package callstest

import (
	"encoding/json"
	"net/http"
	"testing"
	"time"
)

// twoMembersInOneRoom is the shape every case below starts from: two
// signed-in members of the same meeting, both joined, both streams
// open, and each one's peer id.
func twoMembersInOneRoom(t *testing.T) (x *harness, sqid string, a, b *client, sa, sb *sseReader, pa, pb string) {
	t.Helper()
	x, sqid, _ = memberWithMeeting(t)
	a = x.browser(t)
	a.signIn("paul@example.com")
	sa = a.stream("/m/" + sqid + "/stream")
	t.Cleanup(sa.close)
	pa, _ = sa.hello()
	a.signal(sqid, pa, `{"type":"join"}`)

	b = newMemberBrowser(t, x, "paul@rslw.com")
	sb = b.stream("/m/" + sqid + "/stream")
	t.Cleanup(sb.close)
	pb, _ = sb.hello()
	b.signal(sqid, pb, `{"type":"join"}`)
	if ev, _, ok := sa.nextOf("peer", 2*time.Second); !ok {
		t.Fatalf("the two members never met (got %q)", ev)
	}
	return
}

// gone reads the `gone` event the room is owed when a participation
// ends, and says whether it named this peer.
func sawGone(t *testing.T, s *sseReader, peer string) bool {
	t.Helper()
	ev, data, ok := s.nextOf("gone", 2*time.Second)
	if !ok {
		t.Logf("no gone event (got %q)", ev)
		return false
	}
	var g struct{ From string }
	json.Unmarshal(data, &g)
	return g.From == peer
}

// Spec §2.5's paragraph, corrected into the table by §15.12: a
// participation whose kind is `member` re-derives standing on every
// request, not only on the fifteen-second tick — "a member who has just
// been removed is dropped by the next thing they do". Codex S2-1 found
// every one of these accepting a removed member's traffic until the
// tick caught up.
//
// Each case revokes B's membership and then makes exactly one request,
// before any tick has run.
func TestAMemberWithNoStandingIsRefusedByTheNextRequestNotTheNextTick(t *testing.T) {
	t.Run("relay", func(t *testing.T) {
		x, sqid, _, b, sa, _, pa, pb := twoMembersInOneRoom(t)
		// The answer a peer that never existed gets, read before
		// anything is revoked: a dropped member must be told exactly
		// this and nothing more (§2.5, "404, never 403").
		unknown, unknownBody := b.signal(sqid, pb, `{"type":"offer","to":"`+zeroPeer+`","seq":1,"gen":1,"payload":{}}`)
		if unknown.StatusCode != http.StatusNotFound {
			t.Fatalf("offer to an unknown peer: %d", unknown.StatusCode)
		}

		x.ctl.SetAllowlist("paul@example.com") // B is off the team
		resp, body := b.signal(sqid, pb, `{"type":"offer","to":"`+pa+`","seq":2,"gen":1,"payload":{}}`)
		if resp.StatusCode != http.StatusNotFound {
			t.Fatalf("relay by a removed member before the tick: %d %s", resp.StatusCode, body)
		}
		if string(body) != string(unknownBody) {
			t.Fatalf("relay refusal body %s, want the unknown-peer body %s", body, unknownBody)
		}
		if !sawGone(t, sa, pb) {
			t.Fatal("the room was not told the removed member had gone")
		}
	})

	t.Run("reset", func(t *testing.T) {
		x, sqid, _, b, sa, _, pa, pb := twoMembersInOneRoom(t)
		x.ctl.SetAllowlist("paul@example.com")
		resp, body := b.signal(sqid, pb, `{"type":"reset","to":"`+pa+`"}`)
		if resp.StatusCode != http.StatusNotFound {
			t.Fatalf("reset by a removed member before the tick: %d %s", resp.StatusCode, body)
		}
		if !sawGone(t, sa, pb) {
			t.Fatal("the room was not told the removed member had gone")
		}
	})

	t.Run("resume", func(t *testing.T) {
		x, sqid, _, b, sa, sb, _, pb := twoMembersInOneRoom(t)
		sb.close()
		x.ctl.SetAllowlist("paul@example.com")
		rec := b.getStream("/m/" + sqid + "/stream?peer=" + pb)
		_, boot, reason := answer(t, rec)
		if rec.Code != http.StatusNotFound || boot == "" || reason != "" {
			t.Fatalf("resume by a removed member before the tick: %d boot=%q reason=%q, want 404 with a boot and no reason",
				rec.Code, boot, reason)
		}
		if !sawGone(t, sa, pb) {
			t.Fatal("the room was not told the removed member had gone")
		}
	})

