package api

import (
	"encoding/json"
	"fmt"
	"golang.org/x/crypto/bcrypt"
	"net/http"
	"net/http/httptest"
	"strings"
	"sync"
	"testing"
	"time"
)

const resetPath = "/api/users/reset-password"

func TestResetPasswordConcurrentLogin(t *testing.T) {
	a, req := authFixture(t)
	if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='alice'"); err != nil {
		t.Fatal(err)
	}
	admin := req("POST", "/api/login", resetLogin("alice", "password-123"), "", nil).Result().Cookies()
	start := make(chan struct{})
	results := make(chan *httptest.ResponseRecorder, 8)
	for i := 0; i < 8; i++ {
		go func() { <-start; results <- req("POST", "/api/login", resetLogin("bob", "password-123"), "", nil) }()
	}
	close(start)
	w := req("POST", resetPath, resetBody("bob", resetSecret), cookieValue(admin, "dsh_csrf"), admin)
	if w.Code != 200 {
		t.Fatal(w.Code, w.Body.String())
	}
	for i := 0; i < 8; i++ {
		w := <-results
		if w.Code != 200 && w.Code != 401 && w.Code != 429 {
			t.Fatal(w.Code, w.Body.String())
		}
		if w.Code == 200 {
			if check := req("GET", "/api/me", "", "", w.Result().Cookies()); check.Code != 401 {
				t.Fatal("old-password login retained session", check.Code)
			}
		}
	}
	var n int
	if err := a.s.DB.QueryRow("SELECT count(*) FROM sessions WHERE uid='bob'").Scan(&n); err != nil || n != 0 {
		t.Fatal("old login sessions", n, err)
	}
}

type resetSignalReader struct {
	reader  *strings.Reader
	started chan struct{}
	once    sync.Once
}

func (r *resetSignalReader) Read(p []byte) (int, error) {
	r.once.Do(func() { close(r.started) })
	return r.reader.Read(p)
}

func TestResetPasswordRechecksWaitingAdmin(t *testing.T) {
	for _, revoke := range []string{"session", "admin"} {
		t.Run(revoke, func(t *testing.T) {
			a, req := authFixture(t)
			if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='alice'"); err != nil {
				t.Fatal(err)
			}
			admin := req("POST", "/api/login", resetLogin("alice", "password-123"), "", nil).Result().Cookies()
			reader := &resetSignalReader{reader: strings.NewReader(resetBody("bob", resetSecret)), started: make(chan struct{})}
			r := httptest.NewRequest("POST", resetPath, reader)
			r.Header.Set("Origin", a.origin)
			r.Header.Set("X-CSRF-Token", cookieValue(admin, "dsh_csrf"))
			for _, c := range admin {
				r.AddCookie(c)
			}
			a.authLoginMu.Lock()
			locked := true
			defer func() {
				if locked {
					a.authLoginMu.Unlock()
				}
			}()
			done := make(chan *httptest.ResponseRecorder, 1)
			go func() { w := httptest.NewRecorder(); a.Handler().ServeHTTP(w, r); done <- w }()
			select {
			case <-reader.started:
			case <-time.After(5 * time.Second):
				t.Fatal("request did not reach decoder")
			}
			select {
			case w := <-done:
				t.Fatal("reset bypassed login lock", w.Code)
			case <-time.After(150 * time.Millisecond):
			}
			query := "UPDATE users SET admin=0 WHERE id='alice'"
			want := 403
			if revoke == "session" {
				query = "DELETE FROM sessions WHERE uid='alice'"
				want = 401
			}
			if _, err := a.s.DB.Exec(query); err != nil {
				t.Fatal(err)
			}
			a.authLoginMu.Unlock()
			locked = false
			select {
			case w := <-done:
				if w.Code != want {
					t.Fatal(w.Code, w.Body.String())
				}
			case <-time.After(5 * time.Second):
				t.Fatal("reset did not finish")
			}
			hash, err := a.s.Password("bob")
			if err != nil || bcrypt.CompareHashAndPassword([]byte(hash), []byte("password-123")) != nil {
				t.Fatal("unauthorized reset", err)
			}
		})
	}
}

const resetSecret = "new-password-123"

func resetBody(id, password string) string {
	b, _ := json.Marshal(map[string]string{"id": id, "password": password})
	return string(b)
}

