package gardener

import (
	"context"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"math/big"
	"testing"
	"time"

	"github.com/google/go-cmp/cmp"
	. "github.com/onsi/gomega"
	"github.com/pingcap/errors"
	appsv1 "k8s.io/api/apps/v1"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/utils/pointer"
	"sigs.k8s.io/controller-runtime/pkg/client/fake"
)

func TestDeployGracefulShutdownWebhook(t *testing.T) {
	g := NewGomegaWithT(t)
	client := fake.NewClientBuilder().Build()
	ctx := context.Background()

	_, err := deployGracefulShutdownWebhook(ctx, "ns", client, true)
	g.Expect(err).ShouldNot(Succeed())
	g.Expect(err.Error()).Should(MatchRegexp("unable to load certificates from secret ns/webhook-cert-secret"))

	// this secret should be created by cert manager
	secret := new(corev1.Secret)
	secret.Namespace = "ns"
	secret.Name = "webhook-cert-secret"
	certPem, keyPem, err := generateKeyPaire()
	g.Expect(err).Should(Succeed())
	secret.Data = map[string][]byte{
		corev1.ServiceAccountRootCAKey: []byte("aa"),
		corev1.TLSCertKey:              certPem,
		corev1.TLSPrivateKeyKey:        keyPem,
	}
	err = client.Create(ctx, secret)
	g.Expect(err).Should(Succeed())

	// should success now
	_, err = deployGracefulShutdownWebhook(ctx, "ns", client, true)
	g.Expect(err).Should(Succeed())

	// just check duplicate call will not cause error
	_, err = deployGracefulShutdownWebhook(ctx, "ns", client, true)
	g.Expect(err).Should(Succeed())

	// check deployment
	webhookLabels := map[string]string{
		"app": gracefulShutdownTiDBWebhookName,
	}

	deploy := &appsv1.Deployment{
		ObjectMeta: metav1.ObjectMeta{
			Name:      gracefulShutdownTiDBWebhookName,
			Namespace: "ns",
			Labels:    webhookLabels,
		},
		Spec: appsv1.DeploymentSpec{
			Replicas: pointer.Int32Ptr(1),
			Selector: &metav1.LabelSelector{
				MatchLabels: webhookLabels,
			},
			Template: corev1.PodTemplateSpec{
				ObjectMeta: metav1.ObjectMeta{
					Labels: webhookLabels,
				},
				Spec: corev1.PodSpec{
					ServiceAccountName: gracefulShutdownTiDBWebhookName,
					Containers: []corev1.Container{
						{
							Name:  "server",
							Image: gracefulShutdownTiDBWebhookImage,
							Ports: []corev1.ContainerPort{
								{
									Name:          "webhook-api",
									ContainerPort: int32(8443),
								},
							},
							VolumeMounts: []corev1.VolumeMount{
								{
									Name:      "webhook-tls-certs",
									MountPath: "/run/secrets/tls",
									ReadOnly:  true,
								},
							},
						},
					},
					Volumes: []corev1.Volume{
						{
							Name: "webhook-tls-certs",
							VolumeSource: corev1.VolumeSource{
								Secret: &corev1.SecretVolumeSource{
									SecretName: webhookCertSecretName,
								},
							},
						},
					},
				},
			},
		},
	}

	getDeploy := new(appsv1.Deployment)
	err = client.Get(ctx, types.NamespacedName{Namespace: "ns", Name: gracefulShutdownTiDBWebhookName}, getDeploy)
	g.Expect(err).Should(Succeed())
	diff := cmp.Diff(deploy.Spec, getDeploy.Spec)
	if diff != "" {
		t.Errorf("unexpected (-want, +got): %s", diff)
	}

	svc := &corev1.Service{
		ObjectMeta: metav1.ObjectMeta{
			Name:      gracefulShutdownTiDBWebhookName,
			Namespace: "ns",
		},
		Spec: corev1.ServiceSpec{
			Ports: []corev1.ServicePort{
				{
					Port:       443,
					TargetPort: intstr.FromString("webhook-api"),
					Protocol:   corev1.ProtocolTCP,
				},
			},
			Selector: webhookLabels,
		},
	}

	getSvc := new(corev1.Service)
	err = client.Get(ctx, types.NamespacedName{Namespace: "ns", Name: gracefulShutdownTiDBWebhookName}, getSvc)
	g.Expect(err).Should(Succeed())
	diff = cmp.Diff(svc.Spec, getSvc.Spec)
	if diff != "" {
		t.Errorf("unexpected (-want, +got): %s", diff)
	}
}

func generateKeyPaire() (certPem []byte, keyPem []byte, err error) {
	// Generate private key
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, errors.AddStack(err)
	}

	// Generate a pem block with the private key
	keyPem = pem.EncodeToMemory(&pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(key),
	})

	tml := x509.Certificate{
		// you can add any attr that you need
		NotBefore: time.Now(),
		NotAfter:  time.Now().AddDate(5, 0, 0),
		// you have to generate a different serial number each execution
		SerialNumber: big.NewInt(123123),
		Subject: pkix.Name{
			CommonName:   "New Name",
			Organization: []string{"New Org."},
		},
		BasicConstraintsValid: true,
	}
	cert, err := x509.CreateCertificate(rand.Reader, &tml, &tml, &key.PublicKey, key)
	if err != nil {
		return nil, nil, errors.AddStack(err)
	}

	// Generate a pem block with the certificate
	certPem = pem.EncodeToMemory(&pem.Block{
		Type:  "CERTIFICATE",
		Bytes: cert,
	})

	return certPem, keyPem, nil
}