package memoriatest

import (
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"regexp"
	"strings"
	"testing"
)

// nativeApprovalPage starts a native sign-in on h and opens its approval
// page as c, the signed-in browser, returning the response.
func nativeApprovalPage(t *testing.T, h http.Handler, c *client) *httptest.ResponseRecorder {
	t.Helper()
	sum := sha256.Sum256([]byte(strings.Repeat("v", 43)))
	req := httptest.NewRequest(http.MethodPost, testOrigin+"/native/request",
		strings.NewReader(`{"challenge":"`+base64.RawURLEncoding.EncodeToString(sum[:])+`"}`))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Origin", testOrigin)
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	var out struct{ ID string }
	if rec.Code != http.StatusOK || json.Unmarshal(rec.Body.Bytes(), &out) != nil || out.ID == "" {
		t.Fatalf("POST /native/request = %d %q", rec.Code, rec.Body.String())
	}
	page := c.get(testOrigin + "/native/authorize?id=" + out.ID)
	if page.Code != http.StatusOK || !strings.Contains(page.Body.String(), "Sign in to Memoria app") {
		t.Fatalf("GET /native/authorize = %d, not the approval page:\n%s", page.Code, page.Body.String())
	}
	return page
}

var styleElement = regexp.MustCompile(`(?s)<style>(.*?)</style>`)

// Astra on #27, P2: the native kit's approval page (/native/authorize) is
// styled by one inline <style> element, and rastrillo fb806a2's strict
// default refused it, so the page lost its card, spacing and button. The
// fix allows that stylesheet by its hash, on that route only.
//
// Read through the production stack: the served stylesheet's own hash
// must be in the route's style-src (so a native bump that changes the CSS
// fails here, not on a phone), and with that one source taken out the
// policy is rastrillo's default exactly, so nothing else is relaxed. No
// other page carries the hash.
//
// Fails on 651f370 (no hash on the route). MUTATIONS (author-chosen,
// 2026-10-06): dropping the wrapper from the GET route; 'unsafe-inline'
// in place of the hash; the wrapper on every route. Each fails here.
// Reverted.
func TestNativeApprovalStyleIsTheHashedOne(t *testing.T) {
	c, h := signedInServedClient(t)
	page := nativeApprovalPage(t, h, c)
	m := styleElement.FindStringSubmatch(page.Body.String())
	if m == nil {
		t.Fatal("the approval page has no <style> element; if native/server moved its CSS out, drop the hash (memoria native.go)")
	}
	sum := sha256.Sum256([]byte(m[1]))
	source := "'sha256-" + base64.StdEncoding.EncodeToString(sum[:]) + "'"

	policies := page.Header().Values("Content-Security-Policy")
	if len(policies) != 1 {
		t.Fatalf("CSP values = %q, want one", policies)
	}
	if !strings.Contains(policies[0], "style-src ") || !strings.Contains(policies[0], " "+source) {
		t.Fatalf("the approval page's CSP %q does not admit its own stylesheet %s", policies[0], source)
	}
	if strings.Contains(policies[0], "'unsafe-inline'") {
		t.Errorf("the approval page allows every inline style: %q", policies[0])
	}
	if got, want := strings.Replace(policies[0], " "+source, "", 1), defaultCSP(t); got != want {
		t.Errorf("with the native hash taken out, the policy is %q, want rastrillo's default %q", got, want)
	}

	for _, path := range []string{"/", "/signin", "/auth/verify?token=x"} {
		if got := strings.Join(c.get(testOrigin+path).Header().Values("Content-Security-Policy"), "\n"); strings.Contains(got, source) {
			t.Errorf("%s carries the native approval page's hash: %q", path, got)
		}
	}
}

// signedInServedClient is a browser signed in through the real magic link
// on servedApp, the production stack.
func signedInServedClient(t *testing.T) (*client, http.Handler) {
	t.Helper()
	h, mailer := servedApp(t, tempDB(t), []string{chromeOwner})
	c := newClient(t, h)
	if rec := c.postSameOrigin(testOrigin+"/auth/begin", map[string][]string{"address": {chromeOwner}}); rec.Code != http.StatusSeeOther {
		t.Fatalf("POST /auth/begin = %d", rec.Code)
	}
	link := regexp.MustCompile(`/auth/verify\?[^\s<>"]+`).FindString(mailer.text())
	if link == "" {
		t.Fatalf("no magic link: %q", mailer.text())
	}
	if rec := c.openLink(testOrigin + link); rec.Code != http.StatusSeeOther {
		t.Fatalf("redeem = %d", rec.Code)
	}
	return c, h
}