package handler

import (
	"context"
	"go.uber.org/zap"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"git.sundynix.cn/Blizzard/Veyra/internal/service"
)

func TestAuthenticationAndCSRFBoundaries(t *testing.T) {
	auth, err := service.NewAuthService(nil)
	if err != nil {
		t.Fatal(err)
	}
	probe := func(context.Context) error { return nil }
	router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{Auth: auth, DevelopmentLogin: true})
	for _, tc := range []struct {
		method, path, body, origin string
		status                     int
	}{
		{http.MethodGet, "/api/admin/v1/users", "", "", 401},
		{http.MethodGet, "/api/v1/accounts", "", "", 401},
		{http.MethodPost, "/api/admin/v1/auth/login", `{"login_name":"admin","password":"test-password"}`, "http://evil.example", 403},
		{http.MethodPost, "/api/admin/v1/auth/login", `{"login_name":"admin","password":"test-password"}`, "", 403},
		{http.MethodPost, "/api/admin/v1/auth/login", `{"login_name":"admin","password":"test-password","role":"ADMIN"}`, "http://example.com", 422},
		{http.MethodPost, "/api/v1/auth/login", `{} {}`, "", 422},
	} {
		req := httptest.NewRequest(tc.method, "http://example.com"+tc.path, strings.NewReader(tc.body))
		req.Header.Set("Content-Type", "application/json")
		req.Header.Set("Origin", tc.origin)
		rec := httptest.NewRecorder()
		router.ServeHTTP(rec, req)
		if rec.Code != tc.status {
			t.Fatalf("%s %s got %d want %d", tc.method, tc.path, rec.Code, tc.status)
		}
	}
}

func TestDevelopmentLoginDisabledByDefault(t *testing.T) {
	probe := func(context.Context) error { return nil }
	router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{})
	rec := httptest.NewRecorder()
	router.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", strings.NewReader(`{}`)))
	if rec.Code != http.StatusServiceUnavailable {
		t.Fatal("development login open outside explicitly enabled environment")
	}
}

func TestHTTPSPublicOriginBehindProxy(t *testing.T) {
	auth, err := service.NewAuthService(nil)
	if err != nil {
		t.Fatal(err)
	}
	probe := func(context.Context) error { return nil }
	for _, tc := range []struct {
		name, publicOrigin, host, origin, forwardedProto string
		status                                           int
	}{
		{"configured HTTPS", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 503},
		{"no reliance on proxy header", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "", 503},
		{"foreign origin", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://evil.example", "https", 403},
		{"HTTP origin rejected", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "http://veyra.sundynix.cn", "https", 403},
		{"wrong host", "https://veyra.sundynix.cn", "evil.example", "https://veyra.sundynix.cn", "https", 403},
		{"spoofed proxy header", "", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 403},
	} {
		t.Run(tc.name, func(t *testing.T) {
			router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{Auth: auth, DevelopmentLogin: true, PublicOrigin: tc.publicOrigin})
			req := httptest.NewRequest(http.MethodPost, "http://"+tc.host+"/api/admin/v1/auth/login", strings.NewReader(`{"login_name":"admin","password":"test-password"}`))
			req.Header.Set("Content-Type", "application/json")
			req.Header.Set("Origin", tc.origin)
			req.Header.Set("X-Forwarded-Proto", tc.forwardedProto)
			rec := httptest.NewRecorder()
			router.ServeHTTP(rec, req)
			if rec.Code != tc.status {
				t.Fatalf("got %d want %d", rec.Code, tc.status)
			}
		})
	}
}