package httpapi

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	sdktrace "go.opentelemetry.io/otel/sdk/trace"
	"go.opentelemetry.io/otel/sdk/trace/tracetest"
)

func TestRouterExposesOnlySpecifiedMethods(t *testing.T) {
	endpoint := http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
		response.WriteHeader(http.StatusNoContent)
	})
	router, err := NewRouter(Endpoints{
		Metadata: endpoint,
		Token:    endpoint,
		JWKS:     endpoint,
		Health:   endpoint,
		Ready:    endpoint,
	}, Telemetry{})
	if err != nil {
		t.Fatalf("NewRouter() error = %v", err)
	}

	tests := []struct {
		method string
		path   string
		status int
	}{
		{http.MethodGet, "/.well-known/oauth-authorization-server", http.StatusNoContent},
		{http.MethodPost, "/oauth2/token", http.StatusNoContent},
		{http.MethodGet, "/oauth2/jwks", http.StatusNoContent},
		{http.MethodGet, "/healthz", http.StatusNoContent},
		{http.MethodGet, "/readyz", http.StatusNoContent},
		{http.MethodGet, "/oauth2/token", http.StatusMethodNotAllowed},
		{http.MethodPost, "/oauth2/jwks", http.StatusMethodNotAllowed},
		{http.MethodGet, "/unknown", http.StatusNotFound},
	}

	for _, test := range tests {
		t.Run(test.method+" "+test.path, func(t *testing.T) {
			request := httptest.NewRequest(test.method, test.path, nil)
			response := httptest.NewRecorder()
			router.ServeHTTP(response, request)
			if response.Code != test.status {
				t.Fatalf("status = %d, want %d", response.Code, test.status)
			}
		})
	}
}

func TestRouterRequiresEveryEndpoint(t *testing.T) {
	if _, err := NewRouter(Endpoints{}, Telemetry{}); err == nil {
		t.Fatal("NewRouter() error = nil, want missing endpoint error")
	}
}

func TestRouterTelemetryDoesNotCaptureCredentialValues(t *testing.T) {
	const canary = "canary-secret-token"
	recorder := tracetest.NewSpanRecorder()
	tracerProvider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder))
	t.Cleanup(func() { _ = tracerProvider.Shutdown(t.Context()) })

	endpoint := http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
		response.WriteHeader(http.StatusNoContent)
	})
	router, err := NewRouter(Endpoints{
		Metadata: endpoint,
		Token:    endpoint,
		JWKS:     endpoint,
		Health:   endpoint,
		Ready:    endpoint,
	}, Telemetry{TracerProvider: tracerProvider})
	if err != nil {
		t.Fatalf("NewRouter() error = %v", err)
	}

	request := httptest.NewRequest(http.MethodGet, "/oauth2/jwks?subject_token="+canary, nil)
	request.Header.Set("Authorization", "Bearer "+canary)
	response := httptest.NewRecorder()
	router.ServeHTTP(response, request)

	spans := recorder.Ended()
	if len(spans) != 1 {
		t.Fatalf("ended spans = %d, want 1", len(spans))
	}
	for _, attribute := range spans[0].Attributes() {
		if strings.Contains(attribute.Value.Emit(), canary) {
			t.Fatalf("span attribute %q captured credential canary", attribute.Key)
		}
	}
}