package httpserver

import (
	"context"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"git.yuntuo.hk/k2safe/orbit/internal/retention"
	core "git.yuntuo.hk/k2safe/orbit/model"
	"git.yuntuo.hk/k2safe/orbit/platform/auth"
)

type fakeArchiveManager struct {
	retention.SchedulerStore
	calls int
}

func (f *fakeArchiveManager) ListArchivePlans(context.Context, auth.Token) ([]retention.ArchivePlan, error) {
	f.calls++
	return []retention.ArchivePlan{}, nil
}
func TestArchiveRoutesRequireCookieAndRejectCrossOrigin(t *testing.T) {
	ns, _ := core.NewID()
	cred, _ := core.NewID()
	raw, _, _ := auth.Issue(ns, cred)
	volume, _ := core.NewID()
	authStore := &fakeConsoleAuth{valid: true}
	store := &fakeArchiveManager{}
	server := NewWithConsoleAuth("127.0.0.1:0", nil, authStore)
	RegisterConsoleArchiveJobs(server, authStore, store, volume)
	WrapConsoleAuth(server, authStore)
	tests := []struct {
		name, method, path, origin string
		cookie, bearer             bool
		status                     int
	}{
		{"no session", "GET", "/console/archive/plans", "", false, false, 401},
		{"bearer alone", "GET", "/console/archive/plans", "", false, true, 401},
		{"cookie read", "GET", "/console/archive/plans", "", true, false, 200},
		{"missing key", "PUT", "/console/archive/plans/tasks", "", true, false, 400},
		{"cross origin", "PUT", "/console/archive/plans/tasks", "https://foreign.invalid", true, false, 403},
		{"cross origin retry", "POST", "/console/archive/jobs/11111111111111111111111111111111/actions", "https://foreign.invalid", true, false, 403},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r := httptest.NewRequest(tt.method, tt.path, strings.NewReader(`{}`))
			r.Header.Set("Content-Type", "application/json")
			if tt.cookie {
				r.AddCookie(&http.Cookie{Name: consoleSessionCookie, Value: raw})
			}
			if tt.bearer {
				r.Header.Set("Authorization", "Bearer "+raw)
			}
			if tt.origin != "" {
				r.Header.Set("Origin", tt.origin)
			}
			w := httptest.NewRecorder()
			server.Handler.ServeHTTP(w, r)
			if w.Code != tt.status {
				t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
			}
		})
	}
	if store.calls != 1 {
		t.Fatal("unexpected store access", store.calls)
	}
}