package onboarding

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"github.com/google/uuid"
)

func miniRequest(t *testing.T, s *Service, method, path, auth string, in any) (int, map[string]any) {
	t.Helper()
	raw, _ := json.Marshal(in)
	r := httptest.NewRequest(method, "https://platform.example"+path, bytes.NewReader(raw))
	r.RemoteAddr = "127.0.0.1:3456"
	r.Header.Set("Content-Type", "application/json")
	r.Header.Set("X-Request-ID", uuid.NewString())
	r.Header.Set("Authorization", auth)
	w := httptest.NewRecorder()
	mux := http.NewServeMux()
	s.RegisterRoutes(mux)
	mux.ServeHTTP(w, r)
	if len(w.Result().Cookies()) != 0 {
		t.Fatal("native API issued ambient cookie")
	}
	var out map[string]any
	must(t, json.Unmarshal(w.Body.Bytes(), &out))
	data, _ := out["data"].(map[string]any)
	return w.Code, data
}

func TestMiniCredentialsStrictRealm(t *testing.T) {
	good := "customer." + randomToken(32)
	if _, _, ok := miniCredential("Mini "+good, "Mini"); !ok {
		t.Fatal("valid token rejected")
	}
	for _, value := range []string{"Bearer " + good, "Mini admin." + randomToken(32), "Mini customer.short", "Mini " + good + "\n", "MiniLogin " + good} {
		if _, _, ok := miniCredential(value, "Mini"); ok {
			t.Fatal("malformed token accepted")
		}
	}
}

func TestMiniSMSLoginSharesCustomerIdentityAndNoCookies(t *testing.T) {
	f := newLoginFixture(t)
	_, err := f.s.ProvisionCustomerPhone(f.ctx, f.web.UserID, f.user.Issuer, f.user.Subject, f.phone, "CustomerOnly123!", uuid.NewString())
	must(t, err)
	status, session := miniRequest(t, f.s, "POST", "/api/v1/mini/login/session", "", map[string]string{"portal": "customer"})
	if status != 200 || session["sms_enabled"] != true {
		t.Fatal("mini SMS session unavailable", status)
	}
	loginToken := session["login_token"].(string)
	_, token, _ := miniCredential("MiniLogin "+loginToken, "MiniLogin")
	status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/login/captcha", "MiniLogin "+loginToken, struct{}{})
	if status != 200 {
		t.Fatal("mini captcha unavailable", status)
	}
	in := SMSSendInput{Phone: f.phone, Purpose: "LOGIN", CaptchaID: f.knownCaptchaFor(digest([]byte(token))), CaptchaCode: "654321"}
	status, challenge := miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/send", "MiniLogin "+loginToken, in)
	if status != 200 || f.sender.calls != 1 || challenge["sms_challenge_id"] == nil {
		t.Fatal("mini SMS was not sent", status, challenge)
	}
	status, result := miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/verify", "MiniLogin "+loginToken, SMSVerifyInput{ChallengeID: challenge["sms_challenge_id"].(string), Code: f.sender.code})
	if status != 200 || result["portal"] != "customer" {
		t.Fatal("mini SMS login failed", status, result)
	}
	auth := "Mini " + result["access_token"].(string)
	status, _ = miniRequest(t, f.s, "GET", "/api/v1/mini/account", auth, nil)
	if status != 200 {
		t.Fatal("mini account did not inherit customer identity", status)
	}
	status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/verify", "MiniLogin "+loginToken, SMSVerifyInput{ChallengeID: challenge["sms_challenge_id"].(string), Code: f.sender.code})
	if status != 401 {
		t.Fatal("mini SMS challenge was reused", status)
	}
}

func TestMiniSMSOperatorCannotSelfRegister(t *testing.T) {
	f := newOperatorLoginFixture(t)
	status, session := miniRequest(t, f.s, "POST", "/api/v1/mini/login/session", "", map[string]string{"portal": "operator"})
	if status != 200 {
		t.Fatal(status)
	}
	loginToken := session["login_token"].(string)
	_, token, _ := miniCredential("MiniLogin "+loginToken, "MiniLogin")
	status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/login/captcha", "MiniLogin "+loginToken, struct{}{})
	if status != 200 {
		t.Fatal(status)
	}
	in := SMSSendInput{Phone: f.phone, Purpose: "LOGIN", CaptchaID: f.knownCaptchaFor(digest([]byte(token))), CaptchaCode: "654321"}
	status, challenge := miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/send", "MiniLogin "+loginToken, in)
	if status != 200 {
		t.Fatal(status)
	}
	verify := SMSVerifyInput{ChallengeID: challenge["sms_challenge_id"].(string), Code: f.sender.code}
	status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/verify", "MiniLogin "+loginToken, verify)
	if status != 403 {
		t.Fatal("unprovisioned operator registered", status)
	}
	_, err := f.s.ProvisionOperatorPhone(f.ctx, f.operatorID, f.p.Issuer, f.p.Subject, f.phone, "OperatorOnly123!", uuid.NewString())
	must(t, err)
	status, result := miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/verify", "MiniLogin "+loginToken, verify)
	if status != 200 || result["portal"] != "operator" {
		t.Fatal("provisioned operator could not log in", status, result)
	}
	auth := "Mini " + result["access_token"].(string)
	status, _ = miniRequest(t, f.s, "GET", "/api/v1/mini/account", auth, nil)
	if status != 200 {
		t.Fatal("operator session rejected", status)
	}
	status, _ = miniRequest(t, f.s, "GET", "/api/v1/mini/account", strings.Replace(auth, "operator.", "customer.", 1), nil)
	if status != 401 {
		t.Fatal("operator token crossed customer realm", status)
	}
}

