package api

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"chfs-ng/internal/auth"
	"chfs-ng/internal/storage"
)

func TestUserManagementAndPrivateHome(t *testing.T) {
	root := t.TempDir()
	usersFile := filepath.Join(t.TempDir(), "users.json")
	mgr := &auth.Manager{
		Accounts: map[string]*auth.Account{
			"admin": {Username: "admin", Password: "secret", Admin: true, Mask: auth.Read | auth.Write | auth.Delete},
		},
		Guest: &auth.Account{Mask: auth.None},
	}
	s := &Server{Store: storage.Local{Root: root}, Auth: mgr, UserStore: &auth.UserStore{Path: usersFile}, UserHome: "users"}
	h := s.Handler()

	req := httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=admin&pwd=secret"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	rr := httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusCreated {
		t.Fatalf("admin login: %d %s", rr.Code, rr.Body.String())
	}
	cookie := rr.Result().Cookies()[0]

	body := []byte(`{"username":"alice","password":"alice-pass"}`)
	req = httptest.NewRequest(http.MethodPost, "/chfs/users", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(cookie)
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK {
		t.Fatalf("create user: %d %s", rr.Code, rr.Body.String())
	}
	if _, err := os.Stat(filepath.Join(root, "users", "alice")); err != nil {
		t.Fatalf("home not created: %v", err)
	}

	req = httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=alice&pwd=alice-pass"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusCreated {
		t.Fatalf("dynamic user login: %d %s", rr.Code, rr.Body.String())
	}

	token, err := auth.NewToken("alice", 30)
	if err != nil {
		t.Fatal(err)
	}
	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=", nil)
	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "currentMask") || !strings.Contains(rr.Body.String(), "\"currentMask\":\"\"") {
		t.Fatalf("private root access: %d %s", rr.Code, rr.Body.String())
	}

	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=users/alice", nil)
	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "\"currentMask\":\"RWD\"") {
		t.Fatalf("private home access: %d %s", rr.Code, rr.Body.String())
	}

	var saved []map[string]any
	data, err := os.ReadFile(usersFile)
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(data, &saved); err != nil || len(saved) != 1 {
		t.Fatalf("user persistence: %v %#v", err, saved)
	}
}