package console

// Instance catch-alls (domaincatchall.go): "*.<parent>" claimed through the
// domains door, serving each instance at <label>.<parent>. What matters, in
// the order it would hurt if lost: only a person, in the account that holds
// the parent, can make one; the deployment's own names can never be a
// parent; while one is live, no other account can claim a name it serves;
// detach never takes the first-route branch; and listing it reports only
// names that are provably this app's.

import (
	"context"
	"encoding/json"
	"errors"
	"net/http"
	"net/url"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/domains"
	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/status"
)

// catchallFixture is the testbed in miniature: account bab holds
// teams.example.com through another app, and titogo has instances under
// go.tito.io.
func catchallFixture(t *testing.T, code string) (*consoleFixture, string) {
	t.Helper()
	fx, member := instanceFixture(t, code)
	noCatchallProof(fx)
	enableInstances(t, fx, "titogo", titoManifest())
	if _, _, err := domains.AttachClaim(context.Background(), fx.rel, domains.Claim{
		Host: "teams.example.com", Account: "bab", App: "site",
		CreatedAt: time.Now().UTC().Format(time.RFC3339),
	}); err != nil {
		t.Fatal(err)
	}
	return fx, member
}

// noCatchallProof makes every ownership-proof lookup miss, so no test asks
// real DNS. proveCatchall publishes one for a parent and account.
func noCatchallProof(fx *consoleFixture) {
	fx.srv.lookupTXT = func(context.Context, string) ([]string, error) { return nil, errors.New("no such record") }
}

func proveCatchall(fx *consoleFixture, parent, account string) {
	fx.srv.lookupTXT = func(_ context.Context, name string) ([]string, error) {
		if name == domains.CatchallProofName(parent) {
			return []string{"something else", domains.CatchallProofValue(account)}, nil
		}
		return nil, errors.New("no such record")
	}
}

func catchallReq(t *testing.T, fx *consoleFixture, token, body string) (int, string) {
	t.Helper()
	code, _, out := rawReq(t, http.MethodPost, domainsURL(fx, "bab", "titogo"), token, body)
	return code, out
}

func TestInstanceCatchallAttachDetach(t *testing.T) {
	fx, member := catchallFixture(t, "code-ca-attach")
	code, out := catchallReq(t, fx, member, `{"host":"*.Teams.example.com"}`)
	if code != http.StatusOK {
		t.Fatalf("attach = %d %s", code, out)
	}
	var got struct {
		Host      string `json:"host"`
		Created   bool   `json:"created"`
		Instances bool   `json:"instances"`
	}
	if err := json.Unmarshal([]byte(out), &got); err != nil || got.Host != "*.teams.example.com" || !got.Created || !got.Instances {
		t.Fatalf("attach answer = %s (%v)", out, err)
	}
	c := claimOf(t, fx, "*.teams.example.com")
	if !c.Instances || c.Account != "bab" || c.App != "titogo" || c.Route != "" || c.CreatedBy != "alice@keymail.dev" {
		t.Fatalf("claim = %+v", *c)
	}
	if code, out := catchallReq(t, fx, member, `{"host":"*.teams.example.com"}`); code != http.StatusOK || !strings.Contains(out, `"created":false`) {
		t.Fatalf("re-attach = %d %s, want an idempotent 200", code, out)
	}
	// Detach by the same name, and never through the first-route branch:
	// a record at that host (impossible in practice) must survive.
	code, _, out = rawReq(t, http.MethodDelete, domainsURL(fx, "bab", "titogo")+"/*.teams.example.com", member, "")
	if code != http.StatusOK || !strings.Contains(out, `"removed":true`) {
		t.Fatalf("detach = %d %s", code, out)
	}
	claimAbsent(t, fx, "*.teams.example.com")
	claimOf(t, fx, "teams.example.com") // the parent is untouched
}

func TestInstanceCatchallRefusals(t *testing.T) {
	fx, member := catchallFixture(t, "code-ca-refuse")
	fx.srv.cfg.DenyDomains = []string{"denied.test"}
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	fx.srv.cfg.TunnelHost = "hub.tunnels.example.org"
	for _, c := range []struct {
		what, body string
		code       int
		msg        string
	}{
		{"a route alongside", `{"host":"*.teams.example.com","route":"go.tito.io"}`, 400, "takes no route"},
		{"wildcard alongside", `{"host":"*.teams.example.com","wildcard":true}`, 400, "takes no route"},
		{"unclaimed parent", `{"host":"*.free.example.com"}`, 409, "attach free.example.com to an app in this account first"},
		{"a deny entry", `{"host":"*.denied.test"}`, 400, "platform-managed"},
		{"under a deny entry", `{"host":"*.x.denied.test"}`, 400, "platform-managed"},
		{"the apps domain", `{"host":"*.oncarlos.test"}`, 400, "platform-managed"},
		{"an account's namespace", `{"host":"*.bab.oncarlos.test"}`, 400, "platform-managed"},
		{"above the tunnel host", `{"host":"*.tunnels.example.org"}`, 400, "platform-managed"},
		{"a public suffix", `{"host":"*.co.uk"}`, 400, "platform-managed"},
		{"the sidecar suffix", `{"host":"*.x.sidecar.internal"}`, 400, "platform-managed"},
	} {
		code, out := catchallReq(t, fx, member, c.body)
		if code != c.code || !strings.Contains(out, c.msg) {
			t.Errorf("%s: %d %s, want %d containing %q", c.what, code, out, c.code, c.msg)
		}
	}
	claimAbsent(t, fx, "*.teams.example.com")

