package server

import ( "crypto/ecdsa" "crypto/elliptic" "crypto/rand" "crypto/sha256" "encoding/base64" "encoding/json" "fmt" "net/http" "net/http/httptest" "net/url" "os" "strings" "testing" "time"

"gitweb/internal/auth"
"gitweb/internal/store"

"upspin.io/upspin"

)

// newSSOTestServer builds a Server with browser SSO enabled and returns a // function that mints issuer-signed tokens the server will accept. func newSSOTestServer(t *testing.T) (*Server, func(sub string, exp time.Time) string) { t.Helper() priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) if err != nil { t.Fatal(err) } pub := upspin.PublicKey(fmt.Sprintf("p256\n%s\n%s\n", priv.X.String(), priv.Y.String())) const issuer = "vault@cosmocr.at" verifier := auth.NewVaultVerifier(issuer, "gitweb", func(upspin.UserName) (upspin.PublicKey, error) { return pub, nil })

s, err := New(Config{
	Store:           store.NewLocalStore(t.TempDir()),
	Web:             http.FS(os.DirFS("../../web")),
	CacheDir:        t.TempDir(),
	Vault:           verifier,
	SSOAuthorizeURL: "https://vault.cosmocr.at/authorize",
	SSOAudience:     "gitweb",
	BaseURL:         "https://git.cosmocr.at",
})
if err != nil {
	t.Fatal(err)
}

mint := func(sub string, exp time.Time) string {
	claims := map[string]any{
		"iss": issuer, "sub": sub, "aud": "gitweb",
		"iat": time.Now().Unix(), "exp": exp.Unix(),
	}
	payload, _ := json.Marshal(claims)
	p := base64.RawURLEncoding.EncodeToString(payload)
	hash := sha256.Sum256([]byte("v1." + p))
	r, ss, err := ecdsa.Sign(rand.Reader, priv, hash[:])
	if err != nil {
		t.Fatal(err)
	}
	return "v1." + p + "." +
		base64.RawURLEncoding.EncodeToString(r.Bytes()) + "." +
		base64.RawURLEncoding.EncodeToString(ss.Bytes())
}
return s, mint

}

// TestAuthenticateSessionCookie: a valid session cookie authenticates the // browser; an expired one is ignored (anonymous) and cleared. func TestAuthenticateSessionCookie(t *testing.T) { s, mint := newSSOTestServer(t)

// Valid cookie -> authenticated subject.
r := httptest.NewRequest("GET", "/u@d.com/x", nil)
r.AddCookie(&http.Cookie{Name: sessionCookie, Value: mint("alice@d.com", time.Now().Add(time.Hour))})
w := httptest.NewRecorder()
user, ok := s.authenticate(w, r)
if !ok || user != "alice@d.com" {
	t.Fatalf("authenticate = (%q, %v), want (alice@d.com, true)", user, ok)
}

// Expired cookie -> anonymous, and the stale cookie is cleared.
r = httptest.NewRequest("GET", "/u@d.com/x", nil)
r.AddCookie(&http.Cookie{Name: sessionCookie, Value: mint("alice@d.com", time.Now().Add(-time.Minute))})
w = httptest.NewRecorder()
user, ok = s.authenticate(w, r)
if !ok || user != "" {
	t.Fatalf("expired cookie: authenticate = (%q, %v), want (\"\", true)", user, ok)
}
if !clearsCookie(w, sessionCookie) {
	t.Errorf("expired cookie was not cleared: %v", w.Result().Cookies())
}

}

// TestHandleSession covers the callback token-exchange endpoint: state must // match the oauth cookie and the token must verify before a session is set. func TestHandleSession(t *testing.T) { s, mint := newSSOTestServer(t) token := mint("bob@d.com", time.Now().Add(time.Hour))

post := func(oauthState, bodyState, tok string) *httptest.ResponseRecorder {
	body, _ := json.Marshal(map[string]string{"token": tok, "state": bodyState})
	r := httptest.NewRequest("POST", "/_auth/session", strings.NewReader(string(body)))
	r.AddCookie(&http.Cookie{Name: oauthCookie,
		Value: url.Values{"state": {oauthState}, "next": {"/u@d.com/priv.git"}}.Encode()})
	w := httptest.NewRecorder()
	s.handleSession(w, r)
	return w
}

// Happy path: matching state + valid token -> 200, session cookie, next.
w := post("s123", "s123", token)
if w.Code != 200 {
	t.Fatalf("status = %d, want 200 (%s)", w.Code, w.Body)
}
if !setsCookie(w, sessionCookie, token) {
	t.Errorf("session cookie not set to the token")
}
var out struct{ Next string }
json.Unmarshal(w.Body.Bytes(), &out)
if out.Next != "/u@d.com/priv.git" {
	t.Errorf("next = %q, want /u@d.com/priv.git", out.Next)
}

// State mismatch -> 400, no session.
if w := post("s123", "WRONG", token); w.Code != 400 {
	t.Errorf("state mismatch status = %d, want 400", w.Code)
}
// Invalid token -> 401, no session.
if w := post("s123", "s123", "v1.garbage.a.b"); w.Code != 401 {
	t.Errorf("invalid token status = %d, want 401", w.Code)
}

}

// TestDenyReadRoutes: an anonymous browser is redirected to login, a git/curl // client gets a Basic-auth challenge, an authenticated caller gets 404. func TestDenyReadRoutes(t *testing.T) { s, _ := newSSOTestServer(t)

// Browser (Accept: text/html), anonymous -> 303 to /_auth/login.
r := httptest.NewRequest("GET", "/u@d.com/priv.git", nil)
r.Header.Set("Accept", "text/html")
w := httptest.NewRecorder()
s.denyRead(w, r, "")
if w.Code != http.StatusSeeOther {
	t.Fatalf("browser deny status = %d, want 303", w.Code)
}
if loc := w.Header().Get("Location"); !strings.HasPrefix(loc, "/_auth/login?next=") {
	t.Errorf("Location = %q, want /_auth/login?next=…", loc)
}

// git/curl (no text/html), anonymous -> 401 challenge.
r = httptest.NewRequest("GET", "/u@d.com/priv.git/info/refs", nil)
w = httptest.NewRecorder()
s.denyRead(w, r, "")
if w.Code != http.StatusUnauthorized {
	t.Errorf("cli deny status = %d, want 401", w.Code)
}

// Authenticated but unauthorized -> 404 (does not reveal existence).
r = httptest.NewRequest("GET", "/u@d.com/priv.git", nil)
r.Header.Set("Accept", "text/html")
w = httptest.NewRecorder()
s.denyRead(w, r, "eve@d.com")
if w.Code != http.StatusNotFound {
	t.Errorf("authed deny status = %d, want 404", w.Code)
}

}

func setsCookie(w *httptest.ResponseRecorder, name, val string) bool { for _, c := range w.Result().Cookies() { if c.Name == name && c.Value == val && c.MaxAge >= 0 { return true } } return false }

func clearsCookie(w *httptest.ResponseRecorder, name string) bool { for _, c := range w.Result().Cookies() { if c.Name == name && c.MaxAge < 0 { return true } } return false }