package config

import (
	"context"
	"database/sql"
	"encoding/json"
	"errors"
	"os"
	"path/filepath"
	"testing"
	"time"

	_ "modernc.org/sqlite"
)

func TestAuditAutomaticSSLPolicy(t *testing.T) {
	var empty *Config
	if empty.UsesProxyHTTPS() || empty.AutomaticSSLEnabled() {
		t.Fatal("空配置不能启用自动证书")
	}
	for _, mode := range []string{"", HTTPSTLSModeDirect, HTTPSTLSModeProxy, " PROXY "} {
		for _, sslType := range []string{"", SSLTypeUser, SSLTypeAutoHTTP, SSLTypeAutoDNS} {
			cfg := &Config{TLSMode: mode, SSLType: sslType}
			want := (mode == "" || mode == HTTPSTLSModeDirect) && (sslType == SSLTypeAutoHTTP || sslType == SSLTypeAutoDNS)
			if cfg.AutomaticSSLEnabled() != want {
				t.Fatalf("自动证书策略错误: mode=%q type=%q", mode, sslType)
			}
		}
	}
}

func TestAuditProxySwitchRejectsStaleSSLCommit(t *testing.T) {
	previousRoot, previousSnapshot := ROOT_PATH, CurrentConfig()
	ROOT_PATH = t.TempDir()
	t.Cleanup(func() {
		ROOT_PATH = previousRoot
		PublishConfigSnapshot(previousSnapshot)
	})
	expected := &Config{TLSMode: HTTPSTLSModeDirect, SSLType: SSLTypeAutoDNS, HttpsEnabled: 2}
	if err := WriteConfig(expected); err != nil {
		t.Fatal(err)
	}
	live := *expected
	// 只修改 TLSMode，确保拒绝不是由 HTTPS 开关或域名变化引起。
	live.TLSMode = HTTPSTLSModeProxy
	if err := WriteConfig(&live); err != nil {
		t.Fatal(err)
	}
	if err := WriteSSLConfig(expected, expected); !errors.Is(err, ErrGenerationConflict) {
		t.Fatalf("切换反代后未拒绝旧签发结果: %v", err)
	}
	stored, err := ReadConfig()
	if err != nil || !stored.UsesProxyHTTPS() {
		t.Fatal("过期签发改变了反代策略")
	}
}

func TestAuditTLSStatusTracksAppliedPolicy(t *testing.T) {
	root := t.TempDir()
	runtime := validRuntimeConfig()
	runtime.Root.HTTP.TLSMode = HTTPSTLSModeDirect
	writeRuntimeFixture(t, root, runtime)
	manager, err := NewConfigManager(root, ConfigLoaderOptions{Validation: RuntimeValidationOptions{HasSuperAdmin: true, Production: true}})
	if err != nil {
		t.Fatal(err)
	}
	actor := authorizedConfigActor()
	for _, mode := range []string{HTTPSTLSModeProxy, HTTPSTLSModeDirect} {
		current := manager.Snapshot()
		next := current.Root
		next.HTTP.TLSMode = mode
		next.HTTP.HTTPSEnabled = mode == HTTPSTLSModeDirect
		next.HTTP.HTTPSPort = 0
		if next.HTTP.HTTPSEnabled {
			next.HTTP.HTTPSPort = 443
		}
		next.HTTP.TrustedProxyCIDRs = []string{"127.0.0.1/32"}
		payload, err := json.Marshal(next)
		if err != nil {
			t.Fatal(err)
		}
		updated, err := manager.Update(context.Background(), UpdateRequest{
			Section: SectionRoot, ExpectedGeneration: current.Generation, Payload: payload, Actor: actor,
			Confirmation: StepUpConfirmation{Confirmed: true, Method: "recent_auth"},
		})
		if err != nil {
			t.Fatal(err)
		}
		if manager.Status().TLSMode != current.Root.HTTP.TLSMode {
			t.Fatal("未应用的候选不能改变生效模式提示")
		}
		if _, err := manager.ApplyAuthorized(context.Background(), updated.Generation, actor); err != nil {
			t.Fatal(err)
		}
		if manager.Status().TLSMode != mode {
			t.Fatal("状态没有跟随已应用的 HTTPS 模式")
		}
	}
}

