package bootstrap

import (
	"encoding/base64"
	"encoding/json"
	"errors"
	"net/http"
	"net/http/httptest"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"github.com/Pingu-Studio/MaidnCLI/internal/config"
	"github.com/Pingu-Studio/MaidnCLI/internal/forgejo"
)

func TestRenderCiliumConfig(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "values.yaml")
	if err := os.WriteFile(path, []byte("host: ${CILIUM_K8S_SERVICE_HOST}\ninterface: ${CILIUM_TRAFFIC_INTERFACE}\nstart: ${CILIUM_LB_START}\nend: ${CILIUM_LB_END}\n"), 0644); err != nil {
		t.Fatal(err)
	}
	cfg := config.Config{Talos: config.TalosConfig{KubeconfigEndpoint: "192.168.45.3"}, Cilium: config.CiliumConfig{TrafficInterface: "eth1", LoadBalancerStart: "192.168.45.19", LoadBalancerEnd: "192.168.45.30"}}
	if err := renderCiliumConfig(dir, cfg); err != nil {
		t.Fatal(err)
	}
	content, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(content), "${") || !strings.Contains(string(content), "192.168.45.30") {
		t.Fatalf("Cilium configuration was not rendered: %s", content)
	}
}

func TestRenderDeliveryConfig(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "webhook.yaml")
	if err := os.WriteFile(path, []byte("host: ${WEBHOOK_HOSTNAME}\npath: ${WEBHOOK_PATH}\ncatalog: ${TEKTON_CATALOG_REPO_URL}\nref: ${TEKTON_CATALOG_REPO_REF}\n"), 0644); err != nil {
		t.Fatal(err)
	}
	cfg := config.Config{Delivery: config.DeliveryConfig{WebhookHostname: "tekton.example.test", WebhookPath: "/hooks/forgejo"}, Templates: config.TemplateConfig{TektonCatalogRepoURL: "https://catalog.example.test/tekton.git", TektonCatalogRepoRef: "release"}}
	if err := renderDeliveryConfig(dir, cfg); err != nil {
		t.Fatal(err)
	}
	content, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(content), "${") || !strings.Contains(string(content), "/hooks/forgejo") || !strings.Contains(string(content), "https://catalog.example.test/tekton.git") || !strings.Contains(string(content), "ref: release") {
		t.Fatalf("delivery configuration was not rendered: %s", content)
	}
}

func TestCopyAndRenderDeliveryBasesOverwritesExistingMigrationOutput(t *testing.T) {
	templateDir := t.TempDir()
	repoDir := t.TempDir()
	files := []struct {
		base, name, template, want string
	}{
		{"gateway", "route.yaml", "host: ${WEBHOOK_HOSTNAME}\npath: ${WEBHOOK_PATH}\n", "host: tekton.example.test\npath: /hooks/forgejo\n"},
		{"tekton", "catalog-source.yaml", "url: ${TEKTON_CATALOG_REPO_URL}\nref: ${TEKTON_CATALOG_REPO_REF}\n", "url: https://catalog.example.test/tekton.git\nref: release\n"},
		{"tekton-triggers", "trigger.yaml", "app: ${APP_NAME}\nrepo: ${APP_REPO_URL}\n", "app: demo\nrepo: https://git.example.test/demo.git\n"},
	}
	for _, file := range files {
		templatePath := filepath.Join(templateDir, "base", file.base, file.name)
		outputPath := filepath.Join(repoDir, "base", file.base, file.name)
		if err := os.MkdirAll(filepath.Dir(templatePath), 0755); err != nil {
			t.Fatal(err)
		}
		if err := os.MkdirAll(filepath.Dir(outputPath), 0755); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(templatePath, []byte(file.template), 0644); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(outputPath, []byte("stale: output\n"), 0644); err != nil {
			t.Fatal(err)
		}
	}
	customGatewayFile := filepath.Join(repoDir, "base", "gateway", "custom.yaml")
	if err := os.WriteFile(customGatewayFile, []byte("custom: route\n"), 0644); err != nil {
		t.Fatal(err)
	}