	// The probe answers the same 404 and ends nothing: §15.3 defines it
	// as changing nothing at all, so the ending is the next mutating
	// request's, or the tick's.
	t.Run("probe", func(t *testing.T) {
		x, sqid, _, b, sa, _, pa, pb := twoMembersInOneRoom(t)
		x.ctl.SetAllowlist("paul@example.com")
		rec := b.get("/m/" + sqid + "/stream?probe=1&peer=" + pb)
		_, boot, reason := answer(t, rec)
		if rec.Code != http.StatusNotFound || boot == "" || reason != "" {
			t.Fatalf("probe by a removed member before the tick: %d boot=%q reason=%q, want 404 with a boot and no reason",
				rec.Code, boot, reason)
		}
		if ev, _, ok := sa.nextOf("gone", 500*time.Millisecond); ok {
			t.Fatalf("the probe ended the participation (%q reached the room)", ev)
		}
		// Still there, and still the room's to lose on the next thing
		// this member actually does.
		if resp, body := b.signal(sqid, pb, `{"type":"reset","to":"`+pa+`"}`); resp.StatusCode != http.StatusNotFound {
			t.Fatalf("reset after the probe: %d %s", resp.StatusCode, body)
		}
		if !sawGone(t, sa, pb) {
			t.Fatal("the room was not told the removed member had gone")
		}
	})
}

// The other half of §15.12, and ruling 14's guarantee: an admitted
// guest is untouched by any of this. Their grant has expired, which is
// exactly the state a member would be dropped for, and they go on
// relaying, resetting and resuming — the participation is the authority
// once someone is in.
func TestAnAdmittedGuestWithNoStandingKeepsRelayingResettingAndResuming(t *testing.T) {
	x, sqid, tok := memberWithMeeting(t)
	m := x.browser(t)
	m.signIn("paul@example.com")
	sm := m.stream("/m/" + sqid + "/stream")
	defer sm.close()
	pm, _ := sm.hello()
	m.signal(sqid, pm, `{"type":"join"}`)

	g := x.browser(t)
	g.get("/j/" + tok)
	g.signIn("guest@example.com")
	sg := g.stream("/m/" + sqid + "/stream")
	defer sg.close()
	pg, _ := sg.hello()
	g.signal(sqid, pg, `{"type":"join"}`)
	m.signal(sqid, pm, `{"type":"admit","payload":{"peer":"`+pg+`"}}`)
	if ev, _, ok := sg.nextOf("roster", 2*time.Second); !ok {
		t.Fatalf("the guest was never admitted (got %q)", ev)
	}

	x.advance(2*time.Hour + time.Minute) // the grant is over

	if resp, body := g.signal(sqid, pg, `{"type":"offer","to":"`+pm+`","seq":1,"gen":1,"payload":{}}`); resp.StatusCode != http.StatusOK {
		t.Fatalf("relay past grant expiry: %d %s", resp.StatusCode, body)
	}
	if resp, body := g.signal(sqid, pg, `{"type":"reset","to":"`+pm+`"}`); resp.StatusCode != http.StatusOK {
		t.Fatalf("reset past grant expiry: %d %s", resp.StatusCode, body)
	}
	if rec := g.get("/m/" + sqid + "/stream?probe=1&peer=" + pg); rec.Code != http.StatusNoContent {
		t.Fatalf("resume probe past grant expiry: %d, want 204", rec.Code)
	}
	sg.close()
	sg2 := g.stream("/m/" + sqid + "/stream?peer=" + pg)
	defer sg2.close()
	if p, _ := sg2.hello(); p != pg {
		t.Fatalf("resume past grant expiry: %s, want %s", p, pg)
	}
	if ev, _, ok := sm.nextOf("gone", 500*time.Millisecond); ok {
		t.Fatalf("the expired guest was dropped by their own requests (%q reached the member)", ev)
	}
}

// zeroPeer is a peer id of the right shape that no room ever issued.
const zeroPeer = "00000000000000000000000000000000"