package controllers

import (
	"encoding/json"
	"net/http"
	"net/http/cookiejar"
	"net/http/httptest"
	"net/url"
	"strings"
	"testing"

	"git.pcux.cn/xuans/Smail/db"
	"git.pcux.cn/xuans/Smail/dto/response"
	"git.pcux.cn/xuans/Smail/models"
	"git.pcux.cn/xuans/Smail/services/access"
	"git.pcux.cn/xuans/Smail/services/credentials"
	"git.pcux.cn/xuans/Smail/services/externalemail"
	"git.pcux.cn/xuans/Smail/services/verification"
	appcontext "git.pcux.cn/xuans/Smail/utils/context"
)

// 真实控制器约束对照：输错后绑定仍待验证，重新绑定失败，但原挑战可继续验证。
func TestAuditPendingExternalBindingRequiresExistingChallenge(t *testing.T) {
	_, _, engine, user, _ := newPublicSecurityFixture(t)
	previousDB := db.Instance
	db.Instance = engine
	t.Cleanup(func() { db.Instance = previousDB })
	if err := engine.Sync2(new(models.UserEmail)); err != nil {
		t.Fatal(err)
	}
	previous := securityRuntime
	t.Cleanup(func() { securityRuntime = previous })
	vault := externalemail.NewVaultWithKeys([]byte("01234567890123456789012345678901"), []byte("abcdefabcdefabcdefabcdefabcdefab"))
	repo, err := externalemail.NewRepository(engine, vault)
	if err != nil {
		t.Fatal(err)
	}
	store, err := verification.NewStore(32)
	if err != nil {
		t.Fatal(err)
	}
	var issued verification.Challenge
	var deliveredCode string
	service, err := verification.NewService(store, func(challenge verification.Challenge, code string) error {
		issued, deliveredCode = challenge, code
		return nil
	}, nil)
	if err != nil {
		t.Fatal(err)
	}
	securityRuntime.external, securityRuntime.verification = repo, service
	ctx := &appcontext.Context{UserID: user.ID, UserAccount: user.Account, Role: access.RoleUser, RecentAuth: true, Lang: "zhCn"}
	invoke := func(handler func(*appcontext.Context, http.ResponseWriter, *http.Request), input any) response.Response {
		t.Helper()
		body, err := json.Marshal(input)
		if err != nil {
			t.Fatal(err)
		}
		recorder := httptest.NewRecorder()
		request := httptest.NewRequest(http.MethodPost, "https://example.com/api/v1/security/external-email", strings.NewReader(string(body)))
		request.RemoteAddr = "192.0.2.10:12345"
		handler(ctx, recorder, request)
		var result response.Response
		if err := json.Unmarshal(recorder.Body.Bytes(), &result); err != nil {
			t.Fatal(err)
		}
		return result
	}
	bind := map[string]any{"email": "binding@example.com", "type": "backup"}
	if result := invoke(BindExternalEmail, bind); result.ErrorNo != 0 || issued.ID == "" || deliveredCode == "" {
		t.Fatalf("首次绑定前置条件未成立: error=%d", result.ErrorNo)
	}
	check := map[string]any{"id": issued.ID, "binding_id": issued.ResourceID, "email": "binding@example.com", "code": "incorrect"}
	wrong := invoke(VerifyExternalEmail, check)
	if wrong.ErrorNo == 0 {
		t.Fatal("错误验证码意外通过")
	}
	var stored models.ExternalEmail
	if has, err := engine.ID(issued.ResourceID).Get(&stored); err != nil || !has || stored.Status != models.ExternalEmailStatusPending {
		t.Fatalf("错误验证码后绑定状态异常: found=%v err=%v status=%s", has, err, stored.Status)
	}
	retry := invoke(BindExternalEmail, bind)
	if retry.ErrorNo == 0 {
		t.Fatal("重复绑定应被真实仓储拒绝，前端必须恢复原挑战")
	}
	check["code"] = deliveredCode
	continued := invoke(VerifyExternalEmail, check)
	if continued.ErrorNo != 0 {
		t.Fatalf("原挑战正确验证码未通过: error=%d", continued.ErrorNo)
	}
	t.Logf("after_wrong_status=%s retry_bind_error=%d continued_verify_error=%d", stored.Status, retry.ErrorNo, continued.ErrorNo)
}

