package pluginstore

import (
	"context"
	"io"
	"net/http"
	"strings"
	"testing"
	"time"
)

func TestLatestReleaseCacheKeyNormalizesRepository(t *testing.T) {
	t.Parallel()
	client := Client{}
	key, errKey := client.LatestReleaseCacheKey(Plugin{Repository: "https://github.com/Owner/Repo/"})
	if errKey != nil {
		t.Fatal(errKey)
	}
	other, errOther := client.LatestReleaseCacheKey(Plugin{Repository: "https://github.com/owner/repo"})
	if errOther != nil || key != other {
		t.Fatalf("equivalent repository keys differ: %q / %q (%v)", key, other, errOther)
	}
}

func TestLatestReleaseCacheKeyTracksEnvironmentCredentials(t *testing.T) {
	plugin := Plugin{Repository: "https://github.com/owner/repo"}
	client := Client{Auth: []AuthConfig{{Match: "https://api.github.com/", Type: AuthTypeGitHubToken, TokenEnv: "PLUGIN_STORE_CACHE_TEST_TOKEN"}}}
	t.Setenv("PLUGIN_STORE_CACHE_TEST_TOKEN", "secret-token-one")
	first, errFirst := client.LatestReleaseCacheKey(plugin)
	if errFirst != nil {
		t.Fatal(errFirst)
	}
	t.Setenv("PLUGIN_STORE_CACHE_TEST_TOKEN", "secret-token-two")
	second, errSecond := client.LatestReleaseCacheKey(plugin)
	if errSecond != nil || first == second {
		t.Fatalf("credential rotation did not change key: %v", errSecond)
	}
	if strings.Contains(first+second, "secret-token") {
		t.Fatal("cache keys retain raw credentials")
	}
}

type pluginIdentityDoerFunc func(*http.Request) (*http.Response, error)

func (f pluginIdentityDoerFunc) Do(req *http.Request) (*http.Response, error) { return f(req) }

func TestPrepareLatestReleaseSnapshotsEnvironmentCredentials(t *testing.T) {
	plugin := Plugin{Repository: "https://github.com/owner/repo"}
	client := Client{
		Auth: []AuthConfig{{Match: "https://api.github.com/", Type: AuthTypeGitHubToken, TokenEnv: "PLUGIN_STORE_SNAPSHOT_TEST_TOKEN"}},
		HTTPClient: pluginIdentityDoerFunc(func(req *http.Request) (*http.Response, error) {
			if got := req.Header.Get("Authorization"); got != "Bearer original-token" {
				t.Errorf("request did not use the credential snapshot")
			}
			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"tag_name":"v1.0.0"}`))}, nil
		}),
	}
	t.Setenv("PLUGIN_STORE_SNAPSHOT_TEST_TOKEN", "original-token")
	prepared, originalKey, errPrepare := client.PrepareLatestRelease(plugin)
	if errPrepare != nil {
		t.Fatal(errPrepare)
	}
	t.Setenv("PLUGIN_STORE_SNAPSHOT_TEST_TOKEN", "rotated-token")
	rotatedKey, errKey := client.LatestReleaseCacheKey(plugin)
	if errKey != nil || originalKey == rotatedKey {
		t.Fatalf("rotation did not change the unprepared identity: %v", errKey)
	}
	if _, errRelease := prepared.FetchLatestRelease(context.Background(), plugin); errRelease != nil {
		t.Fatal(errRelease)
	}
}

func TestLatestReleaseCacheKeyRejectsExpiredCredentials(t *testing.T) {
	t.Parallel()
	client := Client{
		ResolvedAuth:          []ResolvedAuthConfig{{Match: "https://api.github.com/", Type: AuthTypeGitHubToken, Token: Secret("secret")}},
		ResolvedAuthExpiresAt: time.Unix(1, 0),
	}
	if _, errKey := client.LatestReleaseCacheKey(Plugin{Repository: "https://github.com/owner/repo"}); errKey == nil {
		t.Fatal("expired credentials must not access a cached private release")
	}
}