func TestAuditPendingIdentityAndRecovery(t *testing.T) {
	root := t.TempDir()
	writeRuntimeFixture(t, root, validRuntimeConfig())
	manager, err := NewConfigManager(root, ConfigLoaderOptions{Validation: RuntimeValidationOptions{HasSuperAdmin: true, Production: true}})
	if err != nil {
		t.Fatal(err)
	}
	actor := authorizedConfigActor()
	payload, _ := json.Marshal(manager.Snapshot().Email)
	req := UpdateRequest{Section: SectionEmail, ExpectedGeneration: 1, Payload: payload, Actor: actor}
	first, err := manager.Update(context.Background(), req)
	if err != nil {
		t.Fatal(err)
	}
	confirmation := StepUpConfirmation{Confirmed: true, Method: "recent_auth"}
	if err := manager.ManagePending(context.Background(), first.Generation, first.CandidateID, actor, confirmation, true); err != nil {
		t.Fatal(err)
	}
	second, err := manager.Update(context.Background(), req)
	if err != nil {
		t.Fatal(err)
	}
	if first.CandidateID == second.CandidateID {
		t.Fatal("不同候选不能复用标识")
	}
	if _, err := manager.ApplyPendingAuthorized(context.Background(), first.Generation, first.CandidateID, SectionEmail, actor); !errors.Is(err, ErrGenerationConflict) {
		t.Fatalf("旧候选应用未拒绝: %v", err)
	}
	if err := manager.ManagePending(context.Background(), first.Generation, first.CandidateID, actor, confirmation, true); !errors.Is(err, ErrGenerationConflict) {
		t.Fatalf("旧候选取消未拒绝: %v", err)
	}
	actor.SessionID = "renewed-session"
	actor.RecentAuth = false
	if err := manager.ManagePending(context.Background(), second.Generation, second.CandidateID, actor, confirmation, false); err == nil {
		t.Fatal("跨会话恢复缺少近期认证")
	}
	actor.RecentAuth = true
	if err := manager.ManagePending(context.Background(), second.Generation, second.CandidateID, actor, confirmation, false); err != nil {
		t.Fatal(err)
	}
	if !manager.Pending(actor).SameSession {
		t.Fatal("恢复没有绑定新会话")
	}
	manager.snapshots = &flakyRuntimeSnapshotStore{current: manager.Snapshot(), failures: 1}
	if _, err := manager.ApplyPendingAuthorized(context.Background(), second.Generation, second.CandidateID, SectionEmail, actor); !errors.Is(err, ErrRuntimeSnapshotUnavailable) {
		t.Fatal(err)
	}
	if err := manager.ManagePending(context.Background(), second.Generation, second.CandidateID, actor, confirmation, true); !errors.Is(err, ErrRuntimeSnapshotUnavailable) {
		t.Fatalf("已落盘候选不应取消: %v", err)
	}
	manager.transactions.WithHooks(TransactionHooks{BeforePhase: func(TransactionPhase) error { return errors.New("不能再次提交") }})
	if _, err := manager.ApplyPendingAuthorized(context.Background(), second.Generation, second.CandidateID, SectionEmail, actor); err != nil {
		t.Fatalf("快照重试重新写盘: %v", err)
	}
}

func TestAuditStagedSSLDoesNotReplaceCurrent(t *testing.T) {
	previous := ROOT_PATH
	ROOT_PATH = t.TempDir()
	t.Cleanup(func() { ROOT_PATH = previous })
	key, cert := testManagedCertificate(t, "mail.example.com", time.Now().Add(-time.Hour), time.Now().Add(time.Hour), 2048)
	active, err := ImportManagedSSL(ManagedSSLModeDefault, key, cert, nil, nil)
	if err != nil {
		t.Fatal(err)
	}
	nextKey, nextCert := testManagedCertificate(t, "mail.example.com", time.Now().Add(-time.Hour), time.Now().Add(time.Hour), 2048)
	staged, err := StageManagedSSL(ManagedSSLModeDefault, nextKey, nextCert, nil, nil)
	if err != nil {
		t.Fatal(err)
	}
	actual, err := os.ReadFile(active.CertificatePath)
	if err != nil || string(actual) != string(cert) {
		t.Fatal("暂存替换了现用证书")
	}
	if _, err := ResolveManagedSSLReferences(SSLConfig{Mode: staged.Mode, CertificateRef: staged.CertificateRef, PrivateKeyRef: active.PrivateKeyRef}); !errors.Is(err, ErrInvalidSSLReference) {
		t.Fatalf("跨版本配对未拒绝: %v", err)
	}
	if _, err := ResolveManagedSSLReferences(SSLConfig{Mode: staged.Mode, CertificateRef: staged.CertificateRef, PrivateKeyRef: staged.PrivateKeyRef}); err != nil {
		t.Fatal(err)
	}
}

