package slidestest

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"os/exec"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
	"time"
)

// exportJobPath finds the status page a started export redirected to:
// /d/{sqid}/export/{job}, the job id being rastrillo's own base64url.
var exportJobPath = regexp.MustCompile(`/d/[23456789abcdefghjkmnpqrstuvwxyz]{10}/export/[A-Za-z0-9_-]{22}`)

// startExport posts the export form and returns the status page it
// redirected to.
func startExport(t *testing.T, a *testApp, deck string, cookies []*http.Cookie, form url.Values) string {
	t.Helper()
	rec := post(t, a, deck+"/export", form, cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST %s/export: status %d, want 303\n%s", deck, rec.Code, rec.Body)
	}
	loc := rec.Header().Get("Location")
	if !exportJobPath.MatchString(loc) {
		t.Fatalf("POST %s/export: Location = %q, want a job's status page", deck, loc)
	}
	return loc
}

// waitForExport polls the status page's own fragment — the endpoint the
// shim polls, so this waits exactly as a browser does — until the job
// stops running. Bounded by a context deadline rather than a count of
// sleeps, so a slow machine waits longer and a hung job still fails.
func waitForExport(t *testing.T, a *testApp, status string, cookies []*http.Cookie) string {
	t.Helper()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
	defer cancel()
	for {
		rec := mustGet(t, a, status+"/fragment", http.StatusOK, cookies)
		body := rec.Body.String()
		if !strings.Contains(body, "data-poll=") {
			return body
		}
		select {
		case <-ctx.Done():
			t.Fatalf("the export was still running after %v:\n%s", 2*time.Minute, body)
		case <-time.After(50 * time.Millisecond):
		}
	}
}

// TestExportJobProducesADownload is the whole flow as a person walks
// it: the form, the POST, the status page while it works, the fragment
// the shim polls, and the file at the end.
func TestExportJobProducesADownload(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	deck := sampleDeck(t, a, cookies)

	// The viewer offers it, to the person who can read the deck.
	page := mustGet(t, a, deck, http.StatusOK, cookies).Body.String()
	if !strings.Contains(page, `href="`+deck+`/export"`) {
		t.Errorf("the viewer has no export button:\n%s", page)
	}

	form := mustGet(t, a, deck+"/export", http.StatusOK, cookies).Body.String()
	if !strings.Contains(form, `name="notes"`) {
		t.Errorf("the export form has no with-notes checkbox:\n%s", form)
	}
	if !strings.Contains(form, `method="post"`) {
		t.Errorf("the export form does not post:\n%s", form)
	}

	status := startExport(t, a, deck, cookies, url.Values{"notes": {"1"}})

	// The status page is a page in its own right, and while the job
	// runs it says so in a way that works with scripts off.
	first := mustGet(t, a, status, http.StatusOK, cookies).Body.String()
	if strings.Contains(first, "data-poll=") && !strings.Contains(first, "http-equiv=\"refresh\"") {
		t.Errorf("the running status page polls but has no <noscript> refresh:\n%s", first)
	}

	fragment := waitForExport(t, a, status, cookies)
	if strings.Contains(fragment, "rst-tone=\"negative\"") {
		t.Fatalf("the export failed:\n%s", fragment)
	}
	download := status + ".pdf"
	if !strings.Contains(fragment, download) {
		t.Fatalf("the finished fragment offers no download of %s:\n%s", download, fragment)
	}

	// The finished page says the same thing as the fragment: one
	// template, two holes.
	done := mustGet(t, a, status, http.StatusOK, cookies).Body.String()
	if !strings.Contains(done, download) {
		t.Errorf("the finished status page offers no download:\n%s", done)
	}
	if strings.Contains(done, "data-poll=") {
		t.Errorf("the finished page is still polling:\n%s", done)
	}
	if strings.Contains(done, "http-equiv=\"refresh\"") {
		t.Errorf("the finished page still refreshes itself:\n%s", done)
	}

