package api

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"vpn-platform/backend/internal/tlsservice"
)

func TestTLSStatusRequiresAdmin(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.GET("/api/system/tls", func(c *gin.Context) {
		c.Set("role", c.GetHeader("X-Test-Role"))
		c.Next()
	}, requireRole("admin"), (&Server{}).tlsStatus)

	for _, role := range []string{"", "viewer", "operator"} {
		req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
		req.Header.Set("X-Test-Role", role)
		resp := httptest.NewRecorder()
		router.ServeHTTP(resp, req)
		if resp.Code != http.StatusForbidden {
			t.Errorf("role %q received HTTP %d", role, resp.Code)
		}
	}

	req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
	req.Header.Set("X-Test-Role", "admin")
	resp := httptest.NewRecorder()
	router.ServeHTTP(resp, req)
	if resp.Code != http.StatusOK {
		t.Fatalf("admin received HTTP %d", resp.Code)
	}
	var data map[string]any
	if err := json.Unmarshal(resp.Body.Bytes(), &data); err != nil {
		t.Fatal(err)
	}
	if _, ok := data["configured_domain"]; !ok {
		t.Fatal("admin response missing configured domain")
	}
	for _, secret := range []string{"private_key", "account_key", "certificate_pem"} {
		if _, ok := data[secret]; ok {
			t.Errorf("response exposes %s", secret)
		}
	}
}

func TestLegacyGoGatewayRejectsPublicEntryChanges(t *testing.T) {
	t.Setenv("VPN_TLS_MODE", "autocert")
	t.Setenv("VPN_TLS_DOMAIN", "")
	if err := tlsservice.Start(http.NotFoundHandler(), t.TempDir()); err != nil {
		t.Fatal(err)
	}
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.PUT("/api/system/tls/domain", (&Server{}).setTLSDomain)
	request := httptest.NewRequest(http.MethodPut, "/api/system/tls/domain", bytes.NewBufferString(`{"domain":"other.example.com","scheme":"https","port":443}`))
	request.Header.Set("Content-Type", "application/json")
	response := httptest.NewRecorder()
	router.ServeHTTP(response, request)
	if response.Code != http.StatusConflict {
		t.Fatalf("legacy Go mode should require manual migration: %d %s", response.Code, response.Body.String())
	}
}