	// The parent held by another account reads exactly as an unclaimed one.
	if _, _, err := domains.AttachClaim(context.Background(), fx.rel, domains.Claim{
		Host: "theirs.example.com", Account: "cdef", App: "widgets", CreatedAt: "t",
	}); err != nil {
		t.Fatal(err)
	}
	_, unclaimed := catchallReq(t, fx, member, `{"host":"*.free.example.com"}`)
	_, theirs := catchallReq(t, fx, member, `{"host":"*.theirs.example.com"}`)
	if strings.ReplaceAll(unclaimed, "free.", "") != strings.ReplaceAll(theirs, "theirs.", "") {
		t.Fatalf("held elsewhere %q reads apart from unclaimed %q", theirs, unclaimed)
	}

	// An app with no instance manifest has nothing to serve.
	if _, err := fx.st.CreateAppIn(OpsAccountID, "plain", "paul@keymail.dev", time.Now()); err != nil {
		t.Fatal(err)
	}
	code, _, out := rawReq(t, http.MethodPost, domainsURL(fx, "bab", "plain"), member, `{"host":"*.teams.example.com"}`)
	if code != http.StatusConflict || !strings.Contains(out, "has no instances") {
		t.Fatalf("no manifest: %d %s", code, out)
	}
}

// A person's act: the app's own credential cannot set or remove one.
func TestInstanceCatchallIsAPersonsAct(t *testing.T) {
	fx, member := catchallFixture(t, "code-ca-person")
	tok, err := fx.st.NewAppToken(OpsAccountID, "titogo", "alice@keymail.dev", "signup", time.Now())
	if err != nil {
		t.Fatal(err)
	}
	if code, out := catchallReq(t, fx, tok, `{"host":"*.teams.example.com"}`); code != http.StatusUnauthorized {
		t.Fatalf("app token attach = %d %s, want 401", code, out)
	}
	claimAbsent(t, fx, "*.teams.example.com")
	if code, out := catchallReq(t, fx, member, `{"host":"*.teams.example.com"}`); code != http.StatusOK {
		t.Fatalf("person attach = %d %s", code, out)
	}
	code, _, out := rawReq(t, http.MethodDelete, domainsURL(fx, "bab", "titogo")+"/*.teams.example.com", tok, "")
	if code != http.StatusUnauthorized {
		t.Fatalf("app token detach = %d %s, want 401", code, out)
	}
	claimOf(t, fx, "*.teams.example.com")
	// The app token still attaches ordinary hostnames, including one-label
	// names under its own account's catch-all.
	if got := attachDomain(t, fx, tok, "acme.teams.example.com", "acme.go.tito.io"); !got.Created {
		t.Fatalf("same-account attach under the catch-all = %+v", got)
	}
}

// While a catch-all is live, another account cannot claim the name of one
// of its app's instances, and the refusal is the ordinary neutral 409. Labels
// with no instance stay open (an unproven parent claim must not block a
// whole domain), and a claim made before the catch-all keeps re-attaching.
func TestInstanceCatchallGuardsItsNames(t *testing.T) {
	fx, member := catchallFixture(t, "code-ca-guard")
	ctx := context.Background()
	newInstance := func(label string) {
		t.Helper()
		if err := provision.CreateRecord(ctx, fx.rel, provision.Record{Schema: 1, Host: label + ".go.tito.io", Slug: label,
			App: "titogo", Account: "bab", Channel: "stable", CreatedAt: time.Now().UTC()}); err != nil {
			t.Fatal(err)
		}
	}
	newInstance("acme")
	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if _, err := fx.st.CreateAppIn(42, "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	bob := cliToken(t, fx, "bob@keymail.dev", "code-ca-guard-bob")
	attach := func(host string) (int, string) {
		code, _, out := rawReq(t, http.MethodPost, domainsURL(fx, "cdef", "widgets"), bob, attachBody(host, "w.example.net"))
		return code, out
	}
	// Bob's claim from before the catch-all, on a label that later becomes
	// an instance.
	if code, out := attach("beta.teams.example.com"); code != http.StatusOK {
		t.Fatalf("pre-catch-all attach = %d %s", code, out)
	}
	if code, out := catchallReq(t, fx, member, `{"host":"*.teams.example.com"}`); code != http.StatusOK {
		t.Fatalf("catch-all attach = %d %s", code, out)
	}
	newInstance("beta")

