package main

import (
	"context"
	"encoding/binary"
	"encoding/json"
	"io"
	"net"
	"strings"
	"testing"

	"git.ipao.vip/rogee/creator-hub/internal/hub"
)

func TestSOCKS4DialerUsesBoundProxy(t *testing.T) {
	listener, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	defer listener.Close()
	done := make(chan error, 1)
	go func() {
		connection, err := listener.Accept()
		if err != nil {
			done <- err
			return
		}
		defer connection.Close()
		header := make([]byte, 8)
		if _, err := io.ReadFull(connection, header); err != nil {
			done <- err
			return
		}
		user := make([]byte, 0, 16)
		for {
			var value [1]byte
			if _, err := io.ReadFull(connection, value[:]); err != nil {
				done <- err
				return
			}
			if value[0] == 0 {
				break
			}
			user = append(user, value[0])
		}
		if header[0] != 4 || header[1] != 1 || binary.BigEndian.Uint16(header[2:4]) != 443 ||
			net.IP(header[4:8]).String() != "203.0.113.1" || string(user) != "operator" {
			done <- io.ErrUnexpectedEOF
			return
		}
		_, err = connection.Write([]byte{0, 90, 0, 0, 0, 0, 0, 0})
		done <- err
	}()

	connection, err := socks4DialContext(listener.Addr().String(), "operator")(context.Background(), "tcp", "203.0.113.1:443")
	if err != nil {
		t.Fatal(err)
	}
	_ = connection.Close()
	if err := <-done; err != nil {
		t.Fatal(err)
	}
}

func TestGatewayNetworkExitResolvesCredentialWithoutPersistingIt(t *testing.T) {
	exit := hub.NetworkExitAccess{NetworkExit: hub.NetworkExit{
		Protocol: "socks5", Host: "proxy.example", Port: 1080,
		CredentialReference: &hub.CredentialReference{ID: "credential-a", Provider: "os_keyring"},
	}}
	gatewayExit, err := gatewayNetworkExitFor(exit, func(hub.NetworkExitAccess) (string, error) {
		return "operator:ephemeral-value", nil
	})
	if err != nil || gatewayExit.Username != "operator" || gatewayExit.Password != "ephemeral-value" || gatewayExit.Host != "proxy.example" {
		t.Fatalf("credential was not resolved into the request-local gateway payload: %#v err=%v", gatewayExit, err)
	}
	encoded := string(mustJSON(t, exit.NetworkExit))
	if strings.Contains(encoded, "ephemeral-value") {
		t.Fatalf("network exit persistence model contains resolved credential: %s", encoded)
	}
}

func mustJSON(t *testing.T, value any) []byte {
	t.Helper()
	encoded, err := json.Marshal(value)
	if err != nil {
		t.Fatal(err)
	}
	return encoded
}