	cfg := config.Config{
		Delivery:  config.DeliveryConfig{AppName: "demo", AppRepoURL: "https://git.example.test/demo.git", WebhookHostname: "tekton.example.test", WebhookPath: "/hooks/forgejo"},
		Templates: config.TemplateConfig{TektonCatalogRepoURL: "https://catalog.example.test/tekton.git", TektonCatalogRepoRef: "release"},
	}
	if err := copyAndRenderDeliveryBases(templateDir, repoDir, cfg); err != nil {
		t.Fatal(err)
	}
	for _, file := range files {
		content, err := os.ReadFile(filepath.Join(repoDir, "base", file.base, file.name))
		if err != nil || string(content) != file.want {
			t.Fatalf("%s was not copied and rendered: %q, %v", file.base, content, err)
		}
	}
	content, err := os.ReadFile(customGatewayFile)
	if err != nil || string(content) != "custom: route\n" {
		t.Fatalf("custom gateway file was not preserved: %q, %v", content, err)
	}
}

func TestCopyTemplateBaseComponentsCopiesExternalSecretsConfig(t *testing.T) {
	templateDir := t.TempDir()
	repoDir := t.TempDir()
	for _, component := range templateBaseComponents {
		if err := os.MkdirAll(filepath.Join(templateDir, "base", component), 0755); err != nil {
			t.Fatal(err)
		}
	}
	source := filepath.Join(templateDir, "base", "external-secrets", "config.yaml")
	destination := filepath.Join(repoDir, "base", "external-secrets", "config.yaml")
	if err := os.WriteFile(source, []byte("store: openbao\n"), 0644); err != nil {
		t.Fatal(err)
	}
	if err := os.MkdirAll(filepath.Dir(destination), 0755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(destination, []byte("store: stale\n"), 0644); err != nil {
		t.Fatal(err)
	}

	if err := copyTemplateBaseComponents(templateDir, repoDir); err != nil {
		t.Fatal(err)
	}
	content, err := os.ReadFile(destination)
	if err != nil || string(content) != "store: openbao\n" {
		t.Fatalf("external-secrets configuration was not copied: %q, %v", content, err)
	}
}

func TestRenderDemocraticCSISecret(t *testing.T) {
	secret, err := renderDemocraticCSISecret(config.DemocraticCSIConfig{TrueNASAPIKey: "api-key", TrueNASHost: "truenas.example.test", TargetPortal: "truenas.example.test:3260", ShareHost: "truenas.example.test", DatasetParentNFS: "pool/kubernetes/nfs/v", DatasetSnapshotsNFS: "pool/kubernetes/nfs/s", AllowedNetworks: "192.168.45.0/24", NameSuffix: "-test", PortalGroup: "1", InitiatorGroup: "1"})
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(secret), "name: democratic-csi-secrets") || !strings.Contains(string(secret), "labels:\n        reconcile.fluxcd.io/watch: Enabled") || !strings.Contains(string(secret), "dataset-parent-nfs: pool/kubernetes/nfs/v") {
		t.Fatalf("Democratic CSI secret was not rendered: %s", secret)
	}
}

