package gateway

import (
	"encoding/base64"
	"strings"
	"testing"

	"github.com/stretchr/testify/require"
)

func TestLegacyAGSAuthorizationKeepsCredentialFirstUntilC2Deletion(t *testing.T) {
	t.Parallel()

	basic := base64.StdEncoding.EncodeToString([]byte("git:ags_rat_secret"))
	basicPasswordColon := base64.StdEncoding.EncodeToString([]byte("git:secret:with:colons"))
	for _, test := range []struct {
		name   string
		values []string
		want   legacyAGSAuthority
	}{
		{name: "missing", want: legacyAGSAuthorityMissing},
		{name: "canonical session", values: []string{"Bearer " + strings.Repeat("s", 43)}, want: legacyAGSAuthoritySession},
		{name: "repository bearer", values: []string{"Bearer ags_rat_secret"}, want: legacyAGSAuthorityRepositoryCredential},
		{name: "repository token", values: []string{"Token existing-ags-token"}, want: legacyAGSAuthorityRepositoryCredential},
		{name: "repository basic", values: []string{"Basic " + basic}, want: legacyAGSAuthorityRepositoryCredential},
		{name: "repository basic password colons", values: []string{"Basic " + basicPasswordColon}, want: legacyAGSAuthorityRepositoryCredential},
		{name: "token shared ASCII credential set", values: []string{"Token azAZ09!#$%&'*+-.^_`|~:/="}, want: legacyAGSAuthorityRepositoryCredential},
		{name: "arbitrary bearer is not credential", values: []string{"Bearer future_credential"}, want: legacyAGSAuthorityMalformed},
		{name: "empty repository prefix", values: []string{"Bearer ags_rat_"}, want: legacyAGSAuthorityMalformed},
		{name: "empty token", values: []string{"Token "}, want: legacyAGSAuthorityMalformed},
		{name: "token control", values: []string{"Token bad\ttoken"}, want: legacyAGSAuthorityMalformed},
		{name: "token unicode", values: []string{"Token 令牌"}, want: legacyAGSAuthorityMalformed},
		{name: "token emoji", values: []string{"Token 💩"}, want: legacyAGSAuthorityMalformed},
		{name: "repository bearer unicode", values: []string{"Bearer ags_rat_令牌"}, want: legacyAGSAuthorityMalformed},
		{name: "oversized token", values: []string{"Token " + strings.Repeat("a", maxLegacyAGSAuthorizationBytes)}, want: legacyAGSAuthorityMalformed},
		{name: "basic without password", values: []string{"Basic " + base64.StdEncoding.EncodeToString([]byte("git:"))}, want: legacyAGSAuthorityMalformed},
		{name: "duplicate", values: []string{"Token one", "Token two"}, want: legacyAGSAuthorityMalformed},
	} {
		t.Run(test.name, func(t *testing.T) {
			require.Equal(t, test.want, classifyLegacyAGSAuthorization(test.values))
		})
	}
}