// 使用临时数据库和真实控制器，正向验证授权器允许的角色调整能够到达持久化。
func TestAuditAuthorizedRoleChangeMustSucceed(t *testing.T) {
	_, _, engine, user, super := newPublicSecurityFixture(t)
	previousDB, previousRuntime := db.Instance, securityRuntime
	db.Instance = engine
	t.Cleanup(func() {
		db.Instance = previousDB
		securityRuntime = previousRuntime
	})
	credentialService, err := credentials.NewService(engine)
	if err != nil {
		t.Fatal(err)
	}
	securityRuntime.credentials = credentialService
	if _, err := credentialService.GenerateRecoveryCodes(user.ID, 5); err != nil {
		t.Fatal(err)
	}
	request := access.Request{
		ActorRole: access.RoleSuperAdmin, Capability: access.CapabilityRoleManage,
		TargetRole: access.RoleUser, NewRole: access.RoleAdmin,
		RecentAuth: true, TargetRecoveryConfigured: true,
	}
	if err := access.Authorize(request); err != nil {
		t.Fatalf("角色变更授权前置条件未成立: %v", err)
	}
	ctx := &appcontext.Context{
		UserID: super.ID, UserAccount: super.Account, Role: access.RoleSuperAdmin,
		RecentAuth: true, Lang: "zhCn",
	}
	result := editUserRequest(t, ctx, `{"id":`+itoa(user.ID)+`,"role":"admin","disabled":0}`)
	var stored models.User
	if found, err := engine.ID(user.ID).Get(&stored); err != nil || !found {
		t.Fatalf("读取目标角色失败: found=%v err=%v", found, err)
	}
	t.Logf("policy_allows=true controller_error=%d stored_role=%s", result, stored.EffectiveRole())
	if result != 0 || stored.EffectiveRole() != access.RoleAdmin {
		t.Fatal("符合近期认证和目标恢复码条件的超级管理员仍无法修改用户角色")
	}
	if stored.SessionVersion <= user.SessionVersion || stored.SecurityVersion <= user.SecurityVersion {
		t.Fatal("纯角色变更必须同时提升会话版本和安全版本")
	}
}

// 使用真实 TLS HTTP 客户端及标准 CookieJar 检查浏览器同样遵循的 Path 匹配。
// 只核对 Cookie 是否随请求携带，不把隔离发送器当成真实邮件投递验收。
func TestAuditRecoveryCookieMustReachVersionedAPI(t *testing.T) {
	for _, prefix := range []string{"/api/security/recovery", "/api/v1/security/recovery"} {
		t.Run(prefix, func(t *testing.T) {
			enablePublicRecoveryForTest(t)
			recover, _, _, _, _ := newPublicSecurityFixture(t)
			previous := securityRuntime
			securityRuntime.recovery = recover
			t.Cleanup(func() { securityRuntime = previous })
			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				if strings.HasSuffix(r.URL.Path, "/begin") {
					BeginPasswordRecovery(&appcontext.Context{}, w, r)
					return
				}
				_, ok := recoveryBrowserContext(r, w, false)
				_ = json.NewEncoder(w).Encode(map[string]bool{"context_received": ok})
			}))
			defer server.Close()
			client := server.Client()
			jar, err := cookiejar.New(nil)
			if err != nil {
				t.Fatal(err)
			}
			client.Jar = jar
			begin, err := client.Post(server.URL+prefix+"/begin", "application/json", strings.NewReader(`{"identifier":"alice","email":"alice@example.com"}`))
			if err != nil {
				t.Fatal(err)
			}
			var result response.Response
			err = json.NewDecoder(begin.Body).Decode(&result)
			_ = begin.Body.Close()
			if err != nil || result.ErrorNo != 0 {
				t.Fatalf("恢复申请前置条件失败: code=%d err=%v", result.ErrorNo, err)
			}
			cookiePath := ""
			for _, cookie := range begin.Cookies() {
				if cookie.Name == recoveryContextCookieName {
					cookiePath = cookie.Path
				}
			}
			if cookiePath == "" {
				t.Fatal("恢复申请没有签发浏览器上下文 Cookie")
			}
			target, err := url.Parse(server.URL + prefix + "/verify")
			if err != nil {
				t.Fatal(err)
			}
			verify, err := client.Get(target.String())
			if err != nil {
				t.Fatal(err)
			}
			var received struct {
				ContextReceived bool `json:"context_received"`
			}
			err = json.NewDecoder(verify.Body).Decode(&received)
			_ = verify.Body.Close()
			if err != nil {
				t.Fatal(err)
			}
			t.Logf("request_prefix=%s cookie_path=%s sent_cookie_count=%d context_received=%v", prefix, cookiePath, len(jar.Cookies(target)), received.ContextReceived)
			if !received.ContextReceived {
				t.Fatal("恢复上下文 Cookie 的路径不覆盖前端使用的版本化接口，后续验证无法获取上下文")
			}
		})
	}
}