package httpapi

import (
	"bytes"
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"io"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"testing"

	"hopweb/internal/gitea"
	"hopweb/internal/store"
)

type fakeStore struct {
	repositories []store.Repository
	delivery     store.WebhookDelivery
	duplicate    bool
}

func (f *fakeStore) Ping(context.Context) error { return nil }
func (f *fakeStore) ListRepositories(context.Context) ([]store.Repository, error) {
	return f.repositories, nil
}
func (f *fakeStore) UpsertRepository(_ context.Context, repository gitea.Repository) (store.Repository, error) {
	saved := store.Repository{ID: "RP_TEST", GiteaID: repository.ID, Owner: repository.OwnerName(), Name: repository.Name, FullName: repository.FullName}
	f.repositories = append(f.repositories, saved)
	return saved, nil
}
func (f *fakeStore) RecordWebhook(_ context.Context, delivery store.WebhookDelivery) (bool, error) {
	f.delivery = delivery
	return f.duplicate, nil
}

type fakeGitea struct {
	repository gitea.Repository
	err        error
}

func (f fakeGitea) Repository(context.Context, string, string) (gitea.Repository, error) {
	return f.repository, f.err
}

func testServer(data store.Store, client giteaClient) http.Handler {
	return New(data, client, "admin-secret", "webhook-secret", slog.New(slog.NewTextHandler(io.Discard, nil)))
}

func TestAdminAuthentication(t *testing.T) {
	handler := testServer(&fakeStore{}, fakeGitea{})
	for _, header := range []string{"", "admin-secret", "Bearer wrong"} {
		req := httptest.NewRequest(http.MethodGet, "/api/v1/repositories", nil)
		req.Header.Set("Authorization", header)
		response := httptest.NewRecorder()
		handler.ServeHTTP(response, req)
		if response.Code != http.StatusUnauthorized {
			t.Fatalf("header %q: status = %d, want %d", header, response.Code, http.StatusUnauthorized)
		}
	}
}

func TestLinkRepository(t *testing.T) {
	data := &fakeStore{}
	client := fakeGitea{repository: gitea.Repository{ID: 42, Owner: gitea.Owner{Login: "hop"}, Name: "demo", FullName: "hop/demo"}}
	handler := testServer(data, client)
	req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/link", bytes.NewBufferString(`{"owner":"hop","name":"demo"}`))
	req.Header.Set("Authorization", "Bearer admin-secret")
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, req)
	if response.Code != http.StatusCreated {
		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusCreated, response.Body.String())
	}
	if len(data.repositories) != 1 || data.repositories[0].GiteaID != 42 {
		t.Fatalf("repository not linked: %#v", data.repositories)
	}
}

func TestWebhookVerificationAndDeduplication(t *testing.T) {
	data := &fakeStore{duplicate: true}
	handler := testServer(data, fakeGitea{err: errors.New("unused")})
	body := []byte(`{"repository":{"id":42,"owner":{"login":"hop"},"name":"demo","full_name":"hop/demo"}}`)
	mac := hmac.New(sha256.New, []byte("webhook-secret"))
	_, _ = mac.Write(body)

	req := httptest.NewRequest(http.MethodPost, "/api/v1/gitea/webhooks", bytes.NewReader(body))
	req.Header.Set("X-Gitea-Signature", hex.EncodeToString(mac.Sum(nil)))
	req.Header.Set("X-Gitea-Delivery", "delivery-1")
	req.Header.Set("X-Gitea-Event", "push")
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, req)

	if response.Code != http.StatusNoContent {
		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusNoContent, response.Body.String())
	}
	if response.Header().Get("X-Hop-Duplicate") != "true" {
		t.Fatal("expected duplicate response header")
	}
	if data.delivery.DeliveryID != "delivery-1" || data.delivery.Repository == nil || data.delivery.Repository.ID != 42 {
		t.Fatalf("delivery not recorded: %#v", data.delivery)
	}
}

func TestWebhookRejectsInvalidSignature(t *testing.T) {
	handler := testServer(&fakeStore{}, fakeGitea{})
	req := httptest.NewRequest(http.MethodPost, "/api/v1/gitea/webhooks", bytes.NewBufferString(`{}`))
	req.Header.Set("X-Gitea-Signature", "bad")
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, req)
	if response.Code != http.StatusUnauthorized {
		t.Fatalf("status = %d, want %d", response.Code, http.StatusUnauthorized)
	}
}