package edge

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/carlosframework/platform/internal/registry"
)

// purgePathEdge stands up the shape path routing exists to create: a front
// hostname whose prefix routes to a second route belonging to a DIFFERENT app
// in the same account, plus a cache. The path row is written before New so
// Reload folds it into the upstream map.
func purgePathEdge(t *testing.T, front, target registry.Route, prefix string, h http.HandlerFunc) *Edge {
	t.Helper()
	backend := httptest.NewServer(h)
	t.Cleanup(backend.Close)
	reg := openReg(t)
	for _, rt := range []registry.Route{front, target} {
		rt.Kind, rt.Addr, rt.Status = "instance", backend.Listener.Addr().String(), "ready"
		if err := reg.Upsert(rt); err != nil {
			t.Fatalf("upsert %s: %v", rt.Host, err)
		}
	}
	if err := reg.UpsertPath(registry.RoutePath{
		Host: front.Host, Prefix: prefix, Target: target.Host,
		Account: front.Account, App: front.App,
	}); err != nil {
		t.Fatalf("upsert path %s/%s: %v", front.Host, prefix, err)
	}
	e, err := New(reg, nil)
	if err != nil {
		t.Fatalf("New: %v", err)
	}
	e.EnableCache(NewCache(DefaultCacheMaxEntries, DefaultCacheMaxBodyBytes))
	return e
}

// TestPurgeHostOverrideAllowedFromAPathRoutedHost is the hole this closes.
//
// A path-routed request is cached under the hostname the browser asked for
// (ti.to), but it is served by the target's route (go.tito.example), and
// purgeModifier is built from that route. So the app's own Carlos-Purge lands
// under go.tito.example and hits nothing, and the documented escape hatch —
// naming ti.to explicitly — used to be refused too, because the override
// required the same app and path routing crosses apps by design.
//
// The request really is path-routed here rather than simulated: it arrives on
// ti.to/paulca and reaches the target through the prefix map, so this pins the
// composition and not just resolvePurgeHosts in isolation.
func TestPurgeHostOverrideAllowedFromAPathRoutedHost(t *testing.T) {
	e := purgePathEdge(t,
		route("ti.to", "classic", "tenanta"),
		route("go.tito.example", "gonew", "tenanta"),
		"paulca",
		func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Carlos-Purge-Host", "ti.to")
			w.Header().Set("Carlos-Purge", "/paulca/events/42")
			w.WriteHeader(http.StatusOK)
		})
	seed(t, e.cache, "ti.to", "/paulca/events/42", "", "stale")
	seed(t, e.cache, "ti.to", "/paulca/events/43", "", "untouched")

	rec := httptest.NewRecorder()
	e.ServeHTTP(rec, httptest.NewRequest("POST", "http://ti.to/paulca/admin", nil))

	if cached(e.cache, "ti.to", "/paulca/events/42", "") {
		t.Fatal("a path-routed app could not purge its own stale page under the hostname it is served on")
	}
	if !cached(e.cache, "ti.to", "/paulca/events/43", "") {
		t.Fatal("/paulca/events/43 was purged but nothing named it")
	}
	if got := rec.Header().Get("Carlos-Purge-Host"); got != "" {
		t.Fatalf("Carlos-Purge-Host reached the client: %q", got)
	}
}

// TestPurgeHostOverrideFromPathRoutedHostStillNeedsTheAccount — the new branch
// drops the same-APP requirement and nothing else. Account remains the
// boundary, and the edge checks it here rather than trusting that the
// reconcile pass already refused a cross-account path row: a row written by an
// older binary, or by hand, must not be able to reach another tenant's cache.
//
// Both accounts must be valid sqids (^[a-z]{3,16}$) or release.RouteAccount
// folds them both onto the built-in ops account and the test asserts a
// boundary it never crossed.
func TestPurgeHostOverrideFromPathRoutedHostStillNeedsTheAccount(t *testing.T) {
	e := purgePathEdge(t,
		route("ti.to", "classic", "tenanta"),
		route("go.tito.example", "gonew", "tenantb"),
		"paulca",
		func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Carlos-Purge-Host", "ti.to")
			w.Header().Set("Carlos-Purge", "/paulca/events/42")
			w.WriteHeader(http.StatusOK)
		})
	seed(t, e.cache, "ti.to", "/paulca/events/42", "", "stale")

	rec := httptest.NewRecorder()
	e.ServeHTTP(rec, httptest.NewRequest("POST", "http://ti.to/paulca/admin", nil))

	if !cached(e.cache, "ti.to", "/paulca/events/42", "") {
		t.Fatal("a path row pointing across ACCOUNTS let the target purge the front host's cache")
	}
}

// TestPurgeHostOverrideRefusedWhenNoPrefixPointsAtTheRoute — the exception is
// scoped to the route the prefix map actually names. A second route in the
// same account, serving nothing of ti.to's traffic, gets the ordinary
// cross-app refusal.
//
// Without this, "the front host path-routes somewhere" would be enough, and
// any app in the account could purge ti.to by naming it.
func TestPurgeHostOverrideRefusedWhenNoPrefixPointsAtTheRoute(t *testing.T) {
	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Carlos-Purge-Host", "ti.to")
		w.Header().Set("Carlos-Purge", "/paulca/events/42")
		w.WriteHeader(http.StatusOK)
	}))
	t.Cleanup(backend.Close)

	reg := openReg(t)
	for _, rt := range []registry.Route{
		route("ti.to", "classic", "tenanta"),
		route("go.tito.example", "gonew", "tenanta"),
		route("bystander.example", "other", "tenanta"),
	} {
		rt.Kind, rt.Addr, rt.Status = "instance", backend.Listener.Addr().String(), "ready"
		if err := reg.Upsert(rt); err != nil {
			t.Fatalf("upsert %s: %v", rt.Host, err)
		}
	}
	// ti.to routes /paulca to go.tito.example — and to nothing else.
	if err := reg.UpsertPath(registry.RoutePath{
		Host: "ti.to", Prefix: "paulca", Target: "go.tito.example",
		Account: "tenanta", App: "classic",
	}); err != nil {
		t.Fatal(err)
	}
	e, err := New(reg, nil)
	if err != nil {
		t.Fatal(err)
	}
	e.EnableCache(NewCache(DefaultCacheMaxEntries, DefaultCacheMaxBodyBytes))
	seed(t, e.cache, "ti.to", "/paulca/events/42", "", "stale")

	// The write arrives on the bystander's OWN host, so it is served by the
	// bystander's route — which no prefix of ti.to names.
	rec := httptest.NewRecorder()
	e.ServeHTTP(rec, httptest.NewRequest("POST", "http://bystander.example/write", nil))

	if !cached(e.cache, "ti.to", "/paulca/events/42", "") {
		t.Fatal("a route no prefix points at purged ti.to — the exception is not scoped to the path target")
	}
}