func TestWriteDemocraticCSISecretEncryptsValues(t *testing.T) {
	if _, err := exec.LookPath("age-keygen"); err != nil {
		t.Skip("age-keygen is required for bootstrap encryption")
	}
	if _, err := exec.LookPath("sops"); err != nil {
		t.Skip("sops is required for bootstrap encryption")
	}
	dir := t.TempDir()
	identity := filepath.Join(dir, "age-key.txt")
	if err := exec.Command("age-keygen", "-o", identity).Run(); err != nil {
		t.Fatal(err)
	}
	secretPath := filepath.Join(dir, "secret.sops.yaml")
	csi := config.DemocraticCSIConfig{TrueNASAPIKey: "test-api-key", TrueNASHost: "truenas.example.test", TargetPortal: "truenas.example.test:3260", ShareHost: "truenas.example.test", DatasetParentNFS: "pool/kubernetes/nfs/v", DatasetSnapshotsNFS: "pool/kubernetes/nfs/s", AllowedNetworks: "192.168.45.0/24", NameSuffix: "-test", PortalGroup: "1", InitiatorGroup: "1"}
	if err := writeDemocraticCSISecret(secretPath, csi, identity); err != nil {
		t.Fatal(err)
	}
	encrypted, err := os.ReadFile(secretPath)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(encrypted), csi.TrueNASAPIKey) || !strings.Contains(string(encrypted), "sops:") {
		t.Fatal("Democratic CSI secret was not SOPS encrypted")
	}
	if err := writeDemocraticCSISecret(secretPath, csi, identity); err != nil {
		t.Fatal(err)
	}
	unchanged, err := os.ReadFile(secretPath)
	if err != nil {
		t.Fatal(err)
	}
	if string(encrypted) != string(unchanged) {
		t.Fatal("Democratic CSI secret was re-encrypted without a configuration change")
	}
}

func TestNewWebhookAuthorization(t *testing.T) {
	authorization, err := NewWebhookAuthorization()
	if err != nil {
		t.Fatal(err)
	}
	if !strings.HasPrefix(authorization, "Bearer ") || len(authorization) <= len("Bearer ") {
		t.Fatalf("invalid webhook authorization")
	}
}

func TestForgejoRegistryDockerConfig(t *testing.T) {
	dockerConfig, err := ForgejoRegistryDockerConfig("registry.example.test/team/app", "registry-user", "registry-token")
	if err != nil {
		t.Fatal(err)
	}
	var document struct {
		Auths map[string]struct {
			Auth string `json:"auth"`
		} `json:"auths"`
	}
	if err := json.Unmarshal([]byte(dockerConfig), &document); err != nil {
		t.Fatal(err)
	}
	if document.Auths["registry.example.test"].Auth != base64.StdEncoding.EncodeToString([]byte("registry-user:registry-token")) {
		t.Fatal("Forgejo registry Docker config has the wrong credentials")
	}
}

func TestUpsertOperationalSecretPreservesExistingSecrets(t *testing.T) {
	if _, err := exec.LookPath("age-keygen"); err != nil {
		t.Skip("age-keygen is required for bootstrap encryption")
	}
	if _, err := exec.LookPath("sops"); err != nil {
		t.Skip("sops is required for bootstrap encryption")
	}
	dir := t.TempDir()
	identity := filepath.Join(dir, "age-key.txt")
	if err := exec.Command("age-keygen", "-o", identity).Run(); err != nil {
		t.Fatal(err)
	}
	path := filepath.Join(dir, "operational-secrets.sops.yaml")
	if err := WriteOperationalSecrets(path, identity, map[string]map[string]string{
		"cicd/forgejo":          {"token": "existing-token"},
		"platform/cloudflare":   {"api-token": "existing-api-token"},
		"cicd/forgejo-registry": {"dockerconfigjson": "old-config"},
	}); err != nil {
		t.Fatal(err)
	}
	if err := UpsertOperationalSecret(path, identity, "cicd/forgejo-registry", "dockerconfigjson", "new-config"); err != nil {
		t.Fatal(err)
	}
	encrypted, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(encrypted), "existing-token") || strings.Contains(string(encrypted), "new-config") || !strings.Contains(string(encrypted), "sops:") {
		t.Fatal("operational secret upsert was not SOPS encrypted")
	}
	secrets, err := ReadOperationalSecrets(path, identity)
	if err != nil {
		t.Fatal(err)
	}
	if secrets["cicd/forgejo"]["token"] != "existing-token" || secrets["platform/cloudflare"]["api-token"] != "existing-api-token" || secrets["cicd/forgejo-registry"]["dockerconfigjson"] != "new-config" {
		t.Fatal("operational secret upsert did not preserve unrelated secrets")
	}
}