	// The stream a browser rides instead of the timer says the same
	// thing and closes: it carries no markup, only "go and look".
	events := mustGet(t, a, status+"/events", http.StatusOK, cookies)
	if got := events.Header().Get("Content-Type"); got != "text/event-stream" {
		t.Errorf("the events stream's Content-Type is %q", got)
	}
	if !strings.Contains(events.Body.String(), "event: done") {
		t.Errorf("the events stream of a finished job does not say so:\n%s", events.Body)
	}

	rec := mustGet(t, a, download, http.StatusOK, cookies)
	pdf := rec.Body.Bytes()
	if !strings.HasPrefix(string(pdf), "%PDF-") {
		t.Fatalf("the download is not a PDF: %q", pdf[:min(16, len(pdf))])
	}
	if got := rec.Header().Get("Content-Type"); got != "application/pdf" {
		t.Errorf("Content-Type = %q", got)
	}
	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
		t.Errorf("X-Content-Type-Options = %q", got)
	}
	disposition := rec.Header().Get("Content-Disposition")
	if !strings.HasPrefix(disposition, "attachment; ") || !strings.Contains(disposition, sampleDeckTitle+".pdf") {
		t.Errorf("Content-Disposition = %q, want an attachment named after the deck", disposition)
	}

	// Notes were asked for, so there are at least two pages per slide.
	// Either spelling of the entry: pdf-writer 0.12 (svg2pdf) wrote
	// "/Type /Page", 0.15 (krilla) writes "/Type/Page".
	count := func(entry string) int {
		return strings.Count(string(pdf), entry) +
			strings.Count(string(pdf), strings.Replace(entry, " /", "/", 1))
	}
	pages := count("/Type /Page") - count("/Type /Pages")
	if pages < 16 {
		t.Errorf("the PDF has %d pages; the sample deck with notes should have at least 16", pages)
	}

	// A real extractor, when the machine has one.
	if path, err := exec.LookPath("pdftotext"); err == nil {
		file := filepath.Join(t.TempDir(), "export.pdf")
		if err := os.WriteFile(file, pdf, 0o644); err != nil {
			t.Fatal(err)
		}
		out, err := exec.Command(path, file, "-").Output()
		if err != nil {
			t.Fatalf("pdftotext: %v", err)
		}
		if !strings.Contains(string(out), sampleDeckTitle) {
			t.Errorf("pdftotext did not find the first heading %q; got:\n%s", sampleDeckTitle, out)
		}
	} else {
		t.Log("pdftotext is not on PATH: the extracted-text assertion was skipped")
	}
}

// TestExportStatusOutlivesTheJobRecord: rastrillo/jobs forgets a
// finished job ten minutes after it ends; this app holds the file for
// an hour, which is what the page told the person. For the fifty
// minutes in between, the page and the download have to say the same
// thing — so the status page, its fragment and the API's status all
// answer from the app's own record once the registry has forgotten.
func TestExportStatusOutlivesTheJobRecord(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	deck := sampleDeck(t, a, cookies)

	status := startExport(t, a, deck, cookies, nil)
	waitForExport(t, a, status, cookies)
	download := status + ".pdf"

	// Ten minutes pass, as far as the registry is concerned.
	if err := a.app.ForgetExportJobs(); err != nil {
		t.Fatalf("ForgetExportJobs: %v", err)
	}

	page := mustGet(t, a, status, http.StatusOK, cookies).Body.String()
	if !strings.Contains(page, download) {
		t.Errorf("the status page no longer offers the download it is still serving:\n%s", page)
	}
	if strings.Contains(page, "expired") {
		t.Errorf("the status page says the export expired while the file still downloads:\n%s", page)
	}
	fragment := mustGet(t, a, status+"/fragment", http.StatusOK, cookies).Body.String()
	if !strings.Contains(fragment, download) {
		t.Errorf("the polled fragment no longer offers the download:\n%s", fragment)
	}

	// And the file itself, which is what the page is promising.
	rec := mustGet(t, a, download, http.StatusOK, cookies)
	if !strings.HasPrefix(rec.Body.String(), "%PDF-") {
		t.Errorf("the download stopped being a PDF once the job record went")
	}

	// The API's status twin says the same: done, not expired, and not
	// a 404 that would read as "no such job". Its owner is the agent's
	// operator, which is the person who started this export.
	token := mintAgent(t, a, cookies, "claude")
	apiStatus := "/api/v1/decks/" + sqidOf(deck) + "/export/" +
		strings.TrimPrefix(status, deck+"/export/")
	out := apiJSON(t, a, http.MethodGet, apiStatus, token, "", http.StatusOK)
	if out["state"] != "done" {
		t.Errorf("the API status is %v, want done", out["state"])
	}
	if _, expired := out["expired"]; expired {
		t.Errorf("the API says the export expired while the file still downloads: %v", out)
	}
}