	if code, out := attach("acme.teams.example.com"); code != http.StatusConflict || strings.TrimSpace(out) != `{"error":"hostname unavailable"}` {
		t.Fatalf("foreign attach of a live instance's name = %d %s, want the neutral 409", code, out)
	}
	claimAbsent(t, fx, "acme.teams.example.com")
	if code, out := attach("beta.teams.example.com"); code != http.StatusOK {
		t.Fatalf("re-attach of bob's own older claim = %d %s, want 200", code, out)
	}
	// No instance at that label: not the catch-all's to hold.
	if code, out := attach("free.teams.example.com"); code != http.StatusOK {
		t.Fatalf("label with no instance = %d %s", code, out)
	}
	// Deeper names are not the catch-all's either.
	if code, out := attach("x.acme.teams.example.com"); code != http.StatusOK {
		t.Fatalf("deeper name = %d %s", code, out)
	}
	// Once the parent is released the catch-all serves nothing and holds
	// nothing.
	if _, err := domains.DetachClaim(ctx, fx.rel, "teams.example.com", "bab", "site"); err != nil {
		t.Fatal(err)
	}
	if code, out := attach("acme.teams.example.com"); code != http.StatusOK {
		t.Fatalf("after the parent went = %d %s", code, out)
	}
}

// The list reports the catch-all row and, beneath it, only the names that
// are provably this app's: one label under the parent, unclaimed, routed to
// that label under the app's own instance domain.
func TestInstanceCatchallListsItsDerivedNames(t *testing.T) {
	fx, member := catchallFixture(t, "code-ca-list")
	if code, out := catchallReq(t, fx, member, `{"host":"*.teams.example.com"}`); code != http.StatusOK {
		t.Fatalf("attach = %d %s", code, out)
	}
	acct, err := fx.st.AccountBySqid("bab")
	if err != nil {
		t.Fatal(err)
	}
	claimed := map[string]bool{"teams.example.com": true, "*.teams.example.com": true, "held.teams.example.com": true}
	readings := map[string]status.AliasReading{
		"acme.teams.example.com":   {Route: "acme.go.tito.io", DNSStatus: "pointing"},
		"held.teams.example.com":   {Route: "held.go.tito.io"},        // a claim of its own
		"beta.teams.example.com":   {Route: "beta.elsewhere.example"}, // not this app's domain
		"gamma.teams.example.com":  {Route: "other.go.tito.io"},       // label does not match
		"x.acme.teams.example.com": {Route: "x.acme.go.tito.io"},      // two labels deep
	}
	got := fx.srv.catchallDerived(context.Background(), acct, "titogo", "teams.example.com", claimed, readings)
	if len(got) != 1 || got[0].Host != "acme.teams.example.com" || got[0].Route != "acme.go.tito.io" {
		t.Fatalf("derived = %+v, want only acme", got)
	}

	code, _, out := rawReq(t, http.MethodGet, domainsURL(fx, "bab", "titogo"), member, "")
	if code != http.StatusOK {
		t.Fatalf("list = %d %s", code, out)
	}
	var list struct {
		Domains []struct {
			Host      string `json:"host"`
			State     string `json:"state"`
			Instances bool   `json:"instances"`
			Guidance  string `json:"guidance"`
		} `json:"domains"`
	}
	if err := json.Unmarshal([]byte(out), &list); err != nil {
		t.Fatal(err)
	}
	if len(list.Domains) != 1 || list.Domains[0].Host != "*.teams.example.com" || !list.Domains[0].Instances ||
		list.Domains[0].State != StateChecking || !strings.Contains(list.Domains[0].Guidance, "*.teams.example.com") {
		t.Fatalf("list = %+v", list.Domains)
	}
	code, _, out = rawReq(t, http.MethodGet, domainsURL(fx, "bab", "titogo")+"/*.teams.example.com", member, "")
	if code != http.StatusOK || !strings.Contains(out, `"instances":true`) {
		t.Fatalf("get = %d %s", code, out)
	}
}