func TestInitializeOpenBaoUsesGeneratedKubeconfig(t *testing.T) {
	original := initializeOpenBao
	defer func() { initializeOpenBao = original }()
	var kubeconfig string
	initializeOpenBao = func(path, recipient, identityPath, bundlePath, ageKeyPath, operationalSecretsPath string) (map[string]map[string]string, error) {
		kubeconfig = path
		if recipient != "recipient" || identityPath != "identity" || bundlePath != "bundle" || ageKeyPath != "age" || operationalSecretsPath != "secrets" {
			t.Fatal("InitializeOpenBao passed incorrect configured paths")
		}
		return nil, nil
	}
	cfg := config.Config{
		Git:   config.GitConfig{CloneParent: "checkout"},
		Talos: config.TalosConfig{RepoDirName: "talos", GeneratedDir: "generated"},
		SOPS:  config.SOPSConfig{RecoveryRecipient: "recipient", RecoveryIdentityPath: "identity", RecoveryBundlePath: "bundle", AgeKeyPath: "age", OperationalSecretsPath: "secrets"},
	}
	if err := InitializeOpenBao(cfg); err != nil {
		t.Fatal(err)
	}
	if kubeconfig != filepath.Join("checkout", "talos", "generated", "kubeconfig") {
		t.Fatal("InitializeOpenBao did not use the configured generated kubeconfig")
	}
	initializeOpenBao = func(string, string, string, string, string, string) (map[string]map[string]string, error) {
		return nil, errors.New("unavailable")
	}
	if err := InitializeOpenBao(cfg); err == nil {
		t.Fatal("InitializeOpenBao accepted a seeding error")
	}
}

func TestCopyDirSkipsGitDirectory(t *testing.T) {
	source := t.TempDir()
	destination := t.TempDir()
	if err := os.Mkdir(filepath.Join(source, ".git"), 0755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(source, ".git", "config"), []byte("private"), 0644); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(source, "README.md"), []byte("template"), 0644); err != nil {
		t.Fatal(err)
	}
	if err := copyDir(source, destination, false); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(filepath.Join(destination, ".git")); !os.IsNotExist(err) {
		t.Fatal("copied template must not contain its Git metadata")
	}
	content, err := os.ReadFile(filepath.Join(destination, "README.md"))
	if err != nil || string(content) != "template" {
		t.Fatalf("template content was not copied: %q, %v", content, err)
	}
}

func TestEnsureManifestsKustomizations(t *testing.T) {
	dir := t.TempDir()
	for _, environment := range []string{"previews", "staging", "production"} {
		if err := os.MkdirAll(filepath.Join(dir, "apps", environment), 0755); err != nil {
			t.Fatal(err)
		}
	}
	if err := os.WriteFile(filepath.Join(dir, "apps", "staging", "kustomization.yaml"), []byte("apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\n"), 0644); err != nil {
		t.Fatal(err)
	}
	if err := ensureManifestsKustomizations(dir); err != nil {
		t.Fatal(err)
	}
	content, err := os.ReadFile(filepath.Join(dir, "apps", "previews", "kustomization.yaml"))
	if err != nil || !strings.Contains(string(content), "resources:") {
		t.Fatalf("preview Kustomization was not created: %q, %v", content, err)
	}
	content, err = os.ReadFile(filepath.Join(dir, "apps", "staging", "kustomization.yaml"))
	if err != nil || !strings.Contains(string(content), "resources:") {
		t.Fatalf("staging Kustomization was not repaired: %q, %v", content, err)
	}
}

