package authconfig

import (
	"bytes"
	"context"
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/aritmolab/thothii/tools/tht/internal/config"
)

func TestRunConfiguresLocalRegistryAndRedactsStatusJSON(t *testing.T) {
	directory := newAuthDirectory(t)
	passwordFile := writePasswordFile(t, "this is a local test password\n")
	installation := authInstallation(directory)

	var stdout, stderr bytes.Buffer
	if code := Run(context.Background(), installation, []string{
		"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080",
		"--admin-user", "admin", "--admin-display-name", "Local administrator", "--password-file", passwordFile,
	}, strings.NewReader(""), &stdout, &stderr); code != 0 {
		t.Fatalf("local configure = %d, stdout=%q stderr=%q", code, stdout.String(), stderr.String())
	}
	if stdout.Len() != 0 || stderr.Len() != 0 {
		t.Fatalf("local configure wrote machine output: stdout=%q stderr=%q", stdout.String(), stderr.String())
	}

	stdout.Reset()
	if code := Run(context.Background(), installation, []string{"status", "--json"}, strings.NewReader(""), &stdout, &stderr); code != 0 {
		t.Fatalf("status = %d, stderr=%q", code, stderr.String())
	}
	var status struct {
		Mode       string         `json:"mode"`
		PublicURL  string         `json:"publicUrl"`
		UserCounts map[string]int `json:"userCounts"`
		Revision   string         `json:"configRevision"`
	}
	if err := json.Unmarshal(stdout.Bytes(), &status); err != nil {
		t.Fatalf("status stdout is not pristine JSON: %q: %v", stdout.String(), err)
	}
	if status.Mode != "local" || status.PublicURL != "http://127.0.0.1:8080" || status.UserCounts["admin"] != 1 || status.Revision == "" {
		t.Fatalf("status = %#v", status)
	}
	if strings.Contains(stdout.String()+stderr.String(), "this is a local test password") || strings.Contains(stdout.String()+stderr.String(), "$argon2id$") {
		t.Fatalf("status exposed password material: stdout=%q stderr=%q", stdout.String(), stderr.String())
	}
}

func TestRunConfiguresOIDCFixedGroupsAndRefusesIdenticalGroups(t *testing.T) {
	for name, test := range map[string]struct {
		args     []string
		wantMode string
	}{
		"configured": {
			args:     []string{"configure", "--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://authentik.example.org/application/o/thothii/", "--client-id", "thothii", "--authentik-base-url", "https://authentik.example.org", "--user-group", "TOT Users", "--admin-group", "TOT Admin"},
			wantMode: "oidc",
		},
		"ambiguous groups": {
			args: []string{"configure", "--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://authentik.example.org/application/o/thothii/", "--client-id", "thothii", "--authentik-base-url", "https://authentik.example.org", "--user-group", "same", "--admin-group", "same"},
		},
	} {
		t.Run(name, func(t *testing.T) {
			directory := newAuthDirectory(t)
			var stdout, stderr bytes.Buffer
			code := Run(context.Background(), authInstallation(directory), test.args, strings.NewReader(""), &stdout, &stderr)
			if test.wantMode == "" {
				if code == 0 || strings.Contains(stdout.String()+stderr.String(), "same") && strings.Contains(stdout.String()+stderr.String(), "secret") {
					t.Fatalf("ambiguous groups accepted or exposed unsafe detail: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
				}
				return
			}
			if code != 0 {
				t.Fatalf("OIDC configure = %d, stdout=%q stderr=%q", code, stdout.String(), stderr.String())
			}
			config, _, err := Load(directory)
			if err != nil {
				t.Fatal(err)
			}
			if config.Mode != test.wantMode || config.Authorization.GroupRoles["TOT Users"][0] != RoleUser || config.Authorization.GroupRoles["TOT Admin"][0] != RoleAdmin {
				t.Fatalf("OIDC config = %#v", config)
			}
		})
	}
}

