package decisionpep

import (
	"context"
	"crypto/ed25519"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/base64"
	"encoding/json"
	"encoding/pem"
	"io"
	"math/big"
	"net/http"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"github.com/netkingdom/access-engine/internal/sign"
	"github.com/netkingdom/access-engine/pkg/api"
)

type transportFunc func(*http.Request) (*http.Response, error)

func (f transportFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
func testClient(t *testing.T) (*Client, ed25519.PrivateKey, time.Time) {
	t.Helper()
	pub, key, e := ed25519.GenerateKey(rand.Reader)
	if e != nil {
		t.Fatal(e)
	}
	now := time.Date(2026, 10, 18, 1, 2, 3, 0, time.UTC)
	dir := t.TempDir()
	cert, e := x509.CreateCertificate(rand.Reader, &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "test-only"}, NotBefore: now.Add(-time.Hour), NotAfter: now.Add(time.Hour), IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign}, &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "test-only"}, NotBefore: now.Add(-time.Hour), NotAfter: now.Add(time.Hour), IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign}, pub, key)
	if e != nil {
		t.Fatal(e)
	}
	ca := filepath.Join(dir, "ca.pem")
	token := filepath.Join(dir, "token")
	if e = os.WriteFile(ca, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert}), 0600); e != nil {
		t.Fatal(e)
	}
	if e = os.WriteFile(token, []byte("synthetic-caller-token"), 0600); e != nil {
		t.Fatal(e)
	}
	a := Admission{Endpoint: "https://pdp.invalid/v1/check", CAFile: ca, TokenFile: token, Keys: map[string]string{"test-key": base64.RawURLEncoding.EncodeToString(pub)}, Evaluator: "flex-auth/local", PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyDigest: "sha256:" + strings.Repeat("1", 64), RegistryDigest: "sha256:" + strings.Repeat("2", 64), CallerPrincipal: "system:serviceaccount:test:forgejo", CallerAudience: "access-engine", MaxTTL: "30s", MaxClockSkew: "1s"}
	c, e := New(a)
	if e != nil {
		t.Fatal(e)
	}
	c.now = func() time.Time { return now }
	return c, key, now
}
func testRequest() api.CheckRequest {
	return api.CheckRequest{Tenant: "tenant:test", Subject: api.SubjectRef{ID: "subject:test", Type: api.SubjectType("Human"), Tenant: "tenant:test", Attributes: map[string]any{"groups": []string{"engineers"}}}, Action: "application.access", Resource: api.ResourceRef{ID: "application:forgejo", Type: "application", System: "forgejo", Tenant: "tenant:test"}, Context: map[string]any{"big": json.Number("9007199254740993"), "fraction": json.Number("0.123456789123456789")}}
}
func envelope(c *Client, r api.CheckRequest, key ed25519.PrivateKey, now time.Time) api.DecisionEnvelope {
	e := api.DecisionEnvelope{ID: "test-decision", RequestID: r.ID, Effect: api.DecisionEffectAllow, MatchedPolicyVersion: c.admission.PolicyVersion, Subject: r.Subject, Resource: r.Resource, Binding: api.NewDecisionBindingFor(r, r), Provenance: api.DecisionProvenance{Evaluator: c.admission.Evaluator, Mode: provenanceMode, PolicyPackage: c.admission.PolicyPackage, PolicyVersion: c.admission.PolicyVersion, PolicyPackageDigest: c.admission.PolicyDigest, RegistrySnapshotDigest: c.admission.RegistryDigest, Caller: &api.CallerProvenance{Mode: "enforce", Principal: c.admission.CallerPrincipal, Audience: c.admission.CallerAudience, NotAfter: now.Add(time.Minute).Format(time.RFC3339Nano)}}}
