package console

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/release"
)

func TestHostClaimRoutesArePersonOperatorFlagGatedAndInert(t *testing.T) {
	st := openGatedStore(t)
	rel := release.NewDirStore(t.TempDir())
	disabled, err := NewServer(Config{Origin: "https://console.example", Keymail: "https://keymail.example", Releases: rel}, st)
	if err != nil {
		t.Fatal(err)
	}
	path := "/api/cli/ops/hosts/app.example.com/resolve/inspect"
	ghostStatus, ghostBody := serveHostClaim(t, disabled, "/unknown-host-claim-route", "")
	if status, body := serveHostClaim(t, disabled, path, ""); status != ghostStatus || !bytes.Equal(body, ghostBody) {
		t.Fatalf("flag-off route = %d %q, want unknown route %d %q", status, body, ghostStatus, ghostBody)
	}

	token := mintHostClaimToken(t, st, "paul@keymail.dev")
	enabled, err := NewServer(Config{Origin: "https://console.example", Keymail: "https://keymail.example", Releases: rel, HostClaim: true}, st)
	if err != nil {
		t.Fatal(err)
	}
	if status, _ := serveHostClaim(t, enabled, path, ""); status != http.StatusUnauthorized {
		t.Fatalf("unsigned enabled status = %d", status)
	}
	if status, _ := serveHostClaim(t, enabled, path, token); status != http.StatusNotFound {
		t.Fatalf("enabled member status = %d", status)
	}
	if err := st.SetOperator("paul@keymail.dev", true); err != nil {
		t.Fatal(err)
	}
	status, body := serveHostClaim(t, enabled, path, token)
	if status != http.StatusServiceUnavailable {
		t.Fatalf("flag-on status = %d, body %s", status, body)
	}
	var out map[string]string
	if err := json.Unmarshal(body, &out); err != nil {
		t.Fatal(err)
	}
	if out["error"] != hostClaimUnavailable {
		t.Fatalf("refusal = %q", out["error"])
	}

	status, body = serveHostClaim(t, enabled, "/api/cli/ops/hosts/app.example.com/resolve", token)
	if status != http.StatusServiceUnavailable {
		t.Fatalf("mutation route = %d, body %s", status, body)
	}
}

func mintHostClaimToken(t *testing.T, st *Store, address string) string {
	t.Helper()
	now := time.Now()
	userCode, deviceCode, err := st.NewCLIAuth("test@host", "192.0.2.1", now)
	if err != nil {
		t.Fatal(err)
	}
	if err := st.ApproveCLIAuth(userCode, address, now); err != nil {
		t.Fatal(err)
	}
	status, token, _, err := st.PollCLIAuth(deviceCode, now)
	if err != nil || status != CLIAuthApproved || token == "" {
		t.Fatalf("mint token = %q %v", status, err)
	}
	return token
}

func serveHostClaim(t *testing.T, srv *Server, path, bearer string) (int, []byte) {
	t.Helper()
	req := httptest.NewRequest(http.MethodPost, path, bytes.NewBufferString(`{}`))
	req.Header.Set("Content-Type", "application/json")
	if bearer != "" {
		req.Header.Set("Authorization", "Bearer "+bearer)
	}
	rec := httptest.NewRecorder()
	srv.ServeHTTP(rec, req)
	return rec.Code, rec.Body.Bytes()
}