package api

import (
	"context"
	"encoding/json"
	"fmt"
	"git.misaka.ren/m1saka/dsh-web/internal/docker"
	"git.misaka.ren/m1saka/dsh-web/internal/store"
	"io"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"strings"
	"sync/atomic"
	"testing"
	"time"
)

func imageTestAPI(t *testing.T, h http.HandlerFunc) (*API, string) {
	t.Helper()
	oldDiskAvailable := buildDiskAvailable
	buildDiskAvailable = func(string) (uint64, error) { return minimumBuildDiskBytes, nil }
	t.Cleanup(func() { buildDiskAvailable = oldDiskAvailable })
	root := t.TempDir()
	t.Setenv("DSH_DOCKER_ROOT_VISIBLE", root)
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/v1.47/info" {
			writeJSON(w, map[string]string{"DockerRootDir": root})
			return
		}
		h(w, r)
	}))
	t.Cleanup(srv.Close)
	s, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
	if err != nil {
		t.Fatal(err)
	}
	s.DB.SetMaxOpenConns(1)
	a := New(s, t.TempDir())
	a.docker = docker.New(srv.URL)
	t.Cleanup(func() {
		deadline := time.Now().Add(5 * time.Second)
		for {
			buildQueue.Lock()
			active := buildQueue.active[s.DB]
			buildQueue.Unlock()
			if !active {
				break
			}
			if time.Now().After(deadline) {
				t.Error("worker did not finish")
				break
			}
			time.Sleep(time.Millisecond)
		}
		s.Close()
	})
	if err = s.CreateUser(store.User{ID: "u", Username: "user"}, "unused"); err != nil {
		t.Fatal(err)
	}
	sid, _, err := s.Session("u")
	if err != nil {
		t.Fatal(err)
	}
	registerTestAccess(t, a, sid)
	return a, sid
}
func imageRequest(h http.HandlerFunc, sid, method, body string) *httptest.ResponseRecorder {
	r := httptest.NewRequest(method, "/", strings.NewReader(body))
	if sid != "" {
		r.AddCookie(&http.Cookie{Name: "dsh_session", Value: sid})
		addTestAccess(r, sid)
	}
	w := httptest.NewRecorder()
	h(w, r)
	return w
}
func TestImageListContract(t *testing.T) {
	a, sid := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/v1.47/images/unverified/json" {
			writeImageInspect(w, "unverified", "0.2.0-rc.1")
			return
		}
		if r.URL.Path == "/v1.47/images/sha256:abc/json" {
			writeImageInspect(w, "sha256:abc", "0.2.0-rc.1")
			return
		}
		if !strings.Contains(r.URL.Query().Get("filters"), "dsh-mgr.role=runtime") {
			t.Error("missing label filter")
		}
		io.WriteString(w, `[{"Id":"sha256:abc","Labels":{"dsh-mgr.role":"runtime","dsh-mgr.version":"0.2.0-rc.1","dsh-mgr.recipe":"`+imageRecipeRev+`"},"RepoTags":["runtime:0.2.0-rc.1"]},{"Id":"other","Labels":{}},{"Id":"unverified","Labels":{"dsh-mgr.role":"runtime","dsh-mgr.version":"0.2.0-rc.1","dsh-mgr.recipe":"`+imageRecipeRev+`"}},{"Id":"sha256:abc","Labels":{"dsh-mgr.role":"runtime","dsh-mgr.version":"9.9.9"}}]`)
	})
	seedVerifiedImage(t, a, "sha256:abc", "0.2.0-rc.1")
	if w := imageRequest(a.images, "", "GET", ""); w.Code != 401 {
		t.Fatal(w.Code)
	}
	w := imageRequest(a.images, sid, "GET", "")
	var images []imageRecord
	if err := json.Unmarshal(w.Body.Bytes(), &images); err != nil {
		t.Fatal(err)
	}
	if len(images) != 2 || images[0].ID != "sha256:abc" || images[0].ImageID != images[0].ID || images[0].Status != "available" || images[1].Status != "unverified" {
		t.Fatal(w.Body.String())
	}
	if w = imageRequest(a.images, sid, "POST", ""); w.Code != 405 {
		t.Fatal(w.Code)
	}
}

func seedVerifiedImage(t *testing.T, a *API, id, version string) {
	t.Helper()
	buildQueue.Lock()
	defer buildQueue.Unlock()
	if err := a.ensureBuilds(); err != nil {
		t.Fatal(err)
	}
	if _, err := a.s.DB.Exec("INSERT INTO image_builds(id,version,status,image_id,created_at,recipe_rev,platform) VALUES(?,?,'success',?,'now',?,?)", store.ID(), version, id, imageRecipeRev, imagePlatform); err != nil {
		t.Fatal(err)
	}
	if _, err := a.s.DB.Exec("INSERT OR REPLACE INTO image_admissions(image_id,version,recipe_rev,platform,state,evidence,admitted_by,admitted_at) VALUES(?,?,?,?,'compatible','test fixture explicit acceptance','test','now')", id, version, imageRecipeRev, imagePlatform); err != nil {
		t.Fatal(err)
	}
}
func TestImageSanitizing(t *testing.T) {
	s := sanitizeBuildLog("token=topsecret Authorization: Bearer hidden password=private https://user:pass@example.com/")
	for _, secret := range []string{"topsecret", "hidden", "private", "user:pass"} {
		if strings.Contains(s, secret) {
			t.Fatal(s)
		}
	}
	if len(sanitizeBuildLog(strings.Repeat("x", 2*buildLogLimit))) > buildLogLimit {
		t.Fatal("unbounded")
	}
	for _, v := range []string{"latest", "*", "^0.2.0-rc.1", "1.2", "0.2.0-rc.1;id", "https://example.com", ""} {
		if validBuildVersion(v) {
			t.Fatal(v)
		}
	}
	if !validBuildVersion("0.2.0-rc.1-beta.1") {
		t.Fatal("fixed prerelease rejected")
	}
}

