package boxid

import (
	"bytes"
	"context"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"errors"
	"os"
	"testing"

	"github.com/carlosframework/platform/internal/boxid/internal/signtest"
	"github.com/carlosframework/platform/internal/release"
)

// signer stands in for AWS (signtest, shared with boxidtest): one key and
// certificate per test.
type signer struct {
	key  *rsa.PrivateKey
	cert *x509.Certificate
}

func newSigner(t *testing.T) signer {
	t.Helper()
	s := signtest.New(t)
	return signer{s.Key, s.Cert}
}

func (s signer) record(t *testing.T, box, account, region, instance string) (Record, []byte) {
	t.Helper()
	doc, sig := (&signtest.Signer{Key: s.key, Cert: s.cert}).Sign(t, account, region, instance)
	rec := Record{V: 1, Box: box, IdentityDocument: base64.StdEncoding.EncodeToString(doc),
		IdentitySignature: base64.StdEncoding.EncodeToString(sig), WrittenAt: "2026-10-06T00:00:00Z"}
	raw, _ := json.Marshal(rec)
	return rec, raw
}

// verifier certifies eu-west-1 and eu-west-2 with the same key, so a test
// can show that a supported but wrong region is still refused.
func (s signer) verifier() Verifier {
	return Verifier{Account: "111122223333", Certs: map[string]*x509.Certificate{"eu-west-1": s.cert, "eu-west-2": s.cert}}
}

func expect(box string) Expect { return Expect{Box: box, AWSRegion: "eu-west-1"} }

func TestEnrollProvesTheCloudOfALabel(t *testing.T) {
	s := newSigner(t)
	_, raw := s.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
	ev, err := s.verifier().Enroll(raw, expect("annie-welding"))
	if err != nil {
		t.Fatal(err)
	}
	sum := sha256.Sum256(raw)
	want := Evidence{Box: "annie-welding", RecordSHA256: hex.EncodeToString(sum[:]),
		Cloud: Cloud{Provider: "aws", Account: "111122223333", Region: "eu-west-1", InstanceID: "i-0abc"}}
	if ev != want {
		t.Fatalf("evidence = %+v\nwant       %+v", ev, want)
	}
	if !ev.Cloud.Complete() {
		t.Fatal("a proven cloud is not complete")
	}
}

func TestEnrollRefusals(t *testing.T) {
	s, other := newSigner(t), newSigner(t)
	good := func() []byte {
		_, raw := s.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
		return raw
	}
	cases := map[string]struct {
		raw []byte
		e   Expect
	}{
		"wrong account": {func() []byte {
			_, raw := s.record(t, "annie-welding", "999999999999", "eu-west-1", "i-0abc")
			return raw
		}(), expect("annie-welding")},
		"region with no certificate": {func() []byte {
			_, raw := s.record(t, "annie-welding", "111122223333", "ap-south-1", "i-0abc")
			return raw
		}(), Expect{Box: "annie-welding", AWSRegion: "ap-south-1"}},
		"a supported region that is not the placement's": {func() []byte {
			_, raw := s.record(t, "annie-welding", "111122223333", "eu-west-2", "i-0abc")
			return raw
		}(), expect("annie-welding")},
		"signed by someone else": {func() []byte {
			_, raw := other.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
			return raw
		}(), expect("annie-welding")},
		"document altered after signing": {func() []byte {
			r, _ := s.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
			doc, _ := json.Marshal(map[string]string{"accountId": "111122223333", "region": "eu-west-1", "instanceId": "i-0zzz"})
			r.IdentityDocument = base64.StdEncoding.EncodeToString(doc)
			raw, _ := json.Marshal(r)
			return raw
		}(), expect("annie-welding")},
		"record names another box":    {good(), expect("bert-sawing")},
		"reference is not a label":    {good(), expect("annie.welding")},
		"no expected region":          {good(), Expect{Box: "annie-welding"}},
		"tofu names another instance": {good(), Expect{Box: "annie-welding", AWSRegion: "eu-west-1", TofuInstanceID: "i-0zzz"}},
		// A good, signed record plus one field: only DisallowUnknownFields
		// can refuse it.
		"unknown field in the record": {append(bytes.TrimSuffix(good(), []byte("}")), []byte(`,"extra":1}`)...), expect("annie-welding")},
		"trailing data":               {append(good(), []byte(`{}`)...), expect("annie-welding")},
		"version 2": {func() []byte {
			r, _ := s.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
			r.V = 2
			raw, _ := json.Marshal(r)
			return raw
		}(), expect("annie-welding")},
		"reference enrolled elsewhere": {good(), Expect{Box: "annie-welding", AWSRegion: "eu-west-1", Roster: []Enrolled{{Box: "annie-welding", Cloud: Cloud{InstanceID: "i-0old"}}}}},
	}
	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			if ev, err := s.verifier().Enroll(tc.raw, tc.e); !errors.Is(err, ErrUnverified) {
				t.Fatalf("evidence = %+v, err = %v; want ErrUnverified", ev, err)
			}
		})
	}
}

