package tlsservice

import (
	"net"
	"net/http"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestDomainValidationAndRestart(t *testing.T) {
	for _, domain := range []string{"test-link.appx365.com", "a.b"} {
		if !ValidDomain(domain) {
			t.Errorf("valid domain rejected: %s", domain)
		}
	}
	for _, domain := range []string{"", "localhost", "127.0.0.1", "-a.example.com", "a..example.com", "a.example.com:80", "*.example.com", "a.example.com/evil"} {
		if ValidDomain(domain) {
			t.Errorf("invalid domain accepted: %s", domain)
		}
	}

	t.Setenv("VPN_TLS_DOMAIN", "")
	dir := t.TempDir()
	if err := Start(http.NotFoundHandler(), dir); err != nil {
		t.Fatal(err)
	}
	if err := ConfigureDomain(dir, "Test-Link.Appx365.Com"); err != nil {
		t.Fatal(err)
	}
	status := Status()
	if status.Enabled || status.Domain != "" || status.ConfiguredDomain != "test-link.appx365.com" || !status.RestartRequired {
		t.Fatalf("saved domain must wait for restart: %+v", status)
	}
	info, err := os.Stat(filepath.Join(dir, "tls-domain"))
	if err != nil || info.Mode().Perm() != 0o600 {
		t.Fatalf("domain config permissions: %v, %v", info, err)
	}
	t.Setenv("VPN_TLS_DOMAIN", "other.example.com")
	if err := ConfigureDomain(dir, "test-link.appx365.com"); err == nil {
		t.Fatal("environment-managed domain must not be overwritten")
	}
}

func TestFailedHTTPSBindReleasesHTTPPort(t *testing.T) {
	t.Setenv("VPN_TLS_DOMAIN", "test-link.appx365.com")
	occupied, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	defer occupied.Close()
	httpPort, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	httpAddr := httpPort.Addr().String()
	httpPort.Close()
	t.Setenv("VPN_TLS_HTTP_ADDR", httpAddr)
	t.Setenv("VPN_TLS_HTTPS_ADDR", occupied.Addr().String())
	if err := Start(http.NotFoundHandler(), t.TempDir()); err == nil || !strings.Contains(err.Error(), "HTTPS") {
		t.Fatalf("expected HTTPS port conflict: %v", err)
	}
	rebound, err := net.Listen("tcp", httpAddr)
	if err != nil {
		t.Fatalf("HTTP listener leaked after HTTPS bind failed: %v", err)
	}
	rebound.Close()
	if Status().Enabled {
		t.Fatal("failed start reported active TLS")
	}
}