// TestExportRefusesWhenOverTheHeldCap: with no object store, the
// finished PDF is held in this process, and that is bounded. Over the
// cap the job fails with a sentence the owner can act on, and nothing
// is held.
func TestExportRefusesWhenOverTheHeldCap(t *testing.T) {
	a := newApp(t)
	// A cap of one byte: every real export is over it, and none of
	// them has to be big to prove the rule.
	a.app.SetExportCaps(1, 1)
	cookies := signedIn(t, a, allowedAddress)
	deck := sampleDeck(t, a, cookies)

	status := startExport(t, a, deck, cookies, nil)
	fragment := waitForExport(t, a, status, cookies)
	if !strings.Contains(fragment, "larger than we can hold") {
		t.Errorf("a refused export does not say why:\n%s", fragment)
	}
	// And the file is not there — a job that failed holds nothing.
	if rec := get(t, a, status+".pdf", cookies...); rec.Code != http.StatusNotFound {
		t.Errorf("GET the pdf of a failed export: status %d, want 404", rec.Code)
	}
}

// TestExportGoesToTheStoreWhenThereIsOne: with a bucket bound, the
// bytes belong in it and not in this process. A store that can presign
// hands the browser a URL of its own; one that cannot — blobs.Dir, in
// development — is streamed back through the same route, so the page
// works either way.
func TestExportGoesToTheStoreWhenThereIsOne(t *testing.T) {
	dir := dirStore(t)
	a := newAppWithStore(t, dir)
	// A cap of one byte, which the held-bytes path would refuse: with
	// a store there is nothing held, so this is also the proof that
	// the upload path really is the one being taken.
	a.app.SetExportCaps(1, 1)
	cookies := signedIn(t, a, allowedAddress)
	deck := sampleDeck(t, a, cookies)

	status := startExport(t, a, deck, cookies, nil)
	fragment := waitForExport(t, a, status, cookies)
	if strings.Contains(fragment, "rst-tone=\"negative\"") {
		t.Fatalf("the export failed:\n%s", fragment)
	}
	rec := mustGet(t, a, status+".pdf", http.StatusOK, cookies)
	if !strings.HasPrefix(rec.Body.String(), "%PDF-") {
		t.Errorf("the streamed export is not a PDF")
	}

	// The same deck through a store that presigns: a redirect, and the
	// bytes never come through this process at all.
	presigning := &presigningStore{Store: dirStore(t)}
	b := newAppWithStore(t, presigning)
	bCookies := signedIn(t, b, allowedAddress)
	bDeck := sampleDeck(t, b, bCookies)
	bStatus := startExport(t, b, bDeck, bCookies, nil)
	waitForExport(t, b, bStatus, bCookies)
	redirect := get(t, b, bStatus+".pdf", bCookies...)
	if redirect.Code != http.StatusFound {
		t.Fatalf("GET the pdf with a presigning store: status %d, want 302\n%s", redirect.Code, redirect.Body)
	}
	if loc := redirect.Header().Get("Location"); !strings.HasPrefix(loc, "https://bucket.test/") {
		t.Errorf("Location = %q, want the presigned GET", loc)
	}
}

// TestExportPdfIsOwnersOnly: an export belongs to the person who
// started it. Somebody else — even somebody who can read the same deck
// — gets the same 404 a stranger gets, because a job id is a
// capability and a wrong owner must be indistinguishable from a wrong
// id.
func TestExportPdfIsOwnersOnly(t *testing.T) {
	a := newSharedApp(t)
	mine := signedIn(t, a, allowedAddress)
	theirs := signedIn(t, a, otherAddress)

	deck := createDeck(t, a, mine, "Shared with the team")
	// On the team rung, so the other person can read it and could
	// start an export of their own.
	rec := post(t, a, deck+"/settings", url.Values{
		"title": {"Shared with the team"}, "theme": {"ink"}, "rung": {"team"},
	}, mine...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST %s/settings: status %d\n%s", deck, rec.Code, rec.Body)
	}
	mustGet(t, a, deck, http.StatusOK, theirs)

	status := startExport(t, a, deck, mine, nil)
	waitForExport(t, a, status, mine)

	for _, path := range []string{status, status + ".pdf", status + "/fragment"} {
		if rec := get(t, a, path, theirs...); rec.Code != http.StatusNotFound {
			t.Errorf("GET %s as the other person: status %d, want 404", path, rec.Code)
		}
	}
	// Signed out, it is not even a page.
	if rec := get(t, a, status+".pdf"); rec.Code != http.StatusSeeOther {
		t.Errorf("GET the pdf signed out: status %d, want a redirect to sign in", rec.Code)
	}
}

