package slidestest

import (
	"net/http"
	"net/url"
	"strings"
	"testing"

	slides "amadan.net/oficina/slides/internal/slides"
)

// TestSignedOutIsRedirectedToSignin: "/" is behind the session gate,
// and a signed-out page request lands on the sign-in page rather than
// on an empty screen or a bare 403.
func TestSignedOutIsRedirectedToSignin(t *testing.T) {
	rec := get(t, newApp(t), "/")
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("GET / signed out: status %d, want %d", rec.Code, http.StatusSeeOther)
	}
	if loc := rec.Header().Get("Location"); !strings.HasPrefix(loc, "/signin") {
		t.Errorf("GET / signed out: Location = %q, want a redirect to /signin", loc)
	}
}

// TestSigninPageIsPublic: the front door has to be reachable signed
// out, or nobody could ever get in.
func TestSigninPageIsPublic(t *testing.T) {
	rec := get(t, newApp(t), "/signin")
	if rec.Code != http.StatusOK {
		t.Fatalf("GET /signin signed out: status %d, want 200", rec.Code)
	}
	body := rec.Body.String()
	if !strings.Contains(body, `name="address"`) {
		t.Errorf("GET /signin: no address field in the form:\n%s", body)
	}
	// A real <label> bound to the input, not a placeholder standing in
	// for one — the guarantee the vendored field-text partial carries,
	// pinned here so a future hand-rolled input cannot quietly drop it.
	if !strings.Contains(body, `for="estilo-signin-address"`) {
		t.Errorf("GET /signin: the address field has no bound <label>:\n%s", body)
	}
	// The catalog resolved, rather than the key leaking onto the page.
	if !strings.Contains(body, "Sign in") {
		t.Errorf("GET /signin: page does not carry its translated title:\n%s", body)
	}
	if strings.Contains(body, "slides.signin.") {
		t.Errorf("GET /signin: a catalog key leaked onto the page unresolved:\n%s", body)
	}
}

// TestSigninMailsAllowedAddressOnly is the allowlist's whole point: an
// address nobody put on the list never causes this instance's sending
// identity to mail anything at all — and it cannot tell that it did
// not, because the two responses are identical (anything else would be
// a membership oracle on an unauthenticated endpoint).
func TestSigninMailsAllowedAddressOnly(t *testing.T) {
	app := newApp(t)

	allowed := post(t, app, "/signin", url.Values{"address": {allowedAddress}})
	if allowed.Code != http.StatusSeeOther {
		t.Fatalf("POST /signin (allowed): status %d, want %d", allowed.Code, http.StatusSeeOther)
	}
	if loc := allowed.Header().Get("Location"); loc != "/signin?sent=1" {
		t.Errorf("POST /signin (allowed): Location = %q, want %q", loc, "/signin?sent=1")
	}
	if n := len(app.mailer.messages()); n != 1 {
		t.Fatalf("POST /signin (allowed): mailer captured %d messages, want 1", n)
	}
	if to := app.mailer.messages()[0].To; to != allowedAddress {
		t.Errorf("mailed to %q, want %q", to, allowedAddress)
	}

	denied := post(t, app, "/signin", url.Values{"address": {deniedAddress}})
	if denied.Code != allowed.Code {
		t.Errorf("POST /signin (denied): status %d, want %d — identical to the permitted answer", denied.Code, allowed.Code)
	}
	if got, want := denied.Header().Get("Location"), allowed.Header().Get("Location"); got != want {
		t.Errorf("POST /signin (denied): Location = %q, want %q — identical to the permitted answer", got, want)
	}
	// Byte-for-byte, not merely "both are 303": any observable
	// difference at all would let someone enumerate the allowlist.
	if got, want := denied.Body.String(), allowed.Body.String(); got != want {
		t.Errorf("POST /signin (denied): body %q, want %q — identical to the permitted answer", got, want)
	}
	if n := len(app.mailer.messages()); n != 1 {
		t.Errorf("POST /signin (denied): mailer captured %d messages, want the 1 from the permitted address alone", n)
	}
}

