package nginxgateway

import (
	"errors"
	"strings"
	"testing"

	"vpn-platform/backend/internal/nginxconfig"
)

func TestParseManagedEntry(t *testing.T) {
	for _, want := range []nginxconfig.RenderOptions{
		{Domain: "vpn.example.com", Scheme: "https", Port: 443},
		{Domain: "vpn.example.com", Scheme: "https", Port: 8443},
		{Domain: "vpn.example.com", Scheme: "http", Port: 28080},
		{Domain: "121.4.111.208", Scheme: "http", Port: 28080},
		{Domain: "121.4.111.208", Scheme: "https", Port: 28080},
	} {
		httpSite, httpsSite, err := nginxconfig.RenderWithOptions(want, nil, 0)
		if err != nil {
			t.Fatal(err)
		}
		got, err := parseManagedEntry(httpSite + httpsSite)
		if err != nil || got != want {
			t.Fatalf("parse managed entry = %+v, %v; want %+v", got, err, want)
		}
	}
	if _, err := parseManagedEntry("server { listen 443 ssl; }"); err == nil {
		t.Fatal("unmanaged site must be rejected")
	}
}

func TestIPCertificateRequiresWebrootCapableCertbot(t *testing.T) {
	for _, version := range []string{"certbot 2.9.0", "certbot 5.3.1", "unknown"} {
		if _, err := ipCertificateArgsForVersion("121.4.111.208", version); err == nil {
			t.Fatalf("accepted unsupported version %q", version)
		}
	}
	args, err := ipCertificateArgsForVersion("121.4.111.208", "certbot 5.4.0")
	if err != nil || strings.Join(args, " ") != "--preferred-profile shortlived --ip-address 121.4.111.208" {
		t.Fatalf("unexpected IP ACME flags %q: %v", args, err)
	}
	if !strings.Contains(renewalHook(), "RENEWED_LINEAGE") || !strings.Contains(renewalHook(), "cert-renewals.log") {
		t.Fatal("deploy hook must record a successful renewal")
	}
}

func TestSwapManagedSiteRestoresPreviousOnFailure(t *testing.T) {
	for _, failAt := range []string{"validate", "reload", "persist"} {
		t.Run(failAt, func(t *testing.T) {
			site := "old"
			validations, reloads := 0, 0
			write := func(content string) error { site = content; return nil }
			validate := func() error {
				validations++
				if failAt == "validate" && site == "new" {
					return errors.New("invalid nginx config")
				}
				return nil
			}
			reload := func() error {
				reloads++
				if failAt == "reload" && site == "new" {
					return errors.New("reload failed")
				}
				return nil
			}
			persist := func() error {
				if failAt == "persist" {
					return errors.New("save failed")
				}
				return nil
			}
			if err := swapManagedSite("old", "new", persist, write, validate, reload); err == nil {
				t.Fatal("expected failure")
			}
			if site != "old" || validations < 2 || reloads < 1 {
				t.Fatalf("old site not restored: site=%s validations=%d reloads=%d", site, validations, reloads)
			}
		})
	}
}