package externalprobe

import (
	"context"
	"crypto/x509"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"
)

func TestJWKSRequiresSuccessfulDocumentWithKeys(t *testing.T) {
	tests := []struct {
		name    string
		status  int
		body    string
		wantErr bool
	}{
		{name: "valid", status: http.StatusOK, body: `{"keys":[{"kty":"RSA","kid":"one"}]}`},
		{name: "empty", status: http.StatusOK, body: `{"keys":[]}`, wantErr: true},
		{name: "invalid", status: http.StatusOK, body: `{`, wantErr: true},
		{name: "unavailable", status: http.StatusServiceUnavailable, body: `{}`, wantErr: true},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
				writer.WriteHeader(test.status)
				_, _ = writer.Write([]byte(test.body))
			}))
			defer server.Close()
			check, err := JWKS(server.URL, server.Client())
			if err != nil {
				t.Fatal(err)
			}
			err = check(context.Background())
			if (err != nil) != test.wantErr {
				t.Fatalf("check() error=%v, wantErr=%v", err, test.wantErr)
			}
		})
	}
}

func TestTLSReachabilityValidatesCertificate(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
	defer server.Close()
	roots := x509.NewCertPool()
	roots.AddCert(server.Certificate())
	check, err := TLSReachability(server.URL, roots)
	if err != nil {
		t.Fatal(err)
	}
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	if err = check(ctx); err != nil {
		t.Fatalf("TLS check failed: %v", err)
	}

	untrusted, err := TLSReachability(server.URL, x509.NewCertPool())
	if err != nil {
		t.Fatal(err)
	}
	if err = untrusted(context.Background()); err == nil || !strings.Contains(err.Error(), "TLS") {
		t.Fatalf("untrusted TLS check error=%v", err)
	}
}

func TestRunnerRejectsInvalidDefinitions(t *testing.T) {
	if _, err := NewRunner(0, time.Second, nil, nil); err == nil {
		t.Fatal("zero interval should be rejected")
	}
	if _, err := NewRunner(time.Second, time.Second, map[string]CheckFunc{"": func(context.Context) error { return nil }}, nil); err == nil {
		t.Fatal("empty probe name should be rejected")
	}
}