func TestEnsureClusterKustomizationsUsesTemplateExternalSecretsResource(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "kustomization.yaml")
	if err := os.WriteFile(path, []byte("resources:\n"), 0644); err != nil {
		t.Fatal(err)
	}
	if err := ensureClusterKustomizations(dir); err != nil {
		t.Fatal(err)
	}
	content, err := os.ReadFile(path)
	if err != nil || !strings.Contains(string(content), "snapshot-crds-kustomization.yaml") || !strings.Contains(string(content), "democratic-csi-kustomization.yaml") || !strings.Contains(string(content), "openbao-kustomization.yaml") || !strings.Contains(string(content), "external-secrets-kustomization.yaml") || !strings.Contains(string(content), "cnpg-kustomization.yaml") || !strings.Contains(string(content), "cloudflare-tunnel-kustomization.yaml") || !strings.Contains(string(content), "tekton-kustomization.yaml") || strings.Contains(string(content), "external-secrets-config-kustomization.yaml") {
		t.Fatalf("cluster Kustomization was not updated: %q, %v", content, err)
	}
}

func TestWebhookTargetTimeoutExceedsExternalSecretRefreshInterval(t *testing.T) {
	if webhookTargetTimeout <= time.Hour {
		t.Fatal("webhook target timeout must exceed the one-hour ExternalSecret refresh interval")
	}
}

func TestReconcileWebhookWaitsForRefreshedTargetSecret(t *testing.T) {
	originalInitialize := initializeOpenBao
	originalCommand := runWebhookCommand
	originalWebhook := ensureForgejoWebhook
	originalTimeout := webhookTargetTimeout
	originalInterval := webhookTargetPollInterval
	t.Cleanup(func() {
		initializeOpenBao = originalInitialize
		runWebhookCommand = originalCommand
		ensureForgejoWebhook = originalWebhook
		webhookTargetTimeout = originalTimeout
		webhookTargetPollInterval = originalInterval
	})

	authorization := "Bearer test-webhook-authorization"
	staleTarget := base64.StdEncoding.EncodeToString([]byte("Bearer stale-webhook-authorization"))
	refreshedTarget := base64.StdEncoding.EncodeToString([]byte(authorization))
	targetChecks := 0
	refreshedObserved := false
	runWebhookCommand = func(_ string, name string, args ...string) ([]byte, error) {
		if name != "kubectl" || strings.Contains(strings.Join(args, " "), authorization) {
			t.Fatal("webhook target probe used an unexpected command")
		}
		if strings.Contains(strings.Join(args, " "), "secret/forgejo-webhook") {
			targetChecks++
			if targetChecks == 1 {
				return []byte(staleTarget), nil
			}
			refreshedObserved = true
			return []byte(refreshedTarget), nil
		}
		return nil, nil
	}
	webhookTargetPollInterval = 0

	patches := 0
	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
		if !refreshedObserved {
			t.Error("Forgejo was called before the refreshed webhook Secret was observed")
			writer.WriteHeader(http.StatusInternalServerError)
			return
		}
		switch request.Method {
		case http.MethodGet:
			_ = json.NewEncoder(writer).Encode([]map[string]any{{"id": 7, "url": "https://tekton.example.test/"}})
		case http.MethodPatch:
			var body struct {
				AuthorizationHeader string `json:"authorization_header"`
			}
			if err := json.NewDecoder(request.Body).Decode(&body); err != nil || body.AuthorizationHeader != authorization {
				t.Error("Forgejo webhook update did not use the observed authorization")
				writer.WriteHeader(http.StatusBadRequest)
				return
			}
			patches++
			writer.WriteHeader(http.StatusOK)
		default:
			t.Error("unexpected Forgejo request")
			writer.WriteHeader(http.StatusMethodNotAllowed)
		}
	}))
	defer server.Close()
	ensureForgejoWebhook = func(_ config.Config, repo, webhookURL, authorization string) error {
		manager := forgejo.NewRepoManager(server.URL, "test-token", "owner", "user", "manifests", "flux", "main", "migration")
		manager.HTTPClient = server.Client()
		return manager.EnsureWebhook(repo, webhookURL, authorization)
	}
	initializeOpenBao = func(string, string, string, string, string, string) (map[string]map[string]string, error) {
		return map[string]map[string]string{"cicd/forgejo-webhook": {"authorization": authorization}}, nil
	}