func TestAuditLegacySSLCommitPreservesLatestUnrelatedSettings(t *testing.T) {
	previousRoot, previousSnapshot := ROOT_PATH, CurrentConfig()
	ROOT_PATH = t.TempDir()
	t.Cleanup(func() {
		ROOT_PATH = previousRoot
		PublishConfigSnapshot(previousSnapshot)
	})
	writeLegacyMigrationFixture(t, ROOT_PATH, map[string]any{
		"domain": "example.test", "webDomain": "mail.example.test",
		"sslType": SSLTypeAutoDNS, "httpsEnabled": 1, "httpPort": 8080,
	})
	expected, err := ReadConfig()
	if err != nil {
		t.Fatal(err)
	}
	next := *expected
	next.SSL = SSLConfig{Mode: ManagedSSLModeDefault, Challenge: SSLChallengeDNS, DefaultDirectory: "config/ssl"}
	// 模拟签发期间另一项设置先保存成功，续期不得用旧快照覆盖它。
	live := *expected
	live.HttpPort = 9080
	if err := WriteConfig(&live); err != nil {
		t.Fatal(err)
	}
	if err := WriteSSLConfig(expected, &next); err != nil {
		t.Fatal(err)
	}
	stored, err := ReadConfig()
	if err != nil {
		t.Fatal(err)
	}
	if stored.HttpPort != 9080 || next.HttpPort != 9080 || CurrentConfig().HttpPort != 9080 || stored.SSL != next.SSL {
		t.Fatalf("SSL 提交覆盖了其他设置：disk=%d next=%d runtime=%d", stored.HttpPort, next.HttpPort, CurrentConfig().HttpPort)
	}
	stale := *stored
	live = *stored
	live.WebDomain = "changed.example.test"
	if err := WriteConfig(&live); err != nil {
		t.Fatal(err)
	}
	if err := WriteSSLConfig(&stale, &stale); !errors.Is(err, ErrGenerationConflict) {
		t.Fatalf("签发期间域名变化必须拒绝旧结果：%v", err)
	}
}

// 审查专用：模拟配置落盘中断，只操作测试创建的临时配置根目录。
func TestAuditSuccessfulConfigRetryMustSurviveRestart(t *testing.T) {
	root := t.TempDir()
	writeRuntimeFixture(t, root, validRuntimeConfig())
	options := ConfigLoaderOptions{Validation: RuntimeValidationOptions{HasSuperAdmin: true, Production: true}}
	manager, err := NewConfigManager(root, options)
	if err != nil {
		t.Fatal(err)
	}
	current := manager.Snapshot()
	email := current.Email
	email.Policy.MaxMessageBytes = 8 << 20
	payload, err := json.Marshal(email)
	if err != nil {
		t.Fatal(err)
	}
	actor := authorizedConfigActor()
	updated, err := manager.Update(context.Background(), UpdateRequest{
		Section: SectionEmail, ExpectedGeneration: current.Generation, Payload: payload, Actor: actor,
	})
	if err != nil {
		t.Fatal(err)
	}
	interrupted := errors.New("审查注入的一次性分区提交失败")
	manager.transactions.WithHooks(TransactionHooks{BeforePhase: func(phase TransactionPhase) error {
		if phase == TransactionSectionsCommitted {
			return interrupted
		}
		return nil
	}})
	if _, err := manager.ApplyAuthorized(context.Background(), updated.Generation, actor); !errors.Is(err, interrupted) {
		t.Fatalf("中断前提不成立: %v", err)
	}
	manager.transactions.WithHooks(TransactionHooks{})
	if _, err := manager.ApplyAuthorized(context.Background(), updated.Generation, actor); err != nil {
		t.Fatalf("重试没有成功: %v", err)
	}
	before, err := NewConfigLoader(root, options).Load()
	if err != nil {
		t.Fatal(err)
	}
	if before.Generation != updated.Generation || before.Email.Policy.MaxMessageBytes != email.Policy.MaxMessageBytes {
		t.Fatal("重试结果未实际持久化")
	}
	restarted, err := NewConfigManager(root, options)
	if err != nil {
		t.Fatal(err)
	}
	after := restarted.Snapshot()
	t.Logf("successful_generation=%d before_restart=%d after_restart=%d expected_bytes=%d actual_bytes=%d", updated.Generation, before.Generation, after.Generation, email.Policy.MaxMessageBytes, after.Email.Policy.MaxMessageBytes)
	if after.Generation != before.Generation || after.Email.Policy.MaxMessageBytes != before.Email.Policy.MaxMessageBytes {
		t.Fatal("旧失败事务在启动恢复时撤销了后续已成功落盘的配置")
	}
}