func TestRunMutatesLocalUsersAndPreservesLastAdministrator(t *testing.T) {
	directory := newAuthDirectory(t)
	installation := authInstallation(directory)
	adminPassword := writePasswordFile(t, "initial administrator password\n")
	userPassword := writePasswordFile(t, "ordinary user password one\n")
	if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", adminPassword}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
		t.Fatalf("configure = %d", code)
	}
	for _, args := range [][]string{
		{"user", "add", "operator", "--role", "user", "--display-name", "Operator", "--password-file", userPassword},
		{"user", "set-password", "operator", "--password-file", adminPassword},
		{"user", "grant", "operator", "--role", "admin"},
		{"user", "revoke", "operator", "--role", "admin"},
		{"user", "disable", "operator"},
		{"user", "enable", "operator"},
	} {
		var stdout, stderr bytes.Buffer
		if code := Run(context.Background(), installation, args, strings.NewReader(""), &stdout, &stderr); code != 0 {
			t.Fatalf("%v = %d stdout=%q stderr=%q", args, code, stdout.String(), stderr.String())
		}
		if strings.Contains(stdout.String()+stderr.String(), "initial administrator password") || strings.Contains(stdout.String()+stderr.String(), "$argon2id$") {
			t.Fatalf("%v exposed password material", args)
		}
	}
	var stdout, stderr bytes.Buffer
	if code := Run(context.Background(), installation, []string{"user", "disable", "admin"}, strings.NewReader(""), &stdout, &stderr); code == 0 {
		t.Fatal("last administrator disable succeeded")
	}
	if code := Run(context.Background(), installation, []string{"user", "revoke", "admin", "--role", "admin"}, strings.NewReader(""), &stdout, &stderr); code == 0 {
		t.Fatal("last administrator revoke succeeded")
	}
}

func TestRunLogoutAllIncrementsRevisionAndUserCommandsRefuseOIDC(t *testing.T) {
	directory := newAuthDirectory(t)
	installation := authInstallation(directory)
	passwordFile := writePasswordFile(t, "initial administrator password\n")
	if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
		t.Fatalf("configure = %d", code)
	}
	if code := Run(context.Background(), installation, []string{"user", "logout-all", "admin", "--yes"}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
		t.Fatalf("logout all = %d", code)
	}
	_, registry, err := Load(directory)
	if err != nil {
		t.Fatal(err)
	}
	if registry.Users[0].AuthRevision != 2 {
		t.Fatalf("logout-all revision = %d, want 2", registry.Users[0].AuthRevision)
	}

	oidcDirectory := newAuthDirectory(t)
	if code := Run(context.Background(), authInstallation(oidcDirectory), []string{"configure", "--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://authentik.example.org/application/o/thothii/", "--client-id", "thothii", "--authentik-base-url", "https://authentik.example.org", "--user-group", "TOT Users", "--admin-group", "TOT Admin"}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
		t.Fatalf("OIDC configure = %d", code)
	}
	if code := Run(context.Background(), authInstallation(oidcDirectory), []string{"user", "list", "--json"}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code == 0 {
		t.Fatal("OIDC user command succeeded")
	}
}

func TestRunRefusesNonTTYPasswordsWithoutPasswordFile(t *testing.T) {
	directory := newAuthDirectory(t)
	var stdout, stderr bytes.Buffer
	code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin"}, strings.NewReader("not a password source"), &stdout, &stderr)
	if code == 0 || !strings.Contains(stderr.String(), "--password-file") {
		t.Fatalf("non-TTY password source was accepted: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
	}
}

func writePasswordFile(t *testing.T, password string) string {
	t.Helper()
	path := filepath.Join(newAuthDirectory(t), "password")
	if err := os.Mkdir(filepath.Dir(path), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(path, []byte(password), 0o600); err != nil {
		t.Fatal(err)
	}
	return path
}

func authInstallation(directory string) config.Installation {
	installation := config.Installation{}
	installation.Authentication.ConfigDirectory = directory
	return installation
}

func newAuthDirectory(t *testing.T) string {
	t.Helper()
	root, err := filepath.EvalSymlinks(t.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	return filepath.Join(root, "auth")
}

type ioDiscard struct{}

func (ioDiscard) Write(contents []byte) (int, error) { return len(contents), nil }