package runtime

import (
	"net/http"
	"net/http/httptest"
	"sync/atomic"
	"testing"

	"github.com/stretchr/testify/require"
)

func TestDefaultHTTPClientOwnsHardenedTransport(t *testing.T) {
	t.Setenv("HTTPS_PROXY", "http://127.0.0.1:1")

	client := defaultHTTPClient()
	require.Equal(t, totalTimeout, client.Timeout)
	require.NotNil(t, client.CheckRedirect)

	transport, ok := client.Transport.(*http.Transport)
	require.True(t, ok)
	require.Nil(t, transport.Proxy)
	require.NotNil(t, transport.DialContext)

	dialer := providerDialer()
	require.Equal(t, connectTimeout, dialer.Timeout)
}

func TestDefaultHTTPClientRejectsRedirects(t *testing.T) {
	t.Parallel()

	var targetCalled atomic.Bool
	target := httptest.NewServer(http.HandlerFunc(func(
		w http.ResponseWriter,
		_ *http.Request,
	) {
		targetCalled.Store(true)
		w.WriteHeader(http.StatusOK)
	}))
	t.Cleanup(target.Close)
	redirect := httptest.NewServer(http.HandlerFunc(func(
		w http.ResponseWriter,
		request *http.Request,
	) {
		http.Redirect(w, request, target.URL, http.StatusFound)
	}))
	t.Cleanup(redirect.Close)

	response, err := defaultHTTPClient().Get(redirect.URL)
	require.NoError(t, err)
	t.Cleanup(func() { _ = response.Body.Close() })
	require.Equal(t, http.StatusFound, response.StatusCode)
	require.False(t, targetCalled.Load())
}