	api.CompleteDecision(&e, r, api.DecisionCompletion{AllowTTL: "10s", Now: now})
	if sign.Sign(&e, key, "test-key") != nil {
		panic("test sign")
	}
	return e
}
func respond(t *testing.T, c *Client, key ed25519.PrivateKey, now time.Time, mutate func(*api.DecisionEnvelope), resign bool) {
	t.Helper()
	c.http = &http.Client{Transport: transportFunc(func(req *http.Request) (*http.Response, error) {
		if req.Header.Get("Access-Engine-JSON-Profile") != JSONProfile {
			t.Fatal("missing lossless profile")
		}
		if req.Header.Get("Authorization") != "Bearer synthetic-caller-token" {
			t.Fatal("wrong synthetic caller token")
		}
		var r api.CheckRequest
		d := json.NewDecoder(req.Body)
		d.UseNumber()
		if d.Decode(&r) != nil {
			t.Fatal("request decode")
		}
		if r.Context["big"] != json.Number("9007199254740993") || r.Context["fraction"] != json.Number("0.123456789123456789") {
			t.Fatal("request numeric precision lost")
		}
		if len(r.Context[nonceKey].(string)) != 64 || r.ID != r.Context[nonceKey] {
			t.Fatal("nonce")
		}
		e := envelope(c, r, key, now)
		if mutate != nil {
			mutate(&e)
		}
		if resign {
			if sign.Sign(&e, key, "test-key") != nil {
				t.Fatal("sign")
			}
		}
		b, err := json.Marshal(e)
		if err != nil {
			t.Fatal(err)
		}
		return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(string(b))), Header: http.Header{}}, nil
	})}
}
func TestAuthenticDecisionProducerCanonicalPrecision(t *testing.T) {
	c, key, now := testClient(t)
	respond(t, c, key, now, nil, false)
	e, err := c.Check(context.Background(), testRequest())
	if err != nil {
		t.Fatal(err)
	}
	if e.Binding.Context["big"] != json.Number("9007199254740993") || e.Binding.Context["fraction"] != json.Number("0.123456789123456789") {
		t.Fatal("signed typed precision lost")
	}
	if sign.Verify(e, c.keys) != nil {
		t.Fatal("returned envelope not authentic producer bytes")
	}
}
func TestDecisionAdverseBindings(t *testing.T) {
	cases := map[string]func(*api.DecisionEnvelope){
		"unsigned":      func(e *api.DecisionEnvelope) { e.Signature = api.UnsignedEnvelopeSignature() },
		"effect":        func(e *api.DecisionEnvelope) { e.Effect = api.DecisionEffectDeny },
		"evaluator":     func(e *api.DecisionEnvelope) { e.Provenance.Evaluator = "impostor" },
		"policy":        func(e *api.DecisionEnvelope) { e.Provenance.PolicyPackage = "other" },
		"version":       func(e *api.DecisionEnvelope) { e.Provenance.PolicyVersion = "v2" },
		"policy-digest": func(e *api.DecisionEnvelope) { e.Provenance.PolicyPackageDigest = "sha256:" + strings.Repeat("3", 64) },
		"registry": func(e *api.DecisionEnvelope) {
			e.Provenance.RegistrySnapshotDigest = "sha256:" + strings.Repeat("4", 64)
		},
		"tenant":                 func(e *api.DecisionEnvelope) { e.Binding.Tenant = "other" },
		"actor":                  func(e *api.DecisionEnvelope) { e.Binding.Subject.ID = "other" },
		"action":                 func(e *api.DecisionEnvelope) { e.Binding.Action = "write" },
		"resource":               func(e *api.DecisionEnvelope) { e.Binding.Resource.ID = "other" },
		"purpose":                func(e *api.DecisionEnvelope) { e.Binding.Purpose = "readback" },
		"submitted":              func(e *api.DecisionEnvelope) { e.Binding.SubmittedRequestDigest = "wrong" },
		"context":                func(e *api.DecisionEnvelope) { e.Binding.Context["fraction"] = json.Number("0.123456789123456788") },
