package api

import (
	"io"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/ponzischeme89/memby/server/internal/config"
)

func TestAdminReleaseBuilderRelaysWithoutExposingToken(t *testing.T) {
	var receivedAuth string
	builder := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		receivedAuth = r.Header.Get("Authorization")
		if r.Method != http.MethodPost || r.URL.Path != "/v1/releases" {
			t.Fatalf("builder request = %s %s", r.Method, r.URL.Path)
		}
		body, _ := io.ReadAll(r.Body)
		if !strings.Contains(string(body), `"tag":"v0.2.64"`) || !strings.Contains(string(body), `"mandatory":true`) {
			t.Fatalf("builder body = %s", body)
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusAccepted)
		_, _ = io.WriteString(w, `{"state":"running","logs":[]}`)
	}))
	defer builder.Close()

	s := &Server{cfg: config.Config{ReleaseBuilderURL: builder.URL, ReleasePublishToken: "release-secret"}}
	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodPost, "/admin/api/release-builder",
		strings.NewReader(`{"tag":"v0.2.64","notes":"Living room polish","mandatory":true}`))
	s.handleAdminReleaseBuilderStart(recorder, request)

	if recorder.Code != http.StatusAccepted || receivedAuth != "Bearer release-secret" {
		t.Fatalf("response/auth = %d/%q", recorder.Code, receivedAuth)
	}
	if strings.Contains(recorder.Body.String(), "release-secret") {
		t.Fatal("release token was exposed to the browser")
	}
}

func TestAdminReleaseBuilderValidatesTagBeforeRelay(t *testing.T) {
	s := &Server{cfg: config.Config{ReleaseBuilderURL: "http://builder", ReleasePublishToken: "secret"}}
	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodPost, "/admin/api/release-builder",
		strings.NewReader(`{"tag":"latest; rm -rf /"}`))
	s.handleAdminReleaseBuilderStart(recorder, request)
	if recorder.Code != http.StatusBadRequest {
		t.Fatalf("invalid tag status = %d, want 400", recorder.Code)
	}
}

func TestAdminReleaseBuilderIsUnavailableWhenUnconfigured(t *testing.T) {
	s := &Server{}
	recorder := httptest.NewRecorder()
	s.handleAdminReleaseBuilderStatus(recorder, httptest.NewRequest(http.MethodGet, "/admin/api/release-builder", nil))
	if recorder.Code != http.StatusServiceUnavailable {
		t.Fatalf("unconfigured builder status = %d, want 503", recorder.Code)
	}
}