// TestSigninAnswerIsIdenticalOverTheRateLimitBudget is the sharp end of
// the no-oracle guarantee, and the case the first version of gateBegin
// got wrong.
//
// That version short-circuited a denied address before rastrillo/auth's
// Begin, so it answered ?sent=1 forever, while a permitted address
// reached Begin's per-address budget of 5 and got ?err=rate: six POSTs
// of one candidate address separated "on the list" from "not on it".
// Every address reaches Begin now (gateBegin), so the budgets are the
// same for both; sameAnswer still answers ?err=rate as sent, and this
// pins that.
//
// Seven POSTs, every one byte-identical to what a denied address gets.
// The mailer stops at 5, which is the other half of the proof: the
// answers are the same because the failure is hidden, not because the
// budget quietly stopped being enforced.
func TestSigninAnswerIsIdenticalOverTheRateLimitBudget(t *testing.T) {
	app := newApp(t)

	denied := post(t, app, "/signin", url.Values{"address": {deniedAddress}})
	if denied.Code != http.StatusSeeOther {
		t.Fatalf("POST /signin (denied): status %d, want %d", denied.Code, http.StatusSeeOther)
	}
	wantLoc := denied.Header().Get("Location")
	wantBody := denied.Body.String()
	if wantLoc != "/signin?sent=1" {
		t.Fatalf("POST /signin (denied): Location = %q, want %q", wantLoc, "/signin?sent=1")
	}

	const attempts = 7
	for i := 1; i <= attempts; i++ {
		rec := post(t, app, "/signin", url.Values{"address": {allowedAddress}})
		if rec.Code != denied.Code {
			t.Errorf("POST /signin (allowed, attempt %d): status %d, want %d — identical to a denied address", i, rec.Code, denied.Code)
		}
		if got := rec.Header().Get("Location"); got != wantLoc {
			t.Errorf("POST /signin (allowed, attempt %d): Location = %q, want %q — identical to a denied address", i, got, wantLoc)
		}
		if got := rec.Body.String(); got != wantBody {
			t.Errorf("POST /signin (allowed, attempt %d): body %q, want %q — identical to a denied address", i, got, wantBody)
		}
	}

	// signin's per-address budget is 5; the two attempts past it are
	// the ones whose ?err=rate the guard rewrote.
	if n := len(app.mailer.messages()); n != 5 {
		t.Errorf("mailer captured %d messages over %d attempts, want the 5 the per-address budget allows", n, attempts)
	}
}

// TestSigninAcceptsALegacyOriginOnlyPost covers the path a
// Sec-Fetch-Site header hides: csrf.Protect checks that header first
// when a browser sends it, and only falls back to comparing Origin
// against the app's configured origin when it is absent entirely — a
// non-browser client, or an old one. The post helper sends both, so
// without this test the Origin half of the app's config would never be
// exercised at all, and a wrong resolved origin would pass the suite.
//
// It is also the one test that observes the RESOLVED origin from
// outside the package: the app was configured with testOrigin, and this
// is what proves that string is what csrf.Protect is holding requests
// to.
func TestSigninAcceptsALegacyOriginOnlyPost(t *testing.T) {
	app := newApp(t)

	ok := postLegacy(t, app, "/signin", testOrigin, url.Values{"address": {allowedAddress}})
	if ok.Code != http.StatusSeeOther {
		t.Errorf("POST /signin with Origin %q and no Sec-Fetch-Site: status %d, want %d", testOrigin, ok.Code, http.StatusSeeOther)
	}
	if n := len(app.mailer.messages()); n != 1 {
		t.Errorf("a same-origin legacy POST mailed %d links, want 1", n)
	}

	refused := postLegacy(t, app, "/signin", "http://evil.test", url.Values{"address": {allowedAddress}})
	if refused.Code == http.StatusSeeOther {
		t.Errorf("POST /signin with Origin %q and no Sec-Fetch-Site: status %d, want a refusal", "http://evil.test", refused.Code)
	}
	if n := len(app.mailer.messages()); n != 1 {
		t.Errorf("a cross-origin POST mailed a link; mailer has %d messages, want the 1 from the same-origin post", n)
	}
}

