package main

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"git.ipao.vip/rogee/creator-hub/internal/douyin"
	"git.ipao.vip/rogee/creator-hub/internal/hub"
)

const testDouyinIdentityURL = "https://www.douyin.com/aweme/v1/web/user/profile/self/?aid=6383&device_platform=webapp"

func TestDouyinGatewayBrowserFencesAccountGeneration(t *testing.T) {
	requests := 0
	server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
		requests++
		if request.Header.Get("Authorization") != "Bearer gateway-token-1" {
			t.Fatalf("missing gateway authorization")
		}
		var body map[string]any
		if json.NewDecoder(request.Body).Decode(&body) != nil || body["binding_version"] != float64(2) ||
			body["runtime_id"] != "runtime-a" || body["network_id"] != "network-a" || body["network_exit_id"] != "exit-a" {
			t.Fatalf("generation fence missing: %#v", body)
		}
		switch request.URL.Path {
		case "/v1/browsers/account-a/douyin/get":
			if body["url"] != testDouyinIdentityURL {
				t.Fatalf("unexpected URL: %#v", body)
			}
			_ = json.NewEncoder(response).Encode(map[string]any{"status": 412, "body": `{"captcha":true}`, "challenge": "captcha"})
		default:
			response.WriteHeader(http.StatusNotFound)
		}
	}))
	defer server.Close()
	browser := douyinGatewayBrowser{gateway: hub.Gateway{Endpoint: server.URL, Token: "gateway-token-1"}, environment: readyDouyinEnvironment()}
	result, err := browser.Get(context.Background(), testDouyinIdentityURL)
	if err != nil || result.Status != 412 || result.Challenge != douyin.ChallengeCaptcha || requests != 1 {
		t.Fatalf("unexpected result: %#v requests=%d err=%v", result, requests, err)
	}
}

func TestDouyinGatewayBrowserFailsClosedWithoutReadyBinding(t *testing.T) {
	requests := 0
	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { requests++ }))
	defer server.Close()
	environment := readyDouyinEnvironment()
	environment.Exit.HealthStatus = "unhealthy"
	browser := douyinGatewayBrowser{gateway: hub.Gateway{Endpoint: server.URL, Token: "gateway-token-1"}, environment: environment}
	if _, err := browser.Get(context.Background(), testDouyinIdentityURL); err == nil || requests != 0 {
		t.Fatalf("unready binding reached gateway: requests=%d err=%v", requests, err)
	}
}

func TestDouyinGatewayBrowserDoesNotEchoCredentialOnFailure(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
		response.WriteHeader(http.StatusBadGateway)
		_, _ = response.Write([]byte(`{"error":"private-session"}`))
	}))
	defer server.Close()
	browser := douyinGatewayBrowser{gateway: hub.Gateway{Endpoint: server.URL, Token: "gateway-token-1"}, environment: readyDouyinEnvironment()}
	_, err := browser.Get(context.Background(), testDouyinIdentityURL)
	if err == nil || strings.Contains(err.Error(), "private-session") {
		t.Fatalf("gateway failure leaked credential: %v", err)
	}
}

func readyDouyinEnvironment() hub.EnvironmentContext {
	return hub.EnvironmentContext{Env: hub.Env{Alias: "account-a", Gateway: "gateway-a"}, AccountID: "account-a",
		AccountStatus: "active", AuthorizationStatus: "authorized", BindingID: "binding-a", BindingVersion: 2,
		Exit: hub.NetworkExit{ID: "exit-a", HealthStatus: "healthy"}, RuntimeInstanceID: "instance-a",
		RuntimeID: "runtime-a", RuntimeNetworkID: "network-a"}
}