package tlsservice

import (
	"net"
	"net/http"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestDomainValidationAndRestart(t *testing.T) {
	t.Setenv("VPN_TLS_MODE", "autocert")
	for _, domain := range []string{"test-link.appx365.com", "a.b"} {
		if !ValidDomain(domain) {
			t.Errorf("valid domain rejected: %s", domain)
		}
	}
	for _, domain := range []string{"", "localhost", "127.0.0.1", "-a.example.com", "a..example.com", "a.example.com:80", "*.example.com", "a.example.com/evil"} {
		if ValidDomain(domain) {
			t.Errorf("invalid domain accepted: %s", domain)
		}
	}

	t.Setenv("VPN_TLS_DOMAIN", "")
	dir := t.TempDir()
	if err := Start(http.NotFoundHandler(), dir); err != nil {
		t.Fatal(err)
	}
	if err := ConfigureDomain(dir, "Test-Link.Appx365.Com"); err != nil {
		t.Fatal(err)
	}
	status := Status()
	if status.Enabled || status.Domain != "" || status.ConfiguredDomain != "test-link.appx365.com" || !status.RestartRequired {
		t.Fatalf("saved domain must wait for restart: %+v", status)
	}
	info, err := os.Stat(filepath.Join(dir, "tls-domain"))
	if err != nil || info.Mode().Perm() != 0o600 {
		t.Fatalf("domain config permissions: %v, %v", info, err)
	}
	t.Setenv("VPN_TLS_DOMAIN", "other.example.com")
	if err := ConfigureDomain(dir, "test-link.appx365.com"); err == nil {
		t.Fatal("environment-managed domain must not be overwritten")
	}
}

func TestHTTPIPv4PublicEntry(t *testing.T) {
	for _, host := range []string{"121.4.111.208", "127.0.0.1", "vpn.example.com"} {
		if !ValidPublicHost("http", host) {
			t.Fatalf("valid HTTP host rejected: %s", host)
		}
	}
	for _, host := range []string{"999.4.111.208", "121.4.111.208:28080", "0.0.0.0", "224.0.0.1", "::1", "123.456", "121.4.111.208/evil"} {
		if ValidPublicHost("http", host) {
			t.Fatalf("invalid HTTP host accepted: %s", host)
		}
	}
	if ValidPublicHost("https", "121.4.111.208") {
		t.Fatal("HTTPS IPv4 must require a domain")
	}
	if got := PublicBaseURL("http", "121.4.111.208", 28080); got != "http://121.4.111.208:28080" {
		t.Fatalf("unexpected public URL: %s", got)
	}
	t.Setenv("VPN_TLS_DOMAIN", "")
	t.Setenv("VPN_TLS_SCHEME", "")
	t.Setenv("VPN_TLS_PORT", "")
	dir := t.TempDir()
	if err := ConfigurePublicEntry(dir, "http", "121.4.111.208", 28080); err != nil {
		t.Fatal(err)
	}
	if err := ConfigurePublicEntry(dir, "https", "121.4.111.208", 443); err == nil {
		t.Fatal("HTTPS IPv4 was persisted")
	}
}

func TestFailedHTTPSBindReleasesHTTPPort(t *testing.T) {
	t.Setenv("VPN_TLS_MODE", "autocert")
	t.Setenv("VPN_TLS_DOMAIN", "test-link.appx365.com")
	occupied, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	defer occupied.Close()
	httpPort, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	httpAddr := httpPort.Addr().String()
	httpPort.Close()
	t.Setenv("VPN_TLS_HTTP_ADDR", httpAddr)
	t.Setenv("VPN_TLS_HTTPS_ADDR", occupied.Addr().String())
	if err := Start(http.NotFoundHandler(), t.TempDir()); err == nil || !strings.Contains(err.Error(), "HTTPS") {
		t.Fatalf("expected HTTPS port conflict: %v", err)
	}
	rebound, err := net.Listen("tcp", httpAddr)
	if err != nil {
		t.Fatalf("HTTP listener leaked after HTTPS bind failed: %v", err)
	}
	rebound.Close()
	if Status().Enabled {
		t.Fatal("failed start reported active TLS")
	}
}

func TestNginxModeDoesNotBindGoListeners(t *testing.T) {
	t.Setenv("VPN_TLS_MODE", "nginx")
	t.Setenv("VPN_TLS_DOMAIN", "test-link.appx365.com")
	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
	if err := Start(http.NotFoundHandler(), t.TempDir()); err != nil {
		t.Fatal(err)
	}
	status := Status()
	if status.Mode != "nginx" || status.Enabled || status.Domain != "" || status.ConfiguredDomain != "test-link.appx365.com" || !status.DirectPortPublic {
		t.Fatalf("proxy mode must not claim Go listens: %+v", status)
	}
	t.Setenv("VPN_LISTEN_ADDR", "127.0.0.1:18080")
	if Status().DirectPortPublic {
		t.Fatal("loopback management listener must not be marked public")
	}
}

func TestDefaultModeIsNginxAndExplicitGoModeIsPreserved(t *testing.T) {
	t.Setenv("VPN_TLS_MODE", "")
	t.Setenv("VPN_TLS_DOMAIN", "")
	t.Setenv("VPN_TLS_SCHEME", "")
	t.Setenv("VPN_TLS_PORT", "")
	dir := t.TempDir()
	if err := ConfigurePublicEntry(dir, "https", "vpn.example.com", 443); err != nil {
		t.Fatal(err)
	}
	if err := Start(http.NotFoundHandler(), dir); err != nil {
		t.Fatal(err)
	}
	if got := Status(); got.Mode != "nginx" || got.Enabled || got.ConfiguredPublicBase != "https://vpn.example.com" {
		t.Fatalf("default must keep the public listener under Nginx control: %+v", got)
	}
	if err := writePersisted(dir, "tls-mode", "autocert"); err != nil {
		t.Fatal(err)
	}
	config, err := configFromEnvironment(dir)
	if err != nil || config.mode != "autocert" {
		t.Fatalf("explicit legacy mode must be readable: %+v, %v", config, err)
	}
}

