package onboarding

import (
	"context"
	"testing"
)

func TestSaaSCaptchaDisabledScope(t *testing.T) {
	s := &Service{options: Options{SaaSCaptchaDisabled: true}}
	if !s.saasCaptchaDisabled(context.Background()) {
		t.Fatal("web not disabled")
	}
	mini := context.WithValue(context.Background(), captchaRequestKey{}, captchaRequestInfo{client: "mini_program"})
	if s.saasCaptchaDisabled(mini) {
		t.Fatal("mini affected")
	}
	s.options.SaaSCaptchaDisabled = false
	if s.saasCaptchaDisabled(context.Background()) {
		t.Fatal("default bypass")
	}
}

func TestSaaSCaptchaDisabledSMSAndGuards(t *testing.T) {
	f := newLoginFixture(t)
	f.s.options.SaaSCaptchaDisabled = true
	setCaptchaTestPolicy(t, f.fixture, "slide", "image")
	w, ch := f.request("POST", "/api/v1/web/login/captcha", struct{}{}, f.cookie, f.csrf, "")
	if w.Code != 200 || ch["mode"] != "none" || ch["image"] != nil {
		t.Fatal(w.Body.String())
	}
	in := SMSSendInput{Phone: f.phone, Purpose: "LOGIN"}
	w, _ = f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, "wrong", "")
	if w.Code != 403 || f.sender.calls != 0 {
		t.Fatal("CSRF bypass")
	}
	w, _ = f.request("POST", "/api/v1/web/login/sms/send", in, nil, f.csrf, "")
	if w.Code != 401 || f.sender.calls != 0 {
		t.Fatal("session bypass")
	}
	w, sms := f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, "")
	if w.Code != 200 || f.sender.calls != 1 {
		t.Fatal(w.Body.String())
	}
	w, _ = f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, "")
	if w.Code != 429 || f.sender.calls != 1 {
		t.Fatal("SMS cooldown bypass")
	}
	mini := context.WithValue(f.ctx, captchaRequestKey{}, captchaRequestInfo{client: "mini_program"})
	if f.s.verifyLoginCaptcha(mini, digest([]byte(f.cookie.Value)), "", "") == nil {
		t.Fatal("mini captcha bypass")
	}
	f.s.options.SaaSCaptchaDisabled = false
	if f.s.verifyLoginCaptcha(f.ctx, digest([]byte(f.cookie.Value)), "", "") == nil {
		t.Fatal("reenabling did not enforce proof")
	}
	f.s.options.SaaSCaptchaDisabled = true
	w, _ = f.request("POST", "/api/v1/web/login/sms/verify", SMSVerifyInput{ChallengeID: sms["sms_challenge_id"].(string), Code: f.sender.code}, f.cookie, f.csrf, "")
	if w.Code != 200 {
		t.Fatal(w.Body.String())
	}
}

func TestSaaSCaptchaDisabledPassword(t *testing.T) {
	f := newLoginFixture(t)
	account, csrf := f.smsAccount()
	w, _ := f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "LocalOnly123!"}, account, csrf, "")
	if w.Code != 200 {
		t.Fatal(w.Body.String())
	}
	f.s.options.SaaSCaptchaDisabled = true
	f.newLoginSession()
	w, _ = f.request("POST", "/api/v1/web/login/password", PasswordLoginInput{Phone: f.phone, Password: "WrongPassword!"}, f.cookie, f.csrf, "")
	if w.Code != 401 {
		t.Fatal("wrong password accepted")
	}
	w, _ = f.request("POST", "/api/v1/web/login/password", PasswordLoginInput{Phone: f.phone, Password: "LocalOnly123!"}, f.cookie, f.csrf, "")
	if w.Code != 200 {
		t.Fatal(w.Body.String())
	}
}