package calls

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

func TestCreditsArePublicAndContainDependencyNotices(t *testing.T) {
	fixture := newHomeRouterFixture(t)
	app := fixture.handler
	response := httptest.NewRecorder()
	app.ServeHTTP(response, httptest.NewRequest(http.MethodGet, homeTestOrigin+"/help/open-source", nil))
	if response.Code != http.StatusOK || response.Header().Get("Location") != "" || len(response.Result().Cookies()) != 0 {
		t.Fatal("credits required authentication", response.Code)
	}
	if response.Header().Get("Cache-Control") != "no-store" || response.Header().Get("Referrer-Policy") != "strict-origin" {
		// strict-origin, not no-referrer: the page shows the account menu,
		// whose chained sign-out id.* admits by the Referer's origin (spec
		// shared-chrome §9.5). It still sets no cookie (above).
		t.Fatal("credits must send strict-origin", response.Header().Get("Referrer-Policy"))
	}
	for _, wanted := range []string{"No notice file is included in this release.", "estilo-credits", "Open source", "Lucide and Feather", "gorm.io/gorm", "gormlite/LICENSE", "/static/credits.css"} {
		if !strings.Contains(response.Body.String(), wanted) {
			t.Fatal("missing credit", wanted)
		}
	}
	style := httptest.NewRecorder()
	app.ServeHTTP(style, httptest.NewRequest(http.MethodGet, homeTestOrigin+"/static/credits.css", nil))
	if style.Code != http.StatusOK || !strings.HasPrefix(style.Header().Get("Content-Type"), "text/css") || !strings.Contains(style.Body.String(), "[estilo-credits]") {
		t.Fatal("shared credit styles not served")
	}
	if output := os.Getenv("CALLS_CREDITS_EVIDENCE_DIR"); output != "" {
		if err := os.MkdirAll(output, 0700); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(filepath.Join(output, "page.html"), response.Body.Bytes(), 0600); err != nil {
			t.Fatal(err)
		}
		for _, match := range regexp.MustCompile(`(?:href|src)="(/static/[^" ]+)"`).FindAllStringSubmatch(response.Body.String(), -1) {
			asset := httptest.NewRecorder()
			app.ServeHTTP(asset, httptest.NewRequest(http.MethodGet, homeTestOrigin+match[1], nil))
			if asset.Code != http.StatusOK {
				t.Fatal("credits fixture asset unavailable", match[1])
			}
			if err := os.WriteFile(filepath.Join(output, filepath.Base(match[1])), asset.Body.Bytes(), 0600); err != nil {
				t.Fatal(err)
			}
		}
	}
	var inventory creditInventory
	if err := json.Unmarshal(creditNotices, &inventory); err != nil {
		t.Fatal(err)
	}
	if len(inventory.MissingNotices) != 1 || inventory.MissingNotices[0] != "github.com/keymaildev/signin" {
		t.Fatal("new missing notice requires review")
	}
}