func TestResetPasswordValidation(t *testing.T) {
	a, req := authFixture(t)
	admin := req("POST", "/api/login", resetLogin("alice", "password-123"), "", nil).Result().Cookies()
	regular := req("POST", "/api/login", resetLogin("bob", "password-123"), "", nil).Result().Cookies()
	if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='alice'"); err != nil {
		t.Fatal(err)
	}
	csrf := cookieValue(admin, "dsh_csrf")
	for _, tc := range []struct {
		name, method, body, csrf string
		cookies                  []*http.Cookie
		code                     int
	}{
		{"anonymous", "POST", resetBody("bob", resetSecret), "", nil, 401},
		{"regular", "POST", resetBody("alice", resetSecret), cookieValue(regular, "dsh_csrf"), regular, 403},
		{"csrf", "POST", resetBody("bob", resetSecret), "bad", admin, 403},
		{"method", "GET", "", csrf, admin, 405},
		{"missing id", "POST", resetBody("", resetSecret), csrf, admin, 400},
		{"short", "POST", resetBody("bob", strings.Repeat("a", 11)), csrf, admin, 400},
		{"long", "POST", resetBody("bob", strings.Repeat("a", 73)), csrf, admin, 400},
		{"unicode long", "POST", resetBody("bob", strings.Repeat("密", 25)), csrf, admin, 400},
		{"malformed", "POST", "{", csrf, admin, 400},
		{"trailing", "POST", resetBody("bob", resetSecret) + "{}", csrf, admin, 400},
		{"oversized", "POST", resetBody("bob", strings.Repeat("a", 4096)), csrf, admin, 400},
		{"missing target", "POST", resetBody("missing", resetSecret), csrf, admin, 404},
	} {
		t.Run(tc.name, func(t *testing.T) {
			w := req(tc.method, resetPath, tc.body, tc.csrf, tc.cookies)
			if w.Code != tc.code {
				t.Fatal(w.Code, w.Body.String())
			}
		})
	}
	for _, origin := range []string{"", "https://evil.test"} {
		r := httptest.NewRequest("POST", resetPath, strings.NewReader(resetBody("bob", resetSecret)))
		r.Header.Set("Origin", origin)
		r.Header.Set("X-CSRF-Token", csrf)
		for _, c := range admin {
			r.AddCookie(c)
		}
		w := httptest.NewRecorder()
		a.Handler().ServeHTTP(w, r)
		if w.Code != 403 {
			t.Fatal("origin accepted", w.Code)
		}
	}
	for _, password := range []string{strings.Repeat("a", 12), strings.Repeat("密", 24)} {
		if w := req("POST", resetPath, resetBody("bob", password), csrf, admin); w.Code != 200 {
			t.Fatal(w.Code, w.Body.String())
		}
		hash, err := a.s.Password("bob")
		if err != nil || bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil {
			t.Fatal("boundary hash", err)
		}
	}
}

func resetLogin(username, password string) string {
	b, _ := json.Marshal(map[string]string{"username": username, "password": password})
	return string(b)
}

