package web

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"

	"sourcecraft.dev/bigbes/sr-ht-spec/authn"
)

// /tokens is a signpost now. spec.sr.ht mints no credential of its own, so the
// page that used to mint, list and revoke one points at the daemon that does.
func TestTokensRedirectsToTokensSrHt(t *testing.T) {
	h, _ := testServer(t)

	for name, user := range map[string]string{
		"owner":     "bigbes",
		"anonymous": "",
	} {
		t.Run(name, func(t *testing.T) {
			rec := get(t, h, "/tokens", user)
			assert.Equal(t, http.StatusSeeOther, rec.Code, "body: %s", rec.Body)
			// The external origin, because this is for a browser, and the page
			// SPEC ch. 7 puts the token UI on.
			assert.Equal(t, ecoretest.Origin("tokens.sr.ht")+"/tokens", rec.Header().Get("Location"))
		})
	}
}

// The POST routes went with the table behind them: nothing here mints or
// revokes any more, and a form posted at the old address must not answer as
// though it might have worked. It is now csrf.Require that refuses them — the
// guard runs before routing, so a POST to an address this surface does not
// serve is refused rather than 404'd.
func TestTokensAcceptsNoWrites(t *testing.T) {
	h, _ := testServer(t)

	for _, target := range []string{"/tokens", "/tokens/1/revoke"} {
		t.Run(target, func(t *testing.T) {
			req := httptest.NewRequest(http.MethodPost, target, nil)
			login(req, "bigbes")
			rec := httptest.NewRecorder()
			h.ServeHTTP(rec, req)
			assert.NotEqual(t, http.StatusOK, rec.Code)
			assert.NotEqual(t, http.StatusSeeOther, rec.Code)
		})
	}
}

// An instance with no [tokens.sr.ht] section has nowhere to send anybody, and
// says so instead of redirecting to a URL built out of an empty string.
func TestTokensWithoutTheSectionSaysSo(t *testing.T) {
	srv, err := New(Options{
		Conf:     ecoretest.Config(authn.ConfigSection, ecoretest.Delete("tokens.sr.ht")),
		Reader:   newFakeReader(),
		Searcher: &fakeSearcher{},
		Resolver: testResolver(t),
	})
	require.NoError(t, err)

	req := httptest.NewRequest(http.MethodGet, "/tokens", nil)
	login(req, "bigbes")
	rec := httptest.NewRecorder()
	srv.Handler().ServeHTTP(rec, req)

	assert.Equal(t, http.StatusServiceUnavailable, rec.Code)
	assert.Empty(t, rec.Header().Get("Location"), "there is no origin to redirect to")
	assert.Contains(t, rec.Body.String(), "tokens.sr.ht")
}