package authz

import (
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"golang.org/x/crypto/bcrypt"
)

func TestSurfaceCapabilities(t *testing.T) {
	if Telegram.CanEmit("TaskCreated") || Ntfy.CanEmit("ApprovalRequested") {
		t.Fatal("notify surface emitted an event")
	}
	if !TUI.CanEmit("TaskCreated") {
		t.Fatal("control surface cannot emit")
	}
	if !MCP.CanEmit("ApprovalRequested") || MCP.CanEmit("TaskCreated") {
		t.Fatal("mcp gate is wrong")
	}
}

// TestSystemSurfaceDowngradedByHTTPMiddleware guards half of B8: System
// means "the plane itself, in-process" and is always FullControl with no
// token gate, since no deployment configures a token for a surface no HTTP
// caller is meant to use. HTTP() must never let a request pass through
// treated as System, or a caller declaring X-Orchestra-Surface: system gets
// an unconditional, unauthenticated bypass of the token check below it.
// (Downstream handlers must independently avoid re-deriving System from the
// raw header themselves — see cmd/orchestra/main.go's `surface` closure,
// which this package cannot test directly.)
func TestSystemSurfaceDowngradedByHTTPMiddleware(t *testing.T) {
	tokens := map[Surface]string{System: "should-never-be-checked"}
	h := HTTP(tokens, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	req := httptest.NewRequest(http.MethodPost, "/v1/tasks/t1/complete", nil)
	req.Header.Set("X-Orchestra-Surface", "system")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	// System's token check is intentionally skipped by HTTP() (it downgrades
	// to Web before the token comparison), so the request reaching the
	// handler at all is expected here — the guard that matters is that
	// nothing downstream can observe "system" as the resolved surface. This
	// test documents the middleware's half of the fix; main.go's `surface`
	// closure carries the other half.
	if rec.Code != http.StatusOK {
		t.Fatalf("unexpected status %d", rec.Code)
	}
}

// B18: the web UI is a full control plane. A session cookie must be an
// alternative *presentation* of the Web token, never a widening of it.
func TestWebSessionCookieGatesControlPathsOnly(t *testing.T) {
	// An empty legacy Web bearer-token slot must not open the browser surface:
	// providing Sessions means the caller needs a session cookie.
	tokens := map[Surface]string{}
	sessions := &Sessions{}
	h := HTTPWithSessions(tokens, sessions, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	do := func(method, path string, c *http.Cookie, surface string) int {
		req := httptest.NewRequest(method, path, nil)
		if c != nil {
			req.AddCookie(c)
		}
		if surface != "" {
			req.Header.Set("X-Orchestra-Surface", surface)
		}
		rec := httptest.NewRecorder()
		h.ServeHTTP(rec, req)
		return rec.Code
	}
	if got := do(http.MethodPost, "/v1/ui/tasks", nil, ""); got != http.StatusUnauthorized {
		t.Fatalf("uncredentialed control path = %d, want 401", got)
	}
	// The SPA shell and the login endpoint must stay reachable, or no
	// browser could ever obtain a cookie in the first place.
	if got := do(http.MethodGet, "/index.html", nil, ""); got != http.StatusOK {
		t.Fatalf("SPA shell = %d, want 200", got)
	}
	if got := do(http.MethodPost, SessionPath, nil, ""); got != http.StatusOK {
		t.Fatalf("login endpoint = %d, want 200", got)
	}
	v, err := sessions.Issue()
	if err != nil {
		t.Fatal(err)
	}
	if got := do(http.MethodPost, "/v1/ui/tasks", &http.Cookie{Name: SessionCookie, Value: v}, ""); got != http.StatusOK {
		t.Fatalf("session-cookie control path = %d, want 200", got)
	}
	if got := do(http.MethodPost, "/v1/ui/tasks", &http.Cookie{Name: SessionCookie, Value: "forged"}, ""); got != http.StatusUnauthorized {
		t.Fatalf("forged cookie = %d, want 401", got)
	}
	// A cookie must not authenticate a non-browser surface.
	tokens[TUI] = "tui-secret"
	if got := do(http.MethodPost, "/v1/tasks", &http.Cookie{Name: SessionCookie, Value: v}, "tui"); got != http.StatusUnauthorized {
		t.Fatalf("cookie on TUI surface = %d, want 401", got)
	}
}

