package api

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"
)

func TestRequireBearerToken(t *testing.T) {
	t.Parallel()
	gin.SetMode(gin.TestMode)

	tok := func(name, secret string) BearerToken { return BearerToken{Name: name, Secret: secret} }

	tests := []struct {
		name       string
		configured []BearerToken
		header     string
		wantStatus int
	}{
		{name: "valid", configured: []BearerToken{tok("primary", "shared-secret")}, header: "Bearer shared-secret", wantStatus: http.StatusNoContent},
		{name: "case insensitive scheme", configured: []BearerToken{tok("primary", "shared-secret")}, header: "bearer shared-secret", wantStatus: http.StatusNoContent},
		{name: "matches first of many", configured: []BearerToken{tok("new", "new-secret"), tok("old", "old-secret")}, header: "Bearer new-secret", wantStatus: http.StatusNoContent},
		{name: "matches later of many", configured: []BearerToken{tok("new", "new-secret"), tok("old", "old-secret")}, header: "Bearer old-secret", wantStatus: http.StatusNoContent},
		{name: "missing", configured: []BearerToken{tok("primary", "shared-secret")}, wantStatus: http.StatusUnauthorized},
		{name: "wrong", configured: []BearerToken{tok("primary", "shared-secret")}, header: "Bearer wrong", wantStatus: http.StatusUnauthorized},
		{name: "wrong among many", configured: []BearerToken{tok("new", "new-secret"), tok("old", "old-secret")}, header: "Bearer other", wantStatus: http.StatusUnauthorized},
		{name: "wrong scheme", configured: []BearerToken{tok("primary", "shared-secret")}, header: "Basic shared-secret", wantStatus: http.StatusUnauthorized},
		{name: "not configured", header: "Bearer shared-secret", wantStatus: http.StatusServiceUnavailable},
		{name: "empty slice not configured", configured: []BearerToken{}, header: "Bearer shared-secret", wantStatus: http.StatusServiceUnavailable},
	}

	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			router := gin.New()
			router.POST("/webhook", requireBearerToken(test.configured), func(c *gin.Context) {
				c.Status(http.StatusNoContent)
			})
			req := httptest.NewRequest(http.MethodPost, "/webhook", nil)
			if test.header != "" {
				req.Header.Set("Authorization", test.header)
			}
			resp := httptest.NewRecorder()

			router.ServeHTTP(resp, req)

			require.Equal(t, test.wantStatus, resp.Code)
		})
	}
}

func TestRequireBearerTokenRecordsTokenName(t *testing.T) {
	t.Parallel()
	gin.SetMode(gin.TestMode)

	router := gin.New()
	var got string
	router.POST("/webhook",
		requireBearerToken([]BearerToken{{Name: "new", Secret: "new-secret"}, {Name: "old", Secret: "old-secret"}}),
		func(c *gin.Context) {
			got = c.GetString("webhook_token_name")
			c.Status(http.StatusNoContent)
		})
	req := httptest.NewRequest(http.MethodPost, "/webhook", nil)
	req.Header.Set("Authorization", "Bearer old-secret")
	resp := httptest.NewRecorder()

	router.ServeHTTP(resp, req)

	require.Equal(t, http.StatusNoContent, resp.Code)
	require.Equal(t, "old", got)
}

func TestAlertmanagerWebhookRoutesRequireAuthentication(t *testing.T) {
	t.Parallel()
	gin.SetMode(gin.TestMode)

	server := &Server{
		router:             gin.New(),
		alertmanagerTokens: []BearerToken{{Name: "primary", Secret: "shared-secret"}},
	}
	server.setupRoutes()

	for _, path := range []string{
		"/webhooks/alertmanager",
		"/public/v1/alertstore/webhooks/alertmanager",
	} {
		path := path
		t.Run(path, func(t *testing.T) {
			t.Parallel()
			req := httptest.NewRequest(http.MethodPost, path, nil)
			resp := httptest.NewRecorder()

			server.router.ServeHTTP(resp, req)

			require.Equal(t, http.StatusUnauthorized, resp.Code)
		})
	}
}