package slidestest

import (
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"net/url"
	"regexp"
	"strings"
	"testing"
)

// newToken finds the token the share page was redirected with. It is
// shown once, in the query string of that one redirect, and nowhere
// else ever again.
var newToken = regexp.MustCompile(`\?new=([A-Za-z0-9_-]{43})`)

// revokeAction finds a link row's revoke form on the share page.
var revokeAction = regexp.MustCompile(`/share/(\d+)/revoke`)

// mintShareLink posts the create form on a deck's share page and
// returns the token it was shown once.
func mintShareLink(t *testing.T, a *testApp, deckPath string, cookies []*http.Cookie) string {
	t.Helper()
	rec := post(t, a, deckPath+"/share", nil, cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST %s/share: status %d, want 303\n%s", deckPath, rec.Code, rec.Body)
	}
	loc := rec.Header().Get("Location")
	m := newToken.FindStringSubmatch(loc)
	if m == nil {
		t.Fatalf("POST %s/share: Location = %q, carries no new token", deckPath, loc)
	}
	return m[1]
}

// TestShareLinkShownOnceAndOpensViewer: minting shows the URL once,
// coming back never shows it again, and the URL itself opens the deck
// for somebody with no session at all.
func TestShareLinkShownOnceAndOpensViewer(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Board update")

	empty := mustGet(t, a, path+"/share", http.StatusOK, cookies).Body.String()
	if !strings.Contains(empty, "No share links") {
		t.Errorf("a deck with no share links does not say so:\n%s", empty)
	}

	token := mintShareLink(t, a, path, cookies)

	shown := mustGet(t, a, path+"/share?new="+token, http.StatusOK, cookies).Body.String()
	full := testOrigin + "/s/" + token
	if !strings.Contains(shown, full) {
		t.Errorf("the share page does not show the new link %q:\n%s", full, shown)
	}
	if !strings.Contains(shown, "readonly") {
		t.Errorf("the new link is not in a read-only field:\n%s", shown)
	}

	// Come back for it and it is gone: only the hash was stored, so
	// there is nothing left to show.
	again := mustGet(t, a, path+"/share", http.StatusOK, cookies).Body.String()
	if strings.Contains(again, token) {
		t.Errorf("the share page shows the token a second time:\n%s", again)
	}

	// No cookies at all: the link is the whole capability.
	page := mustGet(t, a, "/s/"+token, http.StatusOK, nil).Body.String()
	if !strings.Contains(page, "Board update") {
		t.Errorf("the share link does not open the deck:\n%s", page)
	}
	if !strings.Contains(page, "<section slides-slide") {
		t.Errorf("the share link renders no slide:\n%s", page)
	}
	// It is the same paged viewer, and the same phone preview.
	mustGet(t, a, "/s/"+token+"?slide=1", http.StatusOK, nil)
	mustGet(t, a, "/s/"+token+"?slide=2", http.StatusNotFound, nil)
	phone := mustGet(t, a, "/s/"+token+"?vp=phone", http.StatusOK, nil).Body.String()
	if !strings.Contains(phone, `data-vp="phone"`) {
		t.Errorf("the share link ignores ?vp=phone:\n%s", phone)
	}
	// ?present=1 is the same capability with the chrome taken off.
	present := mustGet(t, a, "/s/"+token+"?present=1", http.StatusOK, nil).Body.String()
	if !strings.Contains(present, "slides-present") {
		t.Errorf("?present=1 does not render the presenting surface:\n%s", present)
	}

	// A token nobody ever minted is not a different answer.
	mustGet(t, a, "/s/"+strings.Repeat("a", 43), http.StatusNotFound, nil)

	// The views are counted, and the share page says how many.
	counted := mustGet(t, a, path+"/share", http.StatusOK, cookies).Body.String()
	if !strings.Contains(counted, "5 views") {
		t.Errorf("the share page does not count the five views taken above:\n%s", counted)
	}
}

// TestRevokedShareLinkIs404: revoking turns the URL off, and a revoked
// link is not told apart from one that never existed.
func TestRevokedShareLinkIs404(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Board update")

	token := mintShareLink(t, a, path, cookies)
	mustGet(t, a, "/s/"+token, http.StatusOK, nil)

	page := mustGet(t, a, path+"/share", http.StatusOK, cookies).Body.String()
	m := revokeAction.FindStringSubmatch(page)
	if m == nil {
		t.Fatalf("the share page carries no revoke form:\n%s", page)
	}
	if rec := post(t, a, path+"/share/"+m[1]+"/revoke", nil, cookies...); rec.Code != http.StatusSeeOther {
		t.Fatalf("POST revoke: status %d, want 303\n%s", rec.Code, rec.Body)
	}

	mustGet(t, a, "/s/"+token, http.StatusNotFound, nil)

	// The row stays, so the page can still say the link existed and
	// that it is off.
	after := mustGet(t, a, path+"/share", http.StatusOK, cookies).Body.String()
	if !strings.Contains(after, "Revoked") {
		t.Errorf("the share page does not say the link is revoked:\n%s", after)
	}

