package main

import (
	"context"
	"crypto/ecdh"
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"strings"
	"testing"

	"amadan.net/rastrillo/rastrillo/db"
	"amadan.net/rastrillo/rastrillo/migrate"
	"amadan.net/rastrillo/rastrillo/sessions"

	"amadan.net/rastrillo/aviso"
)

func newApp(t *testing.T) (http.Handler, *aviso.Service) {
	t.Helper()
	d, err := db.Open(filepath.Join(t.TempDir(), "example.db"), nil)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { d.Close() })
	if _, err := migrate.Apply(context.Background(), d, migrate.Merge(sessions.Schema, aviso.Schema)); err != nil {
		t.Fatal(err)
	}
	key, _ := aviso.GenerateKey()
	svc, err := aviso.New(aviso.Config{DB: d.Writer(), PrivateKey: key, Contact: "mailto:ops@example.test", Origin: "http://localhost:8080"})
	if err != nil {
		t.Fatal(err)
	}
	return handler(svc, "http://localhost:8080"), svc
}

func get(t *testing.T, h http.Handler, path string) *httptest.ResponseRecorder {
	t.Helper()
	w := httptest.NewRecorder()
	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
	return w
}

// Every seam answers: the page, the two embedded JS files, the
// worker at root scope, the key, and a subscribe that lands as "dev".
func TestEverySeamIsWired(t *testing.T) {
	h, svc := newApp(t)
	for path, want := range map[string]string{
		"/":                            "<button id=\"enable\"",
		"/static/app.js":               "import { enable",
		"/static/aviso/push.mjs":       "export async function enable(",
		"/static/aviso/aviso-sw.js":    "AvisoSW",
		"/sw.js":                       "importScripts(\"/static/aviso/aviso-sw.js\")",
		"/aviso/public-key":            "publicKey",
		"/static/manifest.webmanifest": "/static/icon-512.png",
	} {
		w := get(t, h, path)
		if w.Code != http.StatusOK || !strings.Contains(w.Body.String(), want) {
			t.Errorf("%s: %d, body lacks %q", path, w.Code, want)
		}
	}
	if cc := get(t, h, "/sw.js").Header().Get("Cache-Control"); cc != "no-cache" {
		t.Errorf("sw.js Cache-Control = %q", cc)
	}
	// A module or worker script served as text/plain is refused by the
	// browser; the example must model the right content type.
	for _, path := range []string{"/static/aviso/push.mjs", "/static/aviso/aviso-sw.js", "/sw.js", "/static/app.js"} {
		if ct := get(t, h, path).Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/javascript") {
			t.Errorf("%s Content-Type = %q", path, ct)
		}
	}
	// The installability recipe, modelled: manifest icons at 192 and
	// 512, an Apple touch icon at 180 linked from the page, and
	// buttons that start disabled until the page can act on a click.
	for _, path := range []string{"/static/icon-192.png", "/static/icon-512.png", "/static/icon-180.png"} {
		if w := get(t, h, path); w.Code != http.StatusOK || !strings.HasPrefix(w.Header().Get("Content-Type"), "image/png") {
			t.Errorf("%s: %d %q", path, w.Code, w.Header().Get("Content-Type"))
		}
	}
	page := get(t, h, "/").Body.String()
	for _, want := range []string{`rel="apple-touch-icon" href="/static/icon-180.png"`, `rel="manifest"`, `id="enable" disabled`, `id="notify" disabled`} {
		if !strings.Contains(page, want) {
			t.Errorf("index.html lacks %q", want)
		}
	}

	k, _ := ecdh.P256().GenerateKey(rand.Reader)
	auth := make([]byte, 16)
	_, _ = rand.Read(auth)
	body, _ := json.Marshal(map[string]any{
		"subscription": map[string]any{
			"endpoint": "https://push.example/dev-phone",
			"keys": map[string]string{
				"p256dh": base64.RawURLEncoding.EncodeToString(k.PublicKey().Bytes()),
				"auth":   base64.RawURLEncoding.EncodeToString(auth),
			},
		},
		"publicKey": svc.PublicKeyString(),
	})
	r := httptest.NewRequest(http.MethodPost, "/aviso/subscribe", strings.NewReader(string(body)))
	r.Header.Set("Content-Type", "application/json")
	r.Header.Set("Sec-Fetch-Site", "same-origin")
	w := httptest.NewRecorder()
	h.ServeHTTP(w, r)
	if w.Code != http.StatusNoContent {
		t.Fatalf("subscribe: %d %s", w.Code, w.Body)
	}
	rows, err := svc.List(context.Background(), "dev")
	if err != nil || len(rows) != 1 {
		t.Fatalf("rows for dev: %v %+v", err, rows)
	}

	// notify is gated like any state-changing POST.
	r = httptest.NewRequest(http.MethodPost, "/notify", nil)
	r.Header.Set("Sec-Fetch-Site", "cross-site")
	w = httptest.NewRecorder()
	h.ServeHTTP(w, r)
	if w.Code != http.StatusForbidden {
		t.Fatalf("cross-site notify: %d", w.Code)
	}
}