func TestVerificationFailureCleansUp(t *testing.T) {
	var deleted atomic.Bool
	a, _ := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) {
		switch {
		case strings.HasSuffix(r.URL.Path, "/create"):
			io.WriteString(w, `{"Id":"bad"}`)
		case r.Method == "DELETE":
			deleted.Store(true)
			w.WriteHeader(204)
		default:
			w.WriteHeader(500)
			io.WriteString(w, `{"message":"cannot start"}`)
		}
	})
	if err := a.verifyBuiltImage(context.Background(), "bad", "0.2.0-rc.1"); err == nil {
		t.Fatal("accepted failed start")
	}
	if !deleted.Load() {
		t.Fatal("container leaked")
	}
}

func TestBuildRestartRecovery(t *testing.T) {
	a, _ := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(500) })
	buildQueue.Lock()
	defer buildQueue.Unlock()
	if err := a.ensureBuilds(); err != nil {
		t.Fatal(err)
	}
	if _, err := a.s.DB.Exec("INSERT INTO image_builds(id,version,status,created_at) VALUES('old','0.2.0-rc.1','running','now')"); err != nil {
		t.Fatal(err)
	}
	delete(buildQueue.initialized, a.s.DB)
	if err := a.ensureBuilds(); err != nil {
		t.Fatal(err)
	}
	var status, detail string
	if err := a.s.DB.QueryRow("SELECT status,error FROM image_builds WHERE id='old'").Scan(&status, &detail); err != nil {
		t.Fatal(err)
	}
	if status != "failed" || !strings.Contains(detail, "restart") {
		t.Fatalf("%s %s", status, detail)
	}
}

func TestFailedVerificationNeverAvailable(t *testing.T) {
	var deleted atomic.Bool
	imageID := "sha256:" + strings.Repeat("c", 64)
	info := releaseFixture()
	a, sid := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case "/v1.47/images/sha256:abc/json", "/v1.47/images/sha256:reuse/json":
			writeImageInspect(w, strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/v1.47/images/"), "/json"), "0.2.0-rc.1")
		case "/v1.47/images/json":
			writeJSON(w, []any{map[string]any{"Id": imageID, "Labels": map[string]string{"dsh-mgr.role": "runtime", "dsh-mgr.version": "0.2.0-rc.1", "dsh-mgr.recipe": imageRecipeRev}}})
		case "/v1.47/containers/create":
			io.WriteString(w, `{"Id":"check"}`)
		case "/v1.47/containers/check/start", "/v1.47/exec/probe/start":
			w.WriteHeader(204)
		case "/v1.47/containers/check/exec":
			io.WriteString(w, `{"Id":"probe"}`)
		case "/v1.47/exec/probe/json":
			io.WriteString(w, `{"Running":false,"ExitCode":1}`)
		case "/v1.47/containers/check":
			deleted.Store(true)
			w.WriteHeader(204)
		case "/v1.47/build":
			writeJSON(w, map[string]any{"aux": map[string]string{"ID": imageID}})
		case "/v1.47/images/" + imageID + "/json":
			parts := strings.Split(imagePlatform, "/")
			writeJSON(w, map[string]any{"Id": imageID, "Os": parts[0], "Architecture": parts[1], "Config": map[string]any{"Labels": map[string]string{"dsh-mgr.role": "runtime", "dsh-mgr.version": info.Version, "dsh-mgr.recipe": imageRecipeRev, "dsh-mgr.release": info.ReleaseID, "dsh-mgr.source": info.Repository, "dsh-mgr.commit": info.Commit}}})
		default:
			t.Errorf("unexpected Docker call %s", r.URL)
			w.WriteHeader(500)
		}
	})
	if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='u'"); err != nil {
		t.Fatal(err)
	}
	old := fetchRelease
	t.Cleanup(func() { fetchRelease = old })
	fetchRelease = func(context.Context, string, string) (releaseInfo, io.Reader, error) {
		return info, strings.NewReader("context"), nil
	}
	b, err := a.enqueueRelease("u", info)
	if err != nil {
		t.Fatal(err)
	}
	a.runImageBuild(b)
	if err := scanBuildSummary(a.s.DB.QueryRow("SELECT "+buildSummaryColumns+" FROM image_builds WHERE id=?", b.ID), &b); err != nil {
		t.Fatal(err)
	}
	if b.Status != "failed" || b.ImageID != imageID || !strings.Contains(b.Error, "verification failed") || !deleted.Load() {
		t.Fatalf("%+v cleanup=%v", b, deleted.Load())
	}
	w := imageRequest(a.images, sid, "GET", "")
	var images []imageRecord
	if err := json.Unmarshal(w.Body.Bytes(), &images); err != nil || w.Code != 200 || len(images) != 1 || images[0].Status != "unverified" {
		t.Fatal("failed image advertised", w.Body.String())
	}
	w = imageRequest(a.instances, sid, "POST", fmt.Sprintf(`{"name":"rejected","image_id":%q}`, imageID))
	if w.Code != 400 {
		t.Fatal("unverified image accepted", w.Code, w.Body.String())
	}
}

func writeImageInspect(w http.ResponseWriter, id, version string) {
	parts := strings.Split(imagePlatform, "/")
	writeJSON(w, map[string]any{"Id": id, "Os": parts[0], "Architecture": parts[1], "Config": map[string]any{"Labels": map[string]string{"dsh-mgr.role": "runtime", "dsh-mgr.version": version, "dsh-mgr.recipe": imageRecipeRev}}})
}