// The Settings page attaches a catch-all through the ordinary form, shows
// it as its own row with a detach form, and detaches it by typing the name.
func TestAppDomainFormInstanceCatchall(t *testing.T) {
	fx := newConsoleFixture(t)
	noCatchallProof(fx)
	c := signInPaul(t, fx)
	csrf := sessionToken(t, fx, c)
	ctx := context.Background()
	if err := provision.PutManifest(ctx, fx.rel, fx.sqid, "kass", provision.Manifest{Schema: 1, App: "kass", Domain: "kass.example.net"}); err != nil {
		t.Fatal(err)
	}
	if _, _, err := domains.AttachClaim(ctx, fx.rel, domains.Claim{Host: "teams.example.com", Account: fx.sqid, App: "kass", Route: "kass.carlosapp.dev", CreatedAt: "t"}); err != nil {
		t.Fatal(err)
	}
	st, loc, body := postForm(t, c, fx.u("/apps/kass/domains/attach"), url.Values{"csrf": {csrf}, "host": {"*.teams.example.com"}})
	if st != http.StatusSeeOther || loc != fx.path("/apps/kass/settings/domains") {
		t.Fatalf("attach = %d -> %q:\n%s", st, loc, body)
	}
	if cl := claimOf(t, fx, "*.teams.example.com"); !cl.Instances || cl.App != "kass" || cl.CreatedBy == "" {
		t.Fatalf("claim = %+v", *cl)
	}
	_, _, page := get(t, c, fx.u("/apps/kass/settings/domains"))
	if !strings.Contains(page, "*.teams.example.com") || !strings.Contains(page, "instance catch-all") {
		t.Fatalf("settings page does not show the catch-all:\n%s", page)
	}
	st, _, body = postForm(t, c, fx.u("/apps/kass/domains/detach"), url.Values{
		"csrf": {csrf}, "host": {"*.teams.example.com"}, "confirm": {"*.teams.example.com"}})
	if st != http.StatusSeeOther {
		t.Fatalf("detach = %d:\n%s", st, body)
	}
	claimAbsent(t, fx, "*.teams.example.com")
	claimOf(t, fx, "teams.example.com")
}

// Two more reservations the guard makes: an instance under an instance
// domain the app no longer uses still keeps its name, and a parent proved
// in DNS reserves every label — a team's name is safe before the team
// exists.
func TestInstanceCatchallGuardReservations(t *testing.T) {
	fx, member := catchallFixture(t, "code-ca-reserve")
	ctx := context.Background()
	// Created under an older instance domain than the manifest's go.tito.io.
	if err := provision.CreateRecord(ctx, fx.rel, provision.Record{Schema: 1, Host: "olden.old.example.net", Slug: "olden",
		App: "titogo", Account: "bab", Channel: "stable", CreatedAt: time.Now().UTC()}); err != nil {
		t.Fatal(err)
	}
	if code, out := catchallReq(t, fx, member, `{"host":"*.teams.example.com"}`); code != http.StatusOK {
		t.Fatalf("catch-all attach = %d %s", code, out)
	}
	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if _, err := fx.st.CreateAppIn(42, "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	bob := cliToken(t, fx, "bob@keymail.dev", "code-ca-reserve-bob")
	attach := func(host string) (int, string) {
		code, _, out := rawReq(t, http.MethodPost, domainsURL(fx, "cdef", "widgets"), bob, attachBody(host, "w.example.net"))
		return code, out
	}
	if code, out := attach("olden.teams.example.com"); code != http.StatusConflict {
		t.Fatalf("an old-domain instance's name = %d %s, want the neutral 409", code, out)
	}
	// Unproved: a label with no instance is open, and the list says so.
	if code, out := attach("early.teams.example.com"); code != http.StatusOK {
		t.Fatalf("unproved, no instance = %d %s, want 200", code, out)
	}
	_, _, list := rawReq(t, http.MethodGet, domainsURL(fx, "bab", "titogo"), member, "")
	if !strings.Contains(list, `"reserves":"instances"`) || !strings.Contains(list, domains.CatchallProofName("teams.example.com")) {
		t.Fatalf("list does not say what is reserved, or name the proof record: %s", list)
	}
	// Proved: every label is the catch-all account's...
	proveCatchall(fx, "teams.example.com", "bab")
	if code, out := attach("later.teams.example.com"); code != http.StatusConflict || strings.TrimSpace(out) != `{"error":"hostname unavailable"}` {
		t.Fatalf("proved, no instance = %d %s, want the neutral 409", code, out)
	}
	claimAbsent(t, fx, "later.teams.example.com")
	// ...except a claim the caller already holds.
	if code, out := attach("early.teams.example.com"); code != http.StatusOK {
		t.Fatalf("re-attach of bob's own earlier claim = %d %s, want 200", code, out)
	}
	_, _, list = rawReq(t, http.MethodGet, domainsURL(fx, "bab", "titogo"), member, "")
	if !strings.Contains(list, `"reserves":"all"`) {
		t.Fatalf("list after proof: %s", list)
	}
	// Another account's proof record does not prove this one.
	proveCatchall(fx, "teams.example.com", "cdef")
	if code, out := attach("other.teams.example.com"); code != http.StatusOK {
		t.Fatalf("proof naming another account = %d %s, want 200", code, out)
	}
}