package main

import "testing"

// The push/APNs tables must never retain a usable session token — only its hash.
func TestPushTokensHashedAtRest(t *testing.T) {
	db := newTestDB(t)
	tok := mintDeviceToken(t, db, "x")

	if err := db.addSubscription(PushSub{Endpoint: "https://e/1", Token: tok, P256dh: "p", Auth: "a"}); err != nil {
		t.Fatalf("addSubscription: %v", err)
	}
	if err := db.addAPNsToken(APNsToken{APNsToken: "apns-1", Token: tok}); err != nil {
		t.Fatalf("addAPNsToken: %v", err)
	}

	check := func(table, keyCol, keyVal string) {
		var storedTok, th string
		if err := db.sql.QueryRow(
			"SELECT token, COALESCE(token_hash, '') FROM "+table+" WHERE "+keyCol+" = ?", keyVal,
		).Scan(&storedTok, &th); err != nil {
			t.Fatalf("%s row: %v", table, err)
		}
		if storedTok != "" {
			t.Errorf("%s retains plaintext token %q, want empty", table, storedTok)
		}
		if th != hashToken(tok) {
			t.Errorf("%s token_hash = %q, want hash of the token", table, th)
		}
	}
	check("push_subscriptions", "endpoint", "https://e/1")
	check("apns_tokens", "apns_token", "apns-1")

	// Delete-by-raw-token still resolves via the stored hash.
	if err := db.deleteSubscriptionsForToken(tok); err != nil {
		t.Fatalf("deleteSubscriptionsForToken: %v", err)
	}
	if subs, _ := db.listSubscriptions(); len(subs) != 0 {
		t.Fatalf("delete-by-token after hashing left %d sub(s)", len(subs))
	}
}

// Rows created before this migration stored the token in clear; the backfill
// hashes them and scrubs the plaintext.
func TestBackfillScrubsPlaintextPushTokens(t *testing.T) {
	db := newTestDB(t)
	if _, err := db.sql.Exec(
		"INSERT INTO push_subscriptions(endpoint, token, p256dh, auth, created_at) VALUES('https://e/old','rawtok','p','a',0)",
	); err != nil {
		t.Fatalf("seed push: %v", err)
	}
	if _, err := db.sql.Exec(
		"INSERT INTO apns_tokens(apns_token, token, sandbox, created_at) VALUES('apns-old','rawtok',0,0)",
	); err != nil {
		t.Fatalf("seed apns: %v", err)
	}

	if err := db.backfillPushTokenHashes(); err != nil {
		t.Fatalf("backfill: %v", err)
	}

	for _, tc := range []struct{ table, keyCol, keyVal string }{
		{"push_subscriptions", "endpoint", "https://e/old"},
		{"apns_tokens", "apns_token", "apns-old"},
	} {
		var tok, th string
		if err := db.sql.QueryRow(
			"SELECT token, COALESCE(token_hash, '') FROM "+tc.table+" WHERE "+tc.keyCol+" = ?", tc.keyVal,
		).Scan(&tok, &th); err != nil {
			t.Fatalf("%s: %v", tc.table, err)
		}
		if tok != "" {
			t.Errorf("%s: backfill left plaintext %q", tc.table, tok)
		}
		if th != hashToken("rawtok") {
			t.Errorf("%s: backfill token_hash = %q, want hash of rawtok", tc.table, th)
		}
	}
}

// removeUser must drop the user's APNs tokens. This also exercises the token_hash
// join that replaced a query referencing a non-existent device_tokens.token column.
func TestRemoveUserDropsAPNsTokens(t *testing.T) {
	db := newTestDB(t)
	if err := db.createKeyInvite("k1", "alice", "w", testClaimHash, 0); err != nil {
		t.Fatalf("createKeyInvite: %v", err)
	}
	tok, ok, err := db.claimKeyInvite("k1", "phone", "", testClaimSecret)
	if err != nil || !ok {
		t.Fatalf("claimKeyInvite: ok=%v err=%v", ok, err)
	}
	if err := db.addAPNsToken(APNsToken{APNsToken: "apns-alice", Token: tok}); err != nil {
		t.Fatalf("addAPNsToken: %v", err)
	}
	if toks, _ := db.listAPNsTokens(); len(toks) != 1 {
		t.Fatalf("precondition: want 1 apns token, got %d", len(toks))
	}
	if err := db.removeUser("alice"); err != nil {
		t.Fatalf("removeUser: %v", err)
	}
	if toks, _ := db.listAPNsTokens(); len(toks) != 0 {
		t.Fatalf("removeUser left %d apns token(s)", len(toks))
	}
}