// Review Focus 1: box A's record, intact and validly signed, copied under
// box B's key with its box field rewritten. The signature still verifies,
// because the box field is not signed. Only the roster check refuses it.
func TestEnrollRefusesAnInstanceAlreadyEnrolledUnderAnotherReference(t *testing.T) {
	s := newSigner(t)
	_, raw := s.record(t, "bert-sawing", "111122223333", "eu-west-1", "i-0abc")
	roster := []Enrolled{{Box: "annie-welding", Cloud: Cloud{Provider: "aws", Account: "111122223333", Region: "eu-west-1", InstanceID: "i-0abc"}}}
	if _, err := s.verifier().Enroll(raw, Expect{Box: "bert-sawing", AWSRegion: "eu-west-1", Roster: roster}); !errors.Is(err, ErrUnverified) {
		t.Fatalf("err = %v, want ErrUnverified", err)
	}
	// The same box re-enrolled as the same instance is not a conflict.
	roster[0].Box = "bert-sawing"
	if _, err := s.verifier().Enroll(raw, Expect{Box: "bert-sawing", AWSRegion: "eu-west-1", Roster: roster}); err != nil {
		t.Fatalf("re-enrolling the same instance: %v", err)
	}
}

func TestEnrollAcceptsTheTofuInstanceForALegacyReference(t *testing.T) {
	s := newSigner(t)
	_, raw := s.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
	if _, err := s.verifier().Enroll(raw, Expect{Box: "annie-welding", AWSRegion: "eu-west-1", TofuInstanceID: "i-0abc"}); err != nil {
		t.Fatal(err)
	}
}

func TestPublishIsCreateOnlyAndIdempotent(t *testing.T) {
	ctx, st, s := context.Background(), release.NewDirStore(t.TempDir()), newSigner(t)
	rec, _ := s.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
	if err := Publish(ctx, st, rec); err != nil {
		t.Fatal(err)
	}
	if err := Publish(ctx, st, rec); err != nil {
		t.Fatalf("republishing the same record: %v", err)
	}
	other := rec
	other.WrittenAt = "2027-01-01T00:00:00Z"
	if err := Publish(ctx, st, other); !errors.Is(err, release.ErrCASConflict) {
		t.Fatalf("a different record for the same box: err = %v, want ErrCASConflict", err)
	}
	raw, err := Load(ctx, st, "annie-welding")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := s.verifier().Enroll(raw, expect("annie-welding")); err != nil {
		t.Fatalf("the published record does not enroll: %v", err)
	}
}

func TestPublishAndLoadRefuseAReferenceThatIsNotALabel(t *testing.T) {
	ctx, st, s := context.Background(), release.NewDirStore(t.TempDir()), newSigner(t)
	rec, _ := s.record(t, "x.bind", "111122223333", "eu-west-1", "i-0abc")
	if err := Publish(ctx, st, rec); err == nil {
		t.Fatal("published under a reference with a dot")
	}
	if _, err := Load(ctx, st, "../edges/x"); !errors.Is(err, ErrUnverified) {
		t.Fatalf("err = %v, want ErrUnverified", err)
	}
	if _, err := Load(ctx, st, "nobody-here"); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("err = %v, want os.ErrNotExist", err)
	}
}

func TestEmbeddedCertsCoverTheFlagshipRegions(t *testing.T) {
	certs, err := EmbeddedCerts()
	if err != nil {
		t.Fatal(err)
	}
	for _, region := range []string{"eu-west-1", "eu-west-2", "us-east-1", "ap-southeast-2"} {
		c := certs[region]
		if c == nil {
			t.Errorf("no certificate for %s", region)
			continue
		}
		if c.PublicKeyAlgorithm != x509.RSA {
			t.Errorf("%s: %v key; the base64-signature certificate is RSA (the PKCS7 one is DSA: wrong tab)", region, c.PublicKeyAlgorithm)
		}
	}
}

// Final review 2: a reference already on the roster with no proven cloud
// yet (a box predating region HA) enrolls once, against its tofu id. Only
// an entry that already names another instance refuses the reference.
func TestEnrollAcceptsARosterEntryWithNoCloudYet(t *testing.T) {
	s := newSigner(t)
	_, raw := s.record(t, "annie-welding", "111122223333", "eu-west-1", "i-0abc")
	roster := []Enrolled{{Box: "annie-welding"}}
	if _, err := s.verifier().Enroll(raw, Expect{Box: "annie-welding", AWSRegion: "eu-west-1", TofuInstanceID: "i-0abc", Roster: roster}); err != nil {
		t.Fatalf("a roster entry with no cloud yet: %v", err)
	}
}