain("<Message>");
  });

  it("gets queue attributes", async () => {
    const urlRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetQueueUrl&QueueName=emulate-default-queue",
    });
    const urlText = await urlRes.text();
    const queueUrl = urlText.match(/<QueueUrl>(.*?)<\/QueueUrl>/)?.[1] ?? "";

    const res = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=GetQueueAttributes&QueueUrl=${encodeURIComponent(queueUrl)}`,
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("QueueArn");
    expect(text).toContain("VisibilityTimeout");
  });

  it("deletes a queue", async () => {
    // Create and then delete
    await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateQueue&QueueName=delete-me-queue",
    });

    const urlRes = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetQueueUrl&QueueName=delete-me-queue",
    });
    const urlText = await urlRes.text();
    const queueUrl = urlText.match(/<QueueUrl>(.*?)<\/QueueUrl>/)?.[1] ?? "";

    const res = await app.request(`${base}/sqs/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=DeleteQueue&QueueUrl=${encodeURIComponent(queueUrl)}`,
    });
    expect(res.status).toBe(200);
  });
});

describe("AWS plugin - IAM", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("creates a user", async () => {
    const res = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateUser&UserName=testuser",
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("testuser");
    expect(text).toContain("CreateUserResponse");
  });

  it("gets a user", async () => {
    const res = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetUser&UserName=admin",
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("admin");
  });

  it("lists users", async () => {
    const res = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=ListUsers",
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("admin");
    expect(text).toContain("ListUsersResponse");
  });

  it("creates and lists access keys", async () => {
    const createRes = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateAccessKey&UserName=admin",
    });
    expect(createRes.status).toBe(200);
    const createText = await createRes.text();
    expect(createText).toContain("AccessKeyId");
    expect(createText).toContain("SecretAccessKey");

    const listRes = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=ListAccessKeys&UserName=admin",
    });
    expect(listRes.status).toBe(200);
    const listText = await listRes.text();
    expect(listText).toContain("AccessKeyId");
  });

  it("deletes a user", async () => {
    // Create first
    await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateUser&UserName=delete-me",
    });

    const res = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=DeleteUser&UserName=delete-me",
    });
    expect(res.status).toBe(200);

    // Verify deleted
    const getRes = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetUser&UserName=delete-me",
    });
    expect(getRes.status).toBe(404);
  });

  it("rejects duplicate user", async () => {
    await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateUser&UserName=dup-user",
    });
    const res = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateUser&UserName=dup-user",
    });
    expect(res.status).toBe(409);
  });

  it("creates and gets a role", async () => {
    const createRes = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateRole&RoleName=test-role&Description=A+test+role",
    });
    expect(createRes.status).toBe(200);
    const createText = await createRes.text();
    expect(createText).toContain("test-role");

    const getRes = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetRole&RoleName=test-role",
    });
    expect(getRes.status).toBe(200);
    const getText = await getRes.text();
    expect(getText).toContain("test-role");
    expect(getText).toContain("A test role");
  });

  it("lists roles", async () => {
    await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateRole&RoleName=list-role",
    });

    const res = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=ListRoles",
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("list-role");
  });
});

describe("AWS plugin - STS", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("gets caller identity", async () => {
    const res = await app.request(`${base}/sts/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetCallerIdentity",
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("GetCallerIdentityResponse");
    expect(text).toContain("Account");
    expect(text).toContain("123456789012");
  });

  it("assumes a role", async () => {
    // Create a role first
    await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=CreateRole&RoleName=assume-me",
    });

    // Get the role's ARN
    const getRoleRes = await app.request(`${base}/iam/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: "Action=GetRole&RoleName=assume-me",
    });
    const roleText = await getRoleRes.text();
    const roleArn = roleText.match(/<Arn>(.*?)<\/Arn>/)?.[1] ?? "";

    const res = await app.request(`${base}/sts/`, {
      method: "POST",
      headers: { ...authHeaders(), "Content-Type": "application/x-www-form-urlencoded" },
      body: `Action=AssumeRole&RoleArn=${encodeURIComponent(roleArn)}&RoleSessionName=test-session`,
    });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("AssumeRoleResponse");
    expect(text).toContain("AccessKeyId");
    expect(text).toContain("SecretAccessKey");
    expect(text).toContain("SessionToken");
  });
});

