package aws

import (
	"testing"

	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
	caasmcollector "security-center-backend/internal/modules/caasm/collector"
)

func TestProcessInstanceEmitsPrivateIPAssetAndPrivatePort(t *testing.T) {
	col := &AWSCollector{}
	result := &caasmcollector.AssetResult{}
	instanceID := "i-private"
	privateIP := "10.0.1.25"
	groupID := "sg-private"

	instance := ec2types.Instance{
		InstanceId:       &instanceID,
		PrivateIpAddress: &privateIP,
		State:            &ec2types.InstanceState{Name: ec2types.InstanceStateNameRunning},
		SecurityGroups:   []ec2types.GroupIdentifier{{GroupId: &groupID}},
	}
	securityGroups := map[string]ec2types.SecurityGroup{
		groupID: {
			GroupId: &groupID,
			IpPermissions: []ec2types.IpPermission{
				{
					FromPort:   int32Ptr(22),
					ToPort:     int32Ptr(22),
					IpProtocol: awsStringPtr("tcp"),
					IpRanges:   []ec2types.IpRange{{CidrIp: awsStringPtr("10.0.0.0/16")}},
				},
			},
		},
	}

	col.processInstance(instance, securityGroups, "ap-northeast-1", result)

	if got := len(result.Assets); got != 1 {
		t.Fatalf("asset count = %d, want 1", got)
	}
	if got := result.Assets[0].Service; got != "EC2" {
		t.Fatalf("asset service = %q, want EC2", got)
	}
	if got := len(result.IPAssets); got != 1 {
		t.Fatalf("ip asset count = %d, want 1", got)
	}
	if got := result.IPAssets[0].IPAddress; got != privateIP {
		t.Fatalf("private ip asset address = %q, want %q", got, privateIP)
	}
	if result.IPAssets[0].IsPublic {
		t.Fatal("private ip asset should not be public")
	}
	if got := len(result.Ports); got != 1 {
		t.Fatalf("port count = %d, want 1", got)
	}
	if got := result.Ports[0].IPAddress; got != privateIP {
		t.Fatalf("port ip = %q, want %q", got, privateIP)
	}
	if got := result.Ports[0].Exposure; got != "private" {
		t.Fatalf("port exposure = %q, want private", got)
	}
}

func TestProcessInstanceEmitsPublicAndPrivateIPAssetsAndUsesPublicIPForPublicRule(t *testing.T) {
	col := &AWSCollector{}
	result := &caasmcollector.AssetResult{}
	instanceID := "i-public"
	privateIP := "10.0.2.10"
	publicIP := "54.240.10.10"
	groupID := "sg-public"

	instance := ec2types.Instance{
		InstanceId:       &instanceID,
		PrivateIpAddress: &privateIP,
		PublicIpAddress:  &publicIP,
		State:            &ec2types.InstanceState{Name: ec2types.InstanceStateNameRunning},
		SecurityGroups:   []ec2types.GroupIdentifier{{GroupId: &groupID}},
	}
	securityGroups := map[string]ec2types.SecurityGroup{
		groupID: {
			GroupId: &groupID,
			IpPermissions: []ec2types.IpPermission{
				{
					FromPort:   int32Ptr(443),
					ToPort:     int32Ptr(443),
					IpProtocol: awsStringPtr("tcp"),
					IpRanges:   []ec2types.IpRange{{CidrIp: awsStringPtr("0.0.0.0/0")}},
				},
			},
		},
	}

	col.processInstance(instance, securityGroups, "ap-northeast-1", result)

	if got := len(result.IPAssets); got != 2 {
		t.Fatalf("ip asset count = %d, want 2", got)
	}
	if got := result.Assets[0].Service; got != "EC2" {
		t.Fatalf("asset service = %q, want EC2", got)
	}
	if result.IPAssets[0].IPAddress != privateIP || result.IPAssets[0].IsPublic {
		t.Fatalf("first ip asset = %+v, want private ip asset", result.IPAssets[0])
	}
	if result.IPAssets[1].IPAddress != publicIP || !result.IPAssets[1].IsPublic {
		t.Fatalf("second ip asset = %+v, want public ip asset", result.IPAssets[1])
	}
	if got := len(result.Ports); got != 1 {
		t.Fatalf("port count = %d, want 1", got)
	}
	if got := result.Ports[0].IPAddress; got != publicIP {
		t.Fatalf("port ip = %q, want public ip %q", got, publicIP)
	}
	if got := result.Ports[0].Exposure; got != "public" {
		t.Fatalf("port exposure = %q, want public", got)
	}
	if got := result.Ports[0].ServiceName; got != "https" {
		t.Fatalf("service name = %q, want https", got)
	}
}

func TestProcessInstanceKeepsPrivateExposureWhenNoPublicIPExists(t *testing.T) {
	col := &AWSCollector{}
	result := &caasmcollector.AssetResult{}
	instanceID := "i-private-public-rule"
	privateIP := "10.0.3.10"
	groupID := "sg-public-no-eip"

	instance := ec2types.Instance{
		InstanceId:       &instanceID,
		PrivateIpAddress: &privateIP,
		State:            &ec2types.InstanceState{Name: ec2types.InstanceStateNameRunning},
		SecurityGroups:   []ec2types.GroupIdentifier{{GroupId: &groupID}},
	}
	securityGroups := map[string]ec2types.SecurityGroup{
		groupID: {
			GroupId: &groupID,
			IpPermissions: []ec2types.IpPermission{
				{
					FromPort:   int32Ptr(443),
					ToPort:     int32Ptr(443),
					IpProtocol: awsStringPtr("tcp"),
					IpRanges:   []ec2types.IpRange{{CidrIp: awsStringPtr("0.0.0.0/0")}},
				},
			},
		},
	}

	col.processInstance(instance, securityGroups, "ap-northeast-1", result)

	if got := len(result.IPAssets); got != 1 {
		t.Fatalf("ip asset count = %d, want 1", got)
	}
	if got := len(result.Ports); got != 1 {
		t.Fatalf("port count = %d, want 1", got)
	}
	if got := result.Ports[0].IPAddress; got != privateIP {
		t.Fatalf("port ip = %q, want private ip %q", got, privateIP)
	}
	if got := result.Ports[0].Exposure; got != "private" {
		t.Fatalf("port exposure = %q, want private", got)
	}
}

func int32Ptr(v int32) *int32 {
	return &v
}

func awsStringPtr(v string) *string {
	return &v
}