/*
Copyright 2026 Arctel.net

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package cap

import (
	"bytes"
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/Rain-kl/Wavelet/internal/db"
	"github.com/Rain-kl/Wavelet/internal/model"
	"github.com/Rain-kl/Wavelet/internal/testhelper"
	"github.com/Rain-kl/Wavelet/internal/util"
	capUtil "github.com/Rain-kl/Wavelet/internal/util/cap"
	"github.com/gin-gonic/gin"
)

func TestCapEndpointsAndMiddleware(t *testing.T) {
	sqliteDB, _, cleanup := testhelper.SetupTestEnvironment(t)
	defer cleanup()

	gin.SetMode(gin.TestMode)
	r := gin.New()

	// Mount CAPTCHA API endpoints
	capGroup := r.Group("/api/cap")
	{
		capGroup.POST("/challenge", Challenge)
		capGroup.POST("/redeem", Redeem)
	}

	// Login endpoint with CAPTCHA middleware
	r.POST("/api/v1/user/login", VerifyMiddleware(capUtil.GetDefaultManager(), "login", func() bool {
		enabled, err := model.GetBoolByKey(context.Background(), model.ConfigKeyCapLoginEnabled)
		if err != nil {
			return false
		}
		return enabled
	}), func(c *gin.Context) {
		c.JSON(http.StatusOK, util.OK("login success"))
	})

	// 1. Test challenge generation
	w := httptest.NewRecorder()
	req, _ := http.NewRequest("POST", "/api/cap/challenge", nil)
	r.ServeHTTP(w, req)

	if w.Code != http.StatusOK {
		t.Fatalf("expected 200 OK, got %d. Body: %s", w.Code, w.Body.String())
	}

	var challengeResp capUtil.ChallengeResponse
	if err := json.Unmarshal(w.Body.Bytes(), &challengeResp); err != nil {
		t.Fatalf("failed to unmarshal challenge response: %v", err)
	}

	if challengeResp.Token == "" {
		t.Fatalf("expected token in challenge response")
	}

	// 2. Test login with CAPTCHA disabled (should pass)
	w = httptest.NewRecorder()
	req, _ = http.NewRequest("POST", "/api/v1/user/login", nil)
	r.ServeHTTP(w, req)
	if w.Code != http.StatusOK {
		t.Fatalf("expected 200 OK when CAPTCHA is disabled, got %d. Body: %s", w.Code, w.Body.String())
	}

	// 3. Enable CAPTCHA in DB
	err := sqliteDB.Model(&model.SystemConfig{}).Where("key = ?", model.ConfigKeyCapLoginEnabled).Update("value", "true").Error
	if err != nil {
		t.Fatalf("failed to enable cap_login_enabled in DB: %v", err)
	}
	// Update cache
	var sysCfg model.SystemConfig
	sqliteDB.Where("key = ?", model.ConfigKeyCapLoginEnabled).First(&sysCfg)
	_ = db.HSetJSON(context.Background(), model.SystemConfigRedisHashKey, model.ConfigKeyCapLoginEnabled, &sysCfg)

	// 4. Test login with CAPTCHA enabled but no header (should be blocked)
	w = httptest.NewRecorder()
	req, _ = http.NewRequest("POST", "/api/v1/user/login", nil)
	r.ServeHTTP(w, req)
	if w.Code != http.StatusUnauthorized {
		t.Fatalf("expected 401 Unauthorized, got %d. Body: %s", w.Code, w.Body.String())
	}

	// 5. Solve the challenge
	solutions := capUtil.Solve(challengeResp.Token, challengeResp.Challenge.C, challengeResp.Challenge.S, challengeResp.Challenge.D)

	// 6. Redeem solutions
	redeemReqPayload := redeemRequest{
		Token:     challengeResp.Token,
		Solutions: solutions,
	}
	bodyBytes, _ := json.Marshal(redeemReqPayload)
	w = httptest.NewRecorder()
	req, _ = http.NewRequest("POST", "/api/cap/redeem", bytes.NewBuffer(bodyBytes))
	req.Header.Set("Content-Type", "application/json")
	r.ServeHTTP(w, req)

	if w.Code != http.StatusOK {
		t.Fatalf("expected 200 OK for redeem, got %d. Body: %s", w.Code, w.Body.String())
	}

	var redeemResp capUtil.RedeemResponse
	if err := json.Unmarshal(w.Body.Bytes(), &redeemResp); err != nil {
		t.Fatalf("failed to unmarshal redeem response: %v", err)
	}

	if !redeemResp.Success || redeemResp.Token == "" {
		t.Fatalf("redeem failed or returned empty token: %+v", redeemResp)
	}

	// 7. Login with valid redeem token (should pass)
	w = httptest.NewRecorder()
	req, _ = http.NewRequest("POST", "/api/v1/user/login", nil)
	req.Header.Set("X-Cap-Token", redeemResp.Token)
	r.ServeHTTP(w, req)
	if w.Code != http.StatusOK {
		t.Fatalf("expected 200 OK with valid cap token, got %d. Body: %s", w.Code, w.Body.String())
	}

	// 8. Replay attack: Login with the same redeem token again (should be blocked as it is single-use)
	w = httptest.NewRecorder()
	req, _ = http.NewRequest("POST", "/api/v1/user/login", nil)
	req.Header.Set("X-Cap-Token", redeemResp.Token)
	r.ServeHTTP(w, req)
	if w.Code != http.StatusUnauthorized {
		t.Fatalf("expected 401 Unauthorized on replayed token, got %d. Body: %s", w.Code, w.Body.String())
	}
}