describe("AWS plugin - seedFromConfig", () => {
  it("seeds custom buckets, queues, users, and roles", () => {
    const store = new Store();
    const webhooks = new WebhookDispatcher();
    const app = new Hono();
    awsPlugin.register(app as any, store, webhooks, base);
    awsPlugin.seed!(store, base);

    seedFromConfig(store, base, {
      s3: {
        buckets: [{ name: "my-bucket" }, { name: "other-bucket", region: "eu-west-1" }],
      },
      sqs: {
        queues: [{ name: "my-queue" }, { name: "orders.fifo", fifo: true }],
      },
      iam: {
        users: [{ user_name: "alice", create_access_key: true }],
        roles: [{ role_name: "lambda-role", description: "Lambda execution" }],
      },
    });

    const aws = getAwsStore(store);

    // Default + 2 custom buckets
    const buckets = aws.s3Buckets.all();
    expect(buckets.length).toBe(3);
    expect(buckets.find((b) => b.bucket_name === "my-bucket")).toBeDefined();
    expect(buckets.find((b) => b.bucket_name === "other-bucket")?.region).toBe("eu-west-1");

    // Default + 2 custom queues
    const queues = aws.sqsQueues.all();
    expect(queues.length).toBe(3);
    expect(queues.find((q) => q.queue_name === "orders.fifo")?.fifo).toBe(true);

    // Default admin + alice
    const users = aws.iamUsers.all();
    expect(users.length).toBe(2);
    const alice = users.find((u) => u.user_name === "alice");
    expect(alice).toBeDefined();
    expect(alice!.access_keys.length).toBe(1);

    // 1 custom role
    const roles = aws.iamRoles.all();
    expect(roles.length).toBe(1);
    expect(roles[0].role_name).toBe("lambda-role");
    expect(roles[0].description).toBe("Lambda execution");
  });
});

describe("AWS plugin - Inspector", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("renders the S3 inspector page", async () => {
    const res = await app.request(`${base}/_inspector`);
    expect(res.status).toBe(200);
    const html = await res.text();
    expect(html).toContain("AWS Emulator");
    expect(html).toContain("Inspector");
    expect(html).toContain("emulate-default");
  });

  it("shows SQS tab", async () => {
    const res = await app.request(`${base}/_inspector?tab=sqs`);
    expect(res.status).toBe(200);
    const html = await res.text();
    expect(html).toContain("SQS Queues");
    expect(html).toContain("emulate-default-queue");
  });

  it("shows IAM tab", async () => {
    const res = await app.request(`${base}/_inspector?tab=iam`);
    expect(res.status).toBe(200);
    const html = await res.text();
    expect(html).toContain("IAM Users");
    expect(html).toContain("admin");
  });

  it("does not serve inspector at GET / (reserved for ListBuckets)", async () => {
    const res = await app.request(`${base}/`, { method: "GET", headers: authHeaders() });
    expect(res.status).toBe(200);
    const text = await res.text();
    // Should be XML ListBuckets response, not HTML inspector
    expect(text).toContain("ListAllMyBucketsResult");
    expect(text).not.toContain("<!DOCTYPE html>");
  });
});

describe("AWS plugin - S3 backward-compat /s3/ aliases", () => {
  let app: Hono<AppEnv>;

  beforeEach(() => {
    app = createTestApp().app;
  });

  it("lists buckets via /s3/", async () => {
    const res = await app.request(`${base}/s3/`, { method: "GET", headers: authHeaders() });
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("ListAllMyBucketsResult");
    expect(text).toContain("emulate-default");
  });

  it("creates and lists objects via /s3/ prefix", async () => {
    await app.request(`${base}/s3/emulate-default/compat.txt`, {
      method: "PUT",
      headers: { ...authHeaders(), "Content-Type": "text/plain" },
      body: "backward compat",
    });

    const getRes = await app.request(`${base}/s3/emulate-default/compat.txt`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(getRes.status).toBe(200);
    expect(await getRes.text()).toBe("backward compat");

    const listRes = await app.request(`${base}/s3/emulate-default?prefix=compat`, {
      method: "GET",
      headers: authHeaders(),
    });
    expect(listRes.status).toBe(200);
    expect(await listRes.text()).toContain("compat.txt");
  });
});