	cfg := config.Config{Delivery: config.DeliveryConfig{AppName: "app", WebhookHostname: "tekton.example.test", WebhookPath: "/"}}
	if err := (Runner{Config: cfg}).reconcileWebhook(t.TempDir()); err != nil {
		t.Fatal(err)
	}
	if targetChecks != 2 || patches != 1 {
		t.Fatal("Forgejo webhook was not updated after the target Secret refreshed")
	}
}

func TestReconcileWebhookTimeoutDoesNotUpdateForgejo(t *testing.T) {
	originalInitialize := initializeOpenBao
	originalCommand := runWebhookCommand
	originalWebhook := ensureForgejoWebhook
	originalTimeout := webhookTargetTimeout
	originalInterval := webhookTargetPollInterval
	t.Cleanup(func() {
		initializeOpenBao = originalInitialize
		runWebhookCommand = originalCommand
		ensureForgejoWebhook = originalWebhook
		webhookTargetTimeout = originalTimeout
		webhookTargetPollInterval = originalInterval
	})

	authorization := "Bearer test-webhook-authorization"
	initializeOpenBao = func(string, string, string, string, string, string) (map[string]map[string]string, error) {
		return map[string]map[string]string{"cicd/forgejo-webhook": {"authorization": authorization}}, nil
	}
	runWebhookCommand = func(_ string, _ string, _ ...string) ([]byte, error) {
		return []byte(base64.StdEncoding.EncodeToString([]byte("Bearer stale-webhook-authorization"))), nil
	}
	webhookTargetTimeout = -time.Nanosecond
	webhookTargetPollInterval = 0
	webhookUpdated := false
	ensureForgejoWebhook = func(config.Config, string, string, string) error {
		webhookUpdated = true
		return nil
	}

	err := (Runner{Config: config.Config{Delivery: config.DeliveryConfig{AppName: "app"}}}).reconcileWebhook(t.TempDir())
	if err == nil || !strings.Contains(err.Error(), "Forgejo webhook was not updated") || !strings.Contains(err.Error(), "--register-webhook") {
		t.Fatal("webhook refresh timeout did not return a safe rerun error")
	}
	if webhookUpdated {
		t.Fatal("Forgejo webhook update was attempted before the target Secret refreshed")
	}
}

func TestRenderTerraformTFVarsIsStableAndRedactsToken(t *testing.T) {
	cfg := config.Config{
		ClusterID: "test",
		Talos: config.TalosConfig{
			Proxmox: config.TalosProxmoxConfig{APIURL: "https://proxmox.test", APITokenID: "id", APITokenSecret: "secret", NodeInterfaces: map[string]string{"b": "eno2", "a": "eno1"}},
			Cluster: config.TalosClusterConfig{Name: "test", Domain: "test", DiskStorage: "local", AdditionalStorage: "local"},
			Image:   config.TalosImageConfig{TalosVersion: "v1.13.6", KubernetesVersion: "v1.33.4", SchematicID: "abcdefghijkl", Architecture: "amd64"},
		},
	}
	first := renderTerraformTFVars(cfg)
	second := renderTerraformTFVars(cfg)
	if first != second || strings.Contains(first, "secret") || strings.Index(first, `"a"`) > strings.Index(first, `"b"`) {
		t.Fatalf("Terraform rendering is not deterministic or redacted: %s", first)
	}
}

func TestTerraformPlanPathIsAbsolute(t *testing.T) {
	path, err := terraformPlanPath(filepath.Join("maidn-workspace", "terraform"), "cluster")
	if err != nil || !filepath.IsAbs(path) {
		t.Fatalf("Terraform plan path is not absolute: %q, %v", path, err)
	}
}