package connect

import (
	"bytes"
	"encoding/base64"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"
)

func TestHomeResourceReturnSurvivesSetupAndRefusesTamper(t *testing.T) {
	_, n := navigationFixture(t)
	now := time.Unix(1900000000, 0)
	n.now = func() time.Time { return now }
	const target = "/d/private-resource?view=compact"
	w := httptest.NewRecorder()
	if !n.rememberReturn(w, target) {
		t.Fatal("return intent refused")
	}
	cookies := w.Result().Cookies()
	if len(cookies) != 1 || !cookies[0].Secure || !cookies[0].HttpOnly || cookies[0].SameSite != http.SameSiteLaxMode || cookies[0].MaxAge != 600 {
		t.Fatal("unsafe navigation cookie")
	}
	c := cookies[0]
	r := httptest.NewRequest("GET", navigationOrigin+"/account/home", nil)
	r.AddCookie(c)
	if got := n.returnPath(r); got != target {
		t.Fatal("resource lost across setup", got)
	}
	raw, _ := base64.RawURLEncoding.DecodeString(c.Value)
	if bytes.Contains(raw, []byte("private-resource")) {
		t.Fatal("resource stored as readable cookie bytes")
	}
	raw[len(raw)-1] ^= 1
	bad := *c
	bad.Value = base64.RawURLEncoding.EncodeToString(raw)
	tampered := httptest.NewRequest("GET", navigationOrigin+"/account/home", nil)
	tampered.AddCookie(&bad)
	if n.returnPath(tampered) != "/" {
		t.Fatal("tampered return accepted")
	}
	other := *n
	other.origin = "https://another.docs.example.com"
	if other.returnPath(r) != "/" {
		t.Fatal("other team return accepted")
	}
	duplicate := r.Clone(r.Context())
	duplicate.AddCookie(c)
	if n.returnPath(duplicate) != "/" {
		t.Fatal("ambiguous return accepted")
	}
	now = now.Add(600 * time.Second)
	if n.returnPath(r) != "/" {
		t.Fatal("expired return accepted")
	}
}

func TestHomeResourceReturnValidatesSealedPathAndLifetime(t *testing.T) {
	_, n := navigationFixture(t)
	now := int64(1900000000)
	n.now = func() time.Time { return time.Unix(now, 0) }
	for _, v := range []homeReturnIntent{
		{"https://other.example", now, now + 600},
		{"//other.example", now, now + 600},
		{"/auth/start", now, now + 600},
		{"/d/ok", now + 1, now + 600},
		{"/d/ok", now, now + 601},
	} {
		payload, _ := json.Marshal(v)
		sealed, err := n.sealer.Seal(n.namespace+".home-return.v1:"+n.origin, payload)
		if err != nil {
			t.Fatal(err)
		}
		r := httptest.NewRequest("GET", navigationOrigin+"/account/home", nil)
		r.AddCookie(&http.Cookie{Name: homeReturnCookie, Value: base64.RawURLEncoding.EncodeToString(sealed)})
		if n.returnPath(r) != "/" {
			t.Fatal("unsafe sealed navigation accepted")
		}
	}
}