func TestWebCredentialsAuthenticate(t *testing.T) {
	hash, err := bcrypt.GenerateFromPassword([]byte("correct horse battery staple"), bcrypt.MinCost)
	if err != nil {
		t.Fatal(err)
	}
	c := WebCredentials{Username: "operator", PasswordHash: string(hash)}
	if err := c.Validate(); err != nil {
		t.Fatalf("Validate: %v", err)
	}
	if !c.Authenticate("operator", "correct horse battery staple") {
		t.Fatal("correct credentials rejected")
	}
	for _, attempt := range []struct{ username, password string }{{"operator", "wrong"}, {"other", "correct horse battery staple"}} {
		if c.Authenticate(attempt.username, attempt.password) {
			t.Fatalf("invalid credentials accepted: %+v", attempt)
		}
	}
	if err := (WebCredentials{Username: "operator", PasswordHash: "not-a-bcrypt-hash"}).Validate(); err == nil {
		t.Fatal("invalid bcrypt hash accepted")
	}
}

func TestFederationRequestsUseTheirOwnCredentials(t *testing.T) {
	tokens := map[Surface]string{Web: "web-secret"}
	h := HTTPWithSessions(tokens, nil, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))

	for _, tc := range []struct {
		name   string
		method string
		path   string
		worker string
		want   int
	}{
		{name: "registration reaches admission handler", method: http.MethodPost, path: "/v1/federation/workers", want: http.StatusNoContent},
		{name: "worker request reaches worker handler", method: http.MethodGet, path: "/v1/federation/events", worker: "workpc-opencode", want: http.StatusNoContent},
		{name: "worker task reconciliation reaches worker handler", method: http.MethodGet, path: "/v1/tasks", worker: "workpc-opencode", want: http.StatusNoContent},
		{name: "worker artifact read reaches worker handler", method: http.MethodGet, path: "/v1/artifacts/ref", worker: "workpc-opencode", want: http.StatusNoContent},
		{name: "worker artifact upload reaches worker handler", method: http.MethodPost, path: "/v1/artifacts", worker: "workpc-opencode", want: http.StatusNoContent},
		{name: "unnamed worker request remains web gated", method: http.MethodGet, path: "/v1/federation/events", want: http.StatusUnauthorized},
		{name: "worker list remains web gated", method: http.MethodGet, path: "/v1/federation/workers", want: http.StatusUnauthorized},
	} {
		t.Run(tc.name, func(t *testing.T) {
			r := httptest.NewRequest(tc.method, tc.path, nil)
			if tc.worker != "" {
				r.Header.Set("X-Orchestra-Worker", tc.worker)
			}
			w := httptest.NewRecorder()
			h.ServeHTTP(w, r)
			if w.Code != tc.want {
				t.Fatalf("status = %d, want %d", w.Code, tc.want)
			}
		})
	}
}

func TestSessionExpires(t *testing.T) {
	s := &Sessions{TTL: time.Millisecond}
	v, err := s.Issue()
	if err != nil {
		t.Fatal(err)
	}
	time.Sleep(5 * time.Millisecond)
	if s.Valid(v) {
		t.Fatal("expired session accepted")
	}
	if s.Valid("") {
		t.Fatal("empty session accepted")
	}
}

func TestSessionRevoke(t *testing.T) {
	s := &Sessions{}
	v, err := s.Issue()
	if err != nil {
		t.Fatal(err)
	}
	if !s.Valid(v) {
		t.Fatal("fresh session must be valid")
	}
	s.Revoke(v)
	if s.Valid(v) {
		t.Fatal("revoked session must not be valid")
	}
}