func TestNginxEntryCanAdoptWithoutRestart(t *testing.T) {
	t.Setenv("VPN_TLS_MODE", "")
	t.Setenv("VPN_TLS_DOMAIN", "")
	t.Setenv("VPN_TLS_SCHEME", "")
	t.Setenv("VPN_TLS_PORT", "")
	dir := t.TempDir()
	if err := ConfigureMode(dir, "nginx"); err != nil {
		t.Fatal(err)
	}
	if err := ConfigurePublicEntry(dir, "https", "first.example.com", 443); err != nil {
		t.Fatal(err)
	}
	if err := Start(http.NotFoundHandler(), dir); err != nil {
		t.Fatal(err)
	}
	if err := ConfigurePublicEntry(dir, "http", "second.example.com", 8080); err != nil {
		t.Fatal(err)
	}
	if s := Status(); s.PublicBase == "http://second.example.com:8080" || s.RestartRequired {
		t.Fatalf("unapplied nginx config must not claim the new entry or require process restart: %+v", s)
	}
	if err := AdoptNginxConfiguration(dir); err != nil {
		t.Fatal(err)
	}
	if s := Status(); s.RestartRequired || s.ConfiguredPublicBase != "http://second.example.com:8080" || s.PublicBase != s.ConfiguredPublicBase {
		t.Fatalf("nginx config was not adopted: %+v", s)
	}
	if err := UseManagedNginxEntry(dir, "https", "first.example.com", 443); err != nil {
		t.Fatal(err)
	}
	if s := Status(); s.PublicBase == s.ConfiguredPublicBase || s.ConfiguredPublicBase != "http://second.example.com:8080" {
		t.Fatalf("live Nginx address must remain distinct from saved draft: %+v", s)
	}
}

func TestPublicBaseURL(t *testing.T) {
	cases := []struct {
		scheme, host string
		port         int
		want         string
	}{
		{"https", "vpn.example.com", 0, "https://vpn.example.com"},
		{"https", "vpn.example.com", 443, "https://vpn.example.com"},
		{"https", "vpn.example.com", 8443, "https://vpn.example.com:8443"},
		{"http", "vpn.example.com", 0, "http://vpn.example.com"},
		{"http", "vpn.example.com", 80, "http://vpn.example.com"},
		{"http", "vpn.example.com", 8080, "http://vpn.example.com:8080"},
		{"HTTP", "VPN.Example.Com", 8080, "http://vpn.example.com:8080"},
		{"https", "", 443, ""},
		{"ftp", "vpn.example.com", 0, ""},
	}
	for _, tc := range cases {
		got := PublicBaseURL(tc.scheme, tc.host, tc.port)
		if got != tc.want {
			t.Fatalf("PublicBaseURL(%q,%q,%d)=%q want %q", tc.scheme, tc.host, tc.port, got, tc.want)
		}
	}
}

func TestConfigurePublicEntryHTTPAndCustomPort(t *testing.T) {
	t.Setenv("VPN_TLS_DOMAIN", "")
	t.Setenv("VPN_TLS_SCHEME", "")
	t.Setenv("VPN_TLS_PORT", "")
	t.Setenv("VPN_TLS_MODE", "")
	dir := t.TempDir()
	if err := ConfigureMode(dir, "nginx"); err != nil {
		t.Fatal(err)
	}
	if err := ConfigurePublicEntry(dir, "http", "vpn.example.com", 8080); err != nil {
		t.Fatal(err)
	}
	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
	if err := Start(http.NotFoundHandler(), dir); err != nil {
		t.Fatal(err)
	}
	status := Status()
	if status.Scheme != "http" || status.Domain != "vpn.example.com" || status.Port != 8080 {
		t.Fatalf("unexpected status fields: %+v", status)
	}
	if status.PublicBase != "http://vpn.example.com:8080" {
		t.Fatalf("public_base = %q", status.PublicBase)
	}
	if status.Valid {
		t.Fatal("http entry must not require certificate Valid")
	}
	if status.ConfiguredPublicBase != "http://vpn.example.com:8080" {
		t.Fatalf("configured_public_base = %q", status.ConfiguredPublicBase)
	}
}

func TestConfigurePublicEntryHTTPSOmitsDefaultPort(t *testing.T) {
	t.Setenv("VPN_TLS_DOMAIN", "")
	t.Setenv("VPN_TLS_SCHEME", "")
	t.Setenv("VPN_TLS_PORT", "")
	t.Setenv("VPN_TLS_MODE", "nginx")
	dir := t.TempDir()
	if err := ConfigurePublicEntry(dir, "https", "vpn.example.com", 443); err != nil {
		t.Fatal(err)
	}
	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
	if err := Start(http.NotFoundHandler(), dir); err != nil {
		t.Fatal(err)
	}
	// Without a leaf cert, https nginx Domain stays empty; configured base still omits :443.
	status := Status()
	if status.ConfiguredPublicBase != "https://vpn.example.com" {
		t.Fatalf("configured_public_base = %q", status.ConfiguredPublicBase)
	}
	if status.ConfiguredPort != 443 && status.ConfiguredPort != 0 {
		// persisted 443 is fine; EffectivePort still omits in PublicBaseURL
		t.Logf("configured port = %d", status.ConfiguredPort)
	}
}