// 记录真实后端候选状态约束，供前端丢失候选代次的复现使用。
func TestAuditPendingConfigBlocksFurtherUpdates(t *testing.T) {
	root := t.TempDir()
	writeRuntimeFixture(t, root, validRuntimeConfig())
	manager, err := NewConfigManager(root, ConfigLoaderOptions{Validation: RuntimeValidationOptions{HasSuperAdmin: true, Production: true}})
	if err != nil {
		t.Fatal(err)
	}
	current := manager.Snapshot()
	email := current.Email
	email.Policy.MaxMessageBytes = 8 << 20
	payload, err := json.Marshal(email)
	if err != nil {
		t.Fatal(err)
	}
	actor := authorizedConfigActor()
	request := UpdateRequest{Section: SectionEmail, ExpectedGeneration: current.Generation, Payload: payload, Actor: actor}
	updated, err := manager.Update(context.Background(), request)
	if err != nil {
		t.Fatal(err)
	}
	_, retryErr := manager.Update(context.Background(), request)
	if !errors.Is(retryErr, ErrGenerationConflict) {
		t.Fatalf("原会话再次保存的后端前提变化: %v", retryErr)
	}
	newActor := actor
	newActor.SessionID = "audit-new-session"
	request.Actor = newActor
	_, newSaveErr := manager.Update(context.Background(), request)
	_, newApplyErr := manager.ApplyAuthorized(context.Background(), updated.Generation, newActor)
	if !errors.Is(newSaveErr, ErrGenerationConflict) || !errors.Is(newApplyErr, ErrAuthorizationRequired) {
		t.Fatalf("重新登录后的后端前提变化: save=%v apply=%v", newSaveErr, newApplyErr)
	}
	t.Logf("active=%d pending=%d retry_conflict=%t new_session_save_conflict=%t new_session_apply_denied=%t", manager.Status().ActiveGeneration, updated.Generation, errors.Is(retryErr, ErrGenerationConflict), errors.Is(newSaveErr, ErrGenerationConflict), errors.Is(newApplyErr, ErrAuthorizationRequired))
	// 原会话保留代次时可以应用，问题不是所有应用请求都无条件失败。
	if _, err := manager.ApplyAuthorized(context.Background(), updated.Generation, actor); err != nil {
		t.Fatalf("原会话应用的对照组失败: %v", err)
	}
}

func TestAuditLegacyMigrationMustPreserveSQLiteLocation(t *testing.T) {
	root := t.TempDir()
	oldRoot := ROOT_PATH
	ROOT_PATH = root
	t.Cleanup(func() { ROOT_PATH = oldRoot })
	sourcePath := filepath.Join(root, "config", "archive", "review.db")
	if err := os.MkdirAll(filepath.Dir(sourcePath), 0700); err != nil {
		t.Fatal(err)
	}
	database, err := sql.Open("sqlite", sourcePath)
	if err != nil {
		t.Fatal(err)
	}
	defer database.Close()
	if _, err := database.Exec("CREATE TABLE audit_marker (value TEXT); INSERT INTO audit_marker VALUES ('original')"); err != nil {
		t.Fatal(err)
	}
	writeLegacyMigrationFixture(t, root, map[string]any{
		"logLevel": "info", "domain": "mail.example.test", "webDomain": "mail.example.test",
		"dbType": "sqlite", "dbDSN": "./config/archive/review.db", "isInit": true,
		"sslType": "1", "SSLPublicKeyPath": "./config/ssl/public.crt", "SSLPrivateKeyPath": "./config/ssl/private.key",
		"httpPort": 80, "httpsPort": 443, "httpsEnabled": 1,
	})
	before, err := ReadConfig()
	if err != nil || before.DbDSN != sourcePath {
		t.Fatalf("原配置读取路径前提不成立: %v", err)
	}
	if _, err := MigrateLegacyConfig(root, RuntimeValidationOptions{HasSuperAdmin: true, Production: true}); err != nil {
		t.Fatal(err)
	}
	after, err := ReadConfig()
	if err != nil {
		t.Fatal(err)
	}
	_, sourceErr := os.Stat(sourcePath)
	_, targetErr := os.Stat(after.DbDSN)
	target, err := sql.Open("sqlite", after.DbDSN)
	if err != nil {
		t.Fatal(err)
	}
	defer target.Close()
	var marker string
	queryErr := target.QueryRow("SELECT value FROM audit_marker").Scan(&marker)
	t.Logf("source_exists=%t target_missing_before_open=%t same_path=%t marker=%q query_error=%v",
		sourceErr == nil, os.IsNotExist(targetErr), before.DbDSN == after.DbDSN, marker, queryErr)
	if before.DbDSN != after.DbDSN || queryErr != nil || marker != "original" {
		t.Fatal("仅迁移配置不应把已有 SQLite 指向一个新建的空库")
	}
}