	// Revoking twice is what a double-clicked button does, and the URL
	// is off either way: it is not an error page.
	if rec := post(t, a, path+"/share/"+m[1]+"/revoke", nil, cookies...); rec.Code != http.StatusSeeOther {
		t.Errorf("revoking twice: status %d, want 303", rec.Code)
	}
	// An id that is not this deck's link is a row that does not exist.
	if rec := post(t, a, path+"/share/99999/revoke", nil, cookies...); rec.Code != http.StatusNotFound {
		t.Errorf("revoking an unknown link: status %d, want 404", rec.Code)
	}
}

// TestShareLinkStoresOnlyHash: the table holds a fingerprint, never the
// URL. A plaintext token here would be a live, unauthenticated read
// capability sitting in a file that gets backed up.
func TestShareLinkStoresOnlyHash(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Board update")

	token := mintShareLink(t, a, path, cookies)

	// Every column of the row concatenated, so this is an assertion
	// about the whole row rather than about the one column that was
	// remembered to be checked.
	var whole []string
	err := a.db.G.Raw(`SELECT COALESCE(id,'') || COALESCE(deck_id,'') || COALESCE(token_hash,'') ||
		COALESCE(actor,'') || COALESCE(views,'') || COALESCE(created_at,'') || COALESCE(revoked_at,'')
		FROM share_links`).Scan(&whole).Error
	if err != nil {
		t.Fatalf("read share_links: %v", err)
	}
	if len(whole) != 1 {
		t.Fatalf("share_links holds %d rows, want 1", len(whole))
	}
	if strings.Contains(whole[0], token) {
		t.Errorf("share_links holds the plaintext token: %s", whole[0])
	}

	var stored struct {
		TokenHash string
		Actor     string
	}
	if err := a.db.G.Raw("SELECT token_hash, actor FROM share_links").Scan(&stored).Error; err != nil {
		t.Fatalf("read share_links: %v", err)
	}
	sum := sha256.Sum256([]byte(token))
	if want := hex.EncodeToString(sum[:]); stored.TokenHash != want {
		t.Errorf("share_links.token_hash = %q, want the SHA-256 hex %s", stored.TokenHash, want)
	}
	if stored.Actor == "" {
		t.Errorf("share_links.actor is empty: every write records an actor")
	}
}

// TestShareLinkHidesNotes: a share link is read-only and it is not a
// way into the speaker notes, the settings or the share page itself.
func TestShareLinkHidesNotes(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)

	// The same deck, signed in, does show them — otherwise this test
	// would pass over a viewer that renders no notes to anybody.
	signedInPage := mustGet(t, a, path+"?slide=2", http.StatusOK, cookies).Body.String()
	if !strings.Contains(signedInPage, "template. Text arrives as a small Markdown subset") {
		t.Fatalf("the signed-in viewer shows no notes to compare against:\n%s", signedInPage)
	}

	token := mintShareLink(t, a, path, cookies)
	page := mustGet(t, a, "/s/"+token+"?slide=2", http.StatusOK, nil).Body.String()

	if strings.Contains(page, "template. Text arrives as a small Markdown subset") {
		t.Errorf("the share link leaks the speaker notes:\n%s", page)
	}
	if strings.Contains(page, "Speaker notes") {
		t.Errorf("the share link offers the notes:\n%s", page)
	}
	if strings.Contains(page, "/settings") || strings.Contains(page, "/share") {
		t.Errorf("the share link offers the owner's screens:\n%s", page)
	}
	if strings.Contains(page, "/notes") {
		t.Errorf("the share link offers the notes page:\n%s", page)
	}
	// The deck itself is still not readable without the link: a
	// signed-out request for it is sent to sign in.
	mustGet(t, a, path, http.StatusSeeOther, nil)
}

// TestShareIsTheOwnersAlone: a team member can read the deck and still
// cannot mint, list or revoke a link on it.
func TestShareIsTheOwnersAlone(t *testing.T) {
	a := newSharedApp(t)
	mine := signedIn(t, a, allowedAddress)
	theirs := signedIn(t, a, otherAddress)

	path := createDeck(t, a, mine, "All hands")
	if rec := post(t, a, path+"/settings", url.Values{
		"title": {"All hands"}, "theme": {"ink"}, "rung": {"team"},
	}, mine...); rec.Code != http.StatusSeeOther {
		t.Fatalf("raising the rung: status %d\n%s", rec.Code, rec.Body)
	}
	mustGet(t, a, path, http.StatusOK, theirs)

	mustGet(t, a, path+"/share", http.StatusNotFound, theirs)
	if rec := post(t, a, path+"/share", nil, theirs...); rec.Code != http.StatusNotFound {
		t.Errorf("POST %s/share as a member: status %d, want 404", path, rec.Code)
	}

	token := mintShareLink(t, a, path, mine)
	page := mustGet(t, a, path+"/share", http.StatusOK, mine).Body.String()
	m := revokeAction.FindStringSubmatch(page)
	if m == nil {
		t.Fatalf("no revoke form:\n%s", page)
	}
	if rec := post(t, a, path+"/share/"+m[1]+"/revoke", nil, theirs...); rec.Code != http.StatusNotFound {
		t.Errorf("revoke as a member: status %d, want 404", rec.Code)
	}
	mustGet(t, a, "/s/"+token, http.StatusOK, nil)
}