func TestMiniPasswordRealmRevocationAndNoCookies(t *testing.T) {
	f := newLoginFixture(t)
	account, csrf := f.smsAccount()
	w, _ := f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "LocalOnly123!"}, account, csrf, "")
	if w.Code != 200 {
		t.Fatal(w.Code)
	}
	status, login := miniRequest(t, f.s, "POST", "/api/v1/mini/login/session", "", map[string]string{"portal": "customer"})
	if status != 200 {
		t.Fatal(status)
	}
	loginToken := login["login_token"].(string)
	_, token, _ := miniCredential("MiniLogin "+loginToken, "MiniLogin")
	status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/login/captcha", "MiniLogin "+loginToken, struct{}{})
	if status != 200 {
		t.Fatal(status)
	}
	id := f.knownCaptchaFor(digest([]byte(token)))
	status, result := miniRequest(t, f.s, "POST", "/api/v1/mini/login/password", "MiniLogin "+loginToken, PasswordLoginInput{Phone: f.phone, Password: "LocalOnly123!", CaptchaID: id, CaptchaCode: "654321", TrustedDeviceToken: f.trusted.Value})
	if status != 200 {
		t.Fatal(status)
	}
	auth := "Mini " + result["access_token"].(string)
	status, _ = miniRequest(t, f.s, "GET", "/api/v1/mini/account", auth, nil)
	if status != 200 {
		t.Fatal(status)
	}
	status, _ = miniRequest(t, f.s, "GET", "/api/v1/mini/account", strings.Replace(auth, "customer.", "operator.", 1), nil)
	if status != 401 {
		t.Fatal("realm substitution", status)
	}
	status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/login/captcha", "MiniLogin "+loginToken, struct{}{})
	if status != 401 {
		t.Fatal("consumed login reused", status)
	}
	status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/logout", auth, struct{}{})
	if status != 200 {
		t.Fatal(status)
	}
	status, _ = miniRequest(t, f.s, "GET", "/api/v1/mini/account", auth, nil)
	if status != 401 {
		t.Fatal("revoked session accepted", status)
	}
	// Existing web writes still require their own Origin and CSRF.
	w, _ = f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "ChangedOnly123!"}, account, "wrong", "")
	if w.Code != 403 {
		t.Fatal("web CSRF weakened")
	}
}

func TestBLEAutomaticSession(t *testing.T) {
	f := newFixture(t)
	in := BLESessionInput{DeviceID: f.d.FactoryID, Model: f.d.Model, KeyVersion: f.d.KeyVersion, ClientNonce: randomToken(16), ServerNonce: randomToken(16)}
	in.Proof = domainMAC(f.d.Key, "BLE-PROOF1\n"+bleTranscript(in))
	result, err := f.s.BLESession(f.ctx, f.user, in)
	must(t, err)
	if result["session_password"] != domainMAC(f.d.Key, "BLE-PASS1\n"+bleTranscript(in)) || result["session_password"] == in.Proof {
		t.Fatal("wrong or non-domain-separated password")
	}
	_, err = f.s.BLESession(f.ctx, f.user, in)
	must(t, err)
	bad := in
	bad.ServerNonce = randomToken(16)
	_, err = f.s.BLESession(f.ctx, f.user, bad)
	if err == nil {
		t.Fatal("tampered transcript accepted")
	}
	_, err = f.s.BLESession(f.ctx, f.p, in)
	if err == nil {
		t.Fatal("operator obtained family pairing password")
	}
	must(t, f.s.redis.Set(f.ctx, "onboarding:ble-link:"+digest([]byte(in.Proof)), "different-account", time.Minute).Err())
	_, err = f.s.BLESession(f.ctx, f.user, in)
	if err == nil {
		t.Fatal("cross-account replay accepted")
	}
}