		"legacy-numeric-profile": func(e *api.DecisionEnvelope) { e.Provenance.Mode = "standalone" },
		"caller-warn":            func(e *api.DecisionEnvelope) { e.Provenance.Caller.Mode = "warn" },
		"caller-principal":       func(e *api.DecisionEnvelope) { e.Provenance.Caller.Principal = "other" },
		"caller-audience":        func(e *api.DecisionEnvelope) { e.Provenance.Caller.Audience = "other" },
		"caller-expired":         func(e *api.DecisionEnvelope) { e.Provenance.Caller.NotAfter = "2020-01-01T00:00:00Z" },
		"stale-decision":         func(e *api.DecisionEnvelope) { e.Provenance.DecisionTime = "2020-01-01T00:00:00Z" },
		"expired":                func(e *api.DecisionEnvelope) { e.Lifetime.ExpiresAt = "2020-01-01T00:00:00Z" },
		"future-begin":           func(e *api.DecisionEnvelope) { e.Lifetime.NotBefore = "2030-01-01T00:00:00Z" },
		"subnanosecond-expiry":   func(e *api.DecisionEnvelope) { e.Lifetime.ExpiresAt = "2026-10-18T01:02:02.999999999Z" },
		"missing-TTL":            func(e *api.DecisionEnvelope) { e.Lifetime = nil },
		"excess-TTL":             func(e *api.DecisionEnvelope) { e.Lifetime.TTL = "1h" },
		"obligation":             func(e *api.DecisionEnvelope) { e.Obligations = []api.Obligation{{Type: "unimplemented"}} },
	}
	for name, mutation := range cases {
		t.Run(name, func(t *testing.T) {
			c, key, now := testClient(t)
			respond(t, c, key, now, mutation, name != "unsigned")
			if _, err := c.Check(context.Background(), testRequest()); err == nil {
				t.Fatal("accepted wrong signed binding")
			}
		})
	}
}
func TestSignatureForgeryAndReplay(t *testing.T) {
	t.Run("forged-payload", func(t *testing.T) {
		c, key, now := testClient(t)
		respond(t, c, key, now, func(e *api.DecisionEnvelope) { e.Reason = "changed after signature" }, false)
		if _, e := c.Check(context.Background(), testRequest()); e == nil {
			t.Fatal("forgery accepted")
		}
	})
	t.Run("wrong-key", func(t *testing.T) {
		c, _, now := testClient(t)
		_, key, _ := ed25519.GenerateKey(rand.Reader)
		respond(t, c, key, now, nil, false)
		if _, e := c.Check(context.Background(), testRequest()); e == nil {
			t.Fatal("wrong key accepted")
		}
	})
	t.Run("replay", func(t *testing.T) {
		c, key, now := testClient(t)
		var saved []byte
		c.http = &http.Client{Transport: transportFunc(func(req *http.Request) (*http.Response, error) {
			if saved == nil {
				var r api.CheckRequest
				d := json.NewDecoder(req.Body)
				d.UseNumber()
				if d.Decode(&r) != nil {
					t.Fatal("decode")
				}
				e := envelope(c, r, key, now)
				saved, _ = json.Marshal(e)
			}
			return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(string(saved)))}, nil
		})}
		if _, e := c.Check(context.Background(), testRequest()); e != nil {
			t.Fatal(e)
		}
		if _, e := c.Check(context.Background(), testRequest()); e == nil {
			t.Fatal("old decision replay accepted for new nonce")
		}
	})
}
func TestUnavailableAndPublicTokenFileRefuse(t *testing.T) {
	c, _, _ := testClient(t)
	c.http = &http.Client{Transport: transportFunc(func(*http.Request) (*http.Response, error) { return nil, io.ErrUnexpectedEOF })}
	if _, e := c.Check(context.Background(), testRequest()); e == nil {
		t.Fatal("unavailable allowed")
	}
	if e := os.Chmod(c.admission.TokenFile, 0644); e != nil {
		t.Fatal(e)
	}
	if _, e := c.Check(context.Background(), testRequest()); e == nil {
		t.Fatal("public token file allowed")
	}
}