// TestVerifyMintsSessionAndUserRow: following the emailed link both
// establishes a usable session and creates this app's own person row —
// the address-to-id mapping every later owner-scoped query needs, since
// under rastrillo/auth the session Subject is the email, not a user id.
func TestVerifyMintsSessionAndUserRow(t *testing.T) {
	app := newApp(t)
	cookies := signedIn(t, app, allowedAddress)

	rec := get(t, app, "/", cookies...)
	if rec.Code != http.StatusOK {
		t.Fatalf("GET / signed in: status %d, want 200", rec.Code)
	}

	var users []slides.User
	if err := app.db.G.Find(&users).Error; err != nil {
		t.Fatalf("read users: %v", err)
	}
	if len(users) != 1 {
		t.Fatalf("users table has %d rows, want 1: %+v", len(users), users)
	}
	if users[0].Email != allowedAddress {
		t.Errorf("users[0].Email = %q, want %q", users[0].Email, allowedAddress)
	}
	if users[0].ID == 0 {
		t.Error("users[0].ID is 0; the row was never assigned an id")
	}
}

// TestSecondSignInReusesTheUserRow: the row is created once, on first
// sign-in, not on every request that reads it.
func TestSecondSignInReusesTheUserRow(t *testing.T) {
	app := newApp(t)

	first := signedIn(t, app, allowedAddress)
	if rec := get(t, app, "/", first...); rec.Code != http.StatusOK {
		t.Fatalf("GET / after first sign-in: status %d, want 200", rec.Code)
	}
	second := signedIn(t, app, allowedAddress)
	if rec := get(t, app, "/", second...); rec.Code != http.StatusOK {
		t.Fatalf("GET / after second sign-in: status %d, want 200", rec.Code)
	}

	var users []slides.User
	if err := app.db.G.Find(&users).Error; err != nil {
		t.Fatalf("read users: %v", err)
	}
	if len(users) != 1 {
		t.Fatalf("users table has %d rows after two sign-ins, want 1: %+v", len(users), users)
	}
}

// TestSignoutEndsTheSession: sign-out is real revocation, so the
// signed-in screen goes back to being a redirect.
func TestSignoutEndsTheSession(t *testing.T) {
	app := newApp(t)
	cookies := signedIn(t, app, allowedAddress)

	if rec := post(t, app, "/signout", url.Values{}, cookies...); rec.Code != http.StatusSeeOther {
		t.Fatalf("POST /signout: status %d, want %d", rec.Code, http.StatusSeeOther)
	}
	rec := get(t, app, "/", cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Errorf("GET / after sign-out: status %d, want %d", rec.Code, http.StatusSeeOther)
	}
}

// TestDevelopmentDefaultsRefusedInProduction: each of the four
// settings that decide whether sign-in is safe refuses to start when it
// is missing and Env is not "development". A missing one must never
// silently take a development fallback in a deployment — the whole
// fail-closed story, one subtest per setting so a regression names
// which one.
func TestDevelopmentDefaultsRefusedInProduction(t *testing.T) {
	for _, tc := range []struct {
		name string
		bend func(cfg *slides.Config)
	}{
		{"InstanceKey", func(cfg *slides.Config) { cfg.InstanceKey = "" }},
		{"Origin", func(cfg *slides.Config) { cfg.Origin = "" }},
		{"Mailer", func(cfg *slides.Config) { cfg.Mailer = nil }},
		{"AllowedAddresses", func(cfg *slides.Config) { cfg.AllowedAddresses = nil }},
	} {
		t.Run(tc.name, func(t *testing.T) {
			cfg, _ := newConfig(t)
			cfg.Env = "production"
			tc.bend(&cfg)
			if _, _, err := slides.New(openTestDB(t, cfg), cfg); err == nil {
				t.Fatalf("slides.New with an empty %s and Env %q returned no error; want a startup refusal", tc.name, cfg.Env)
			}
		})
	}
}

// TestDevelopmentDefaultsAllowedInDevelopment is the other half of the
// same rule: the one Env that may default does, so scripts/run-dev.sh
// needs no setup at all.
func TestDevelopmentDefaultsAllowedInDevelopment(t *testing.T) {
	cfg, _ := newConfig(t)
	cfg.Env = "development"
	cfg.InstanceKey = ""
	cfg.Origin = ""
	cfg.Mailer = nil
	cfg.AllowedAddresses = nil
	_, a, err := slides.New(openTestDB(t, cfg), cfg)
	if err != nil {
		t.Fatalf("slides.New with an empty config and Env %q: %v", cfg.Env, err)
	}
	t.Cleanup(func() { a.Close() })
}