func TestResetPasswordLifecycle(t *testing.T) {
	for _, target := range []string{"bob", "alice"} {
		t.Run(target, func(t *testing.T) {
			a, req := authFixture(t)
			if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='alice'"); err != nil {
				t.Fatal(err)
			}
			login := func(name string) []*http.Cookie {
				w := req("POST", "/api/login", resetLogin(name, "password-123"), "", nil)
				if w.Code != 200 {
					t.Fatal(w.Code)
				}
				return w.Result().Cookies()
			}
			admin := login("alice")
			targets := [][]*http.Cookie{login(target), login(target)}
			other := "alice"
			if target == "alice" {
				other = "bob"
			}
			unaffected := login(other)
			if _, err := a.s.DB.Exec("INSERT INTO auth_failures VALUES(?,5,?)", target, 9999999999); err != nil {
				t.Fatal(err)
			}
			w := req("POST", resetPath, resetBody(target, resetSecret), cookieValue(admin, "dsh_csrf"), admin)
			if w.Code != 200 {
				t.Fatal(w.Code, w.Body.String())
			}
			var result map[string]bool
			if json.Unmarshal(w.Body.Bytes(), &result) != nil || !result["ok"] || result["reauthenticate"] != (target == "alice") {
				t.Fatal(w.Body.String())
			}
			for _, cs := range targets {
				var remaining int
				if err := a.s.DB.QueryRow("SELECT count(*) FROM auth_refresh WHERE sid=?", cookieValue(cs, "dsh_session")).Scan(&remaining); err != nil || remaining != 0 {
					t.Fatal("old refresh row", remaining, err)
				}
				if w := req("GET", "/api/me", "", "", cs); w.Code != 401 {
					t.Fatal("old access", w.Code)
				}
				if w := req("POST", "/api/refresh", "", cookieValue(cs, "dsh_csrf"), cs); w.Code != 403 {
					t.Fatal("old refresh", w.Code)
				}
			}
			for _, query := range []string{"SELECT count(*) FROM sessions WHERE uid=?", "SELECT count(*) FROM auth_failures WHERE username=?", "SELECT count(*) FROM auth_refresh WHERE sid IN (SELECT id FROM sessions WHERE uid=?)"} {
				var n int
				if err := a.s.DB.QueryRow(query, target).Scan(&n); err != nil || n != 0 {
					t.Fatal(query, n, err)
				}
			}
			if w := req("GET", "/api/me", "", "", unaffected); w.Code != 200 {
				t.Fatal("other access", w.Code)
			}
			if w := req("POST", "/api/refresh", "", cookieValue(unaffected, "dsh_csrf"), unaffected); w.Code != 200 {
				t.Fatal("other refresh", w.Code)
			}
			if w := req("POST", "/api/login", resetLogin(target, "password-123"), "", nil); w.Code != 401 {
				t.Fatal("old password", w.Code)
			}
			if w := req("POST", "/api/login", resetLogin(target, resetSecret), "", nil); w.Code != 200 {
				t.Fatal("new password", w.Code)
			}
			var actor, detail string
			var n int
			if err := a.s.DB.QueryRow("SELECT uid,detail,count(*) FROM audit WHERE action='user.reset_password' AND target=?", target).Scan(&actor, &detail, &n); err != nil || actor != "alice" || detail != "" || n != 1 {
				t.Fatal("audit", actor, detail, n, err)
			}
		})
	}
}

func TestResetPasswordRollback(t *testing.T) {
	for _, step := range []struct{ table, event string }{{"users", "UPDATE"}, {"auth_refresh", "DELETE"}, {"sessions", "DELETE"}, {"auth_failures", "DELETE"}, {"audit", "INSERT"}} {
		t.Run(step.table, func(t *testing.T) {
			a, req := authFixture(t)
			if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='alice'"); err != nil {
				t.Fatal(err)
			}
			admin := req("POST", "/api/login", resetLogin("alice", "password-123"), "", nil).Result().Cookies()
			target := req("POST", "/api/login", resetLogin("bob", "password-123"), "", nil).Result().Cookies()
			before, err := a.s.Password("bob")
			if err != nil {
				t.Fatal(err)
			}
			if _, err := a.s.DB.Exec("INSERT INTO auth_failures VALUES('bob',5,9999999999)"); err != nil {
				t.Fatal(err)
			}
			if _, err := a.s.DB.Exec(fmt.Sprintf("CREATE TRIGGER reject_reset BEFORE %s ON %s BEGIN SELECT RAISE(ABORT,'forced failure'); END", step.event, step.table)); err != nil {
				t.Fatal(err)
			}
			w := req("POST", resetPath, resetBody("bob", resetSecret), cookieValue(admin, "dsh_csrf"), admin)
			if w.Code != 500 || strings.Contains(w.Body.String(), resetSecret) {
				t.Fatal(w.Code, w.Body.String())
			}
			after, err := a.s.Password("bob")
			if err != nil || before != after {
				t.Fatal("hash changed", err)
			}
			for query, want := range map[string]int{"SELECT count(*) FROM sessions WHERE uid='bob'": 1, "SELECT count(*) FROM auth_refresh": 2, "SELECT count(*) FROM auth_failures WHERE username='bob' AND failures=5 AND locked_until=9999999999": 1, "SELECT count(*) FROM audit WHERE action='user.reset_password'": 0} {
				var n int
				if err := a.s.DB.QueryRow(query).Scan(&n); err != nil || n != want {
					t.Fatal(query, n, err)
				}
			}
			if w := req("GET", "/api/me", "", "", target); w.Code != 200 {
				t.Fatal("session changed", w.Code)
			}
			if w := req("POST", "/api/refresh", "", cookieValue(target, "dsh_csrf"), target); w.Code != 200 {
				t.Fatal("refresh changed", w.Code)
			}
		})
	}
}