// TestExportRefusesADeckOverTheSlideCap: 200 slides is the most one
// PDF will take (spec §4.3), and the refusal happens on the form
// BEFORE a goroutine is started — a person is told, not shown a failed
// job.
func TestExportRefusesADeckOverTheSlideCap(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "filler")
	deck := createDeck(t, a, cookies, "Too many slides")
	sqid := sqidOf(deck)

	// 201 slides in one batch through the API: the fastest way to a
	// deck of this size, and the same op path a person's editor uses.
	ops := make([]map[string]any, 0, 201)
	for i := 0; i < 201; i++ {
		ops = append(ops, map[string]any{"op": "add_slide", "layout": "flow", "template": "section"})
	}
	body, err := json.Marshal(map[string]any{"ops": ops})
	if err != nil {
		t.Fatal(err)
	}
	apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token, string(body), http.StatusOK)

	rec := post(t, a, deck+"/export", nil, cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST %s/export: status %d, want 303\n%s", deck, rec.Code, rec.Body)
	}
	if loc := rec.Header().Get("Location"); loc != deck+"/export" {
		t.Errorf("a refused export redirected to %q, want the form at %q", loc, deck+"/export")
	}
	// The reason travels in a flash cookie and is on the form.
	form := mustGet(t, a, deck+"/export", http.StatusOK, append(cookies, flashCookie(t, rec))).Body.String()
	if !strings.Contains(form, "more than 200 slides") {
		t.Errorf("the form does not say why the export was refused:\n%s", form)
	}
}

// flashCookie picks the flash out of a response, so the next request in
// a test carries it exactly as a browser would.
func flashCookie(t *testing.T, rec *httptest.ResponseRecorder) *http.Cookie {
	t.Helper()
	for _, c := range rec.Result().Cookies() {
		if c.Name == "rastrillo_flash" {
			return c
		}
	}
	t.Fatal("no flash cookie on the refusal")
	return nil
}

// TestExportAPITwins: the same export, driven by an agent. 202 with
// somewhere to poll, a status document, and the bytes at the end.
func TestExportAPITwins(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := sqidOf(sampleDeck(t, a, cookies))

	started := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/export", token,
		`{"notes": false}`, http.StatusAccepted)
	job, _ := started["job"].(string)
	statusURL, _ := started["status_url"].(string)
	pdfURL, _ := started["pdf_url"].(string)
	if job == "" || statusURL == "" || pdfURL == "" {
		t.Fatalf("POST export: %v, want job, status_url and pdf_url", started)
	}
	if want := fmt.Sprintf("/api/v1/decks/%s/export/%s", sqid, job); statusURL != want {
		t.Errorf("status_url = %q, want %q", statusURL, want)
	}

	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
	defer cancel()
	var state string
	for state != "done" {
		body := apiJSON(t, a, http.MethodGet, statusURL, token, "", http.StatusOK)
		state, _ = body["state"].(string)
		if state == "failed" {
			t.Fatalf("the export failed: %v", body)
		}
		if state == "done" {
			if _, has := body["warnings"]; !has {
				t.Errorf("a finished export reports no warnings key: %v", body)
			}
			break
		}
		select {
		case <-ctx.Done():
			t.Fatalf("the export was still %q after two minutes", state)
		case <-time.After(50 * time.Millisecond):
		}
	}

	req := httptest.NewRequest(http.MethodGet, pdfURL, nil)
	req.Header.Set("Authorization", "Bearer "+token)
	rec := httptest.NewRecorder()
	a.ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("GET %s: status %d\n%s", pdfURL, rec.Code, rec.Body)
	}
	if !strings.HasPrefix(rec.Body.String(), "%PDF-") {
		t.Errorf("the API's download is not a PDF")
	}
	if got := rec.Header().Get("Content-Type"); got != "application/pdf" {
		t.Errorf("Content-Type = %q", got)
	}

	// A token that is not one of this instance's is not a way in.
	if body := apiJSON(t, a, http.MethodGet, statusURL, "sl_"+strings.Repeat("x", 40), "", http.StatusUnauthorized); body["error"] != "unauthorized" {
		t.Errorf("a bad token: %v", body)
	}
}