package auth

import (
	"os"
	"path/filepath"
	"testing"

	"gitweb/internal/store"
)

// writeTree writes files (path -> content) under a fresh temp root and returns a
// LocalStore over it.
func writeTree(t *testing.T, files map[string]string) *store.LocalStore {
	t.Helper()
	root := t.TempDir()
	for p, content := range files {
		full := filepath.Join(root, filepath.FromSlash(p))
		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(full, []byte(content), 0o644); err != nil {
			t.Fatal(err)
		}
	}
	return store.NewLocalStore(root)
}

// checker reduces the boilerplate of asserting CanRead/CanWrite outcomes.
type checker struct {
	t *testing.T
	a *Authorizer
}

func (c checker) read(name, user, p string, want bool) {
	c.t.Helper()
	got, err := c.a.CanRead(user, p)
	if err != nil {
		c.t.Fatalf("%s: CanRead error: %v", name, err)
	}
	if got != want {
		c.t.Errorf("%s: CanRead(%q) = %v, want %v", name, user, got, want)
	}
}

func (c checker) write(name, user, p string, want bool) {
	c.t.Helper()
	got, err := c.a.CanWrite(user, p)
	if err != nil {
		c.t.Fatalf("%s: CanWrite error: %v", name, err)
	}
	if got != want {
		c.t.Errorf("%s: CanWrite(%q) = %v, want %v", name, user, got, want)
	}
}

func TestAuthorizerPublicRepo(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/public.git"
	st := writeTree(t, map[string]string{
		repo + "/HEAD":   "ref: refs/heads/main\n",
		repo + "/Access": "read,list: all\n*: " + owner + "\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("anon", "", repo, true)
	c.read("stranger", "x@other.com", repo, true)
	c.read("owner", owner, repo, true)
	c.write("anon", "", repo, false)
	c.write("owner", owner, repo, true)
	c.write("stranger", "x@other.com", repo, false)
}

func TestAuthorizerPrivateRepo(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/private.git"
	st := writeTree(t, map[string]string{
		repo + "/HEAD":   "ref: refs/heads/main\n",
		repo + "/Access": "*: " + owner + "\nread,write: w@d.com\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("anon", "", repo, false)
	c.read("collaborator", "w@d.com", repo, true)
	c.read("stranger", "x@other.com", repo, false)
	c.write("collaborator", "w@d.com", repo, true)
	c.write("stranger", "x@other.com", repo, false)
	c.write("owner", owner, repo, true)
}

// A private Access file inside the repo overrides a public one on the parent
// directory (nearest ancestor wins).
func TestAuthorizerNearestAccessWins(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/proj/secret.git"
	st := writeTree(t, map[string]string{
		owner + "/proj/Access": "read,list: all\n*: " + owner + "\n",
		repo + "/HEAD":         "ref: refs/heads/main\n",
		repo + "/Access":       "*: " + owner + "\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("anon", "", repo, false)
	c.read("owner", owner, repo, true)
}

// With no Access file anywhere, only the owner has any rights.
func TestAuthorizerNoAccessOwnerOnly(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/bare.git"
	st := writeTree(t, map[string]string{
		repo + "/HEAD": "ref: refs/heads/main\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("owner", owner, repo, true)
	c.read("anon", "", repo, false)
	c.read("stranger", "x@other.com", repo, false)
	c.write("owner", owner, repo, true)
}