package proxmox

import (
	"context"
	"crypto/sha256"
	"crypto/x509"
	"encoding/hex"
	"io"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"forgejo.digital-droplets.de/philschlo/proxui/platform/cluster"
)

func TestClientAcceptsMatchingFingerprintAndSendsTokenHeader(t *testing.T) {
	var authHeader string
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		authHeader = r.Header.Get("Authorization")
		if r.URL.Path != "/api2/json/version" {
			t.Fatalf("path = %q, want /api2/json/version", r.URL.Path)
		}
		_, _ = w.Write([]byte(`{"data":{"version":"8.2"}}`))
	}))
	defer server.Close()

	client := newTestClient(t, server, fingerprintForServer(server))
	response, err := client.Get(context.Background(), "/version")
	if err != nil {
		t.Fatalf("Get() error = %v", err)
	}
	defer response.Body.Close()

	if response.StatusCode != http.StatusOK {
		t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusOK)
	}
	if authHeader != "PVEAPIToken=root@pam!proxui=secret-token" {
		t.Fatalf("Authorization = %q", authHeader)
	}
}

func TestClientAcceptsPinnedSelfSignedCertificate(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/api2/json/version" {
			t.Fatalf("path = %q, want /api2/json/version", r.URL.Path)
		}
		_, _ = w.Write([]byte(`{"data":{"version":"9.2"}}`))
	}))
	defer server.Close()

	client, err := NewClient(cluster.Cluster{
		APIEndpoint:    server.URL + "/api2/json",
		TLSFingerprint: fingerprintForServer(server),
		TokenID:        "root@pam!proxui",
		TokenSecret:    "secret-token",
	}, WithTimeout(time.Second), WithRetries(0))
	if err != nil {
		t.Fatalf("NewClient() error = %v", err)
	}

	response, err := client.Get(context.Background(), "/version")
	if err != nil {
		t.Fatalf("Get() error = %v", err)
	}
	defer response.Body.Close()

	if response.StatusCode != http.StatusOK {
		t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusOK)
	}
}

func TestClientRejectsMismatchedFingerprint(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))
	defer server.Close()

	client := newTestClient(t, server, strings.Repeat("0", sha256.Size*2))
	_, err := client.Get(context.Background(), "/version")
	if err == nil {
		t.Fatal("Get() error = nil, want error")
	}
	if !strings.Contains(err.Error(), "fingerprint mismatch") {
		t.Fatalf("error = %q, want fingerprint mismatch", err)
	}
}

func TestClientRetriesServerErrors(t *testing.T) {
	var calls int
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		calls++
		if calls == 1 {
			http.Error(w, "temporary", http.StatusBadGateway)
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}))
	defer server.Close()

	client := newTestClient(t, server, fingerprintForServer(server))
	response, err := client.Post(context.Background(), "/nodes/pve/status", []byte(`{"command":"start"}`))
	if err != nil {
		t.Fatalf("Post() error = %v", err)
	}
	defer response.Body.Close()
	_, _ = io.Copy(io.Discard, response.Body)

	if response.StatusCode != http.StatusNoContent {
		t.Fatalf("status = %d, want %d", response.StatusCode, http.StatusNoContent)
	}
	if calls != 2 {
		t.Fatalf("calls = %d, want 2", calls)
	}
}

func TestClientGetsTaskStatus(t *testing.T) {
	upid := "UPID:pve:1:2:3:qmstart:100:root@pam!ui:"
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/api2/json/nodes/pve/tasks/"+upid+"/status" {
			t.Fatalf("path = %q", r.URL.Path)
		}
		_, _ = w.Write([]byte(`{"data":{"status":"stopped","exitstatus":"OK"}}`))
	}))
	defer server.Close()

	client := newTestClient(t, server, fingerprintForServer(server))
	status, err := client.GetTaskStatus(context.Background(), "pve", upid)
	if err != nil {
		t.Fatalf("GetTaskStatus() error = %v", err)
	}

	if status.Status != "stopped" {
		t.Fatalf("Status = %q, want stopped", status.Status)
	}
	if status.ExitStatus != "OK" {
		t.Fatalf("ExitStatus = %q, want OK", status.ExitStatus)
	}
}

func TestClientPowersVM(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodPost {
			t.Fatalf("method = %s, want POST", r.Method)
		}
		if r.URL.Path != "/api2/json/nodes/pve/qemu/100/status/start" {
			t.Fatalf("path = %q", r.URL.Path)
		}
		_, _ = w.Write([]byte(`{"data":"UPID:pve:1"}`))
	}))
	defer server.Close()

	client := newTestClient(t, server, fingerprintForServer(server))
	upid, err := client.PowerVM(context.Background(), "pve", 100, "start")
	if err != nil {
		t.Fatalf("PowerVM() error = %v", err)
	}
	if upid != "UPID:pve:1" {
		t.Fatalf("UPID = %q, want UPID:pve:1", upid)
	}
}

func TestClientGetsVMStatus(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/api2/json/nodes/pve/qemu/100/status/current" {
			t.Fatalf("path = %q", r.URL.Path)
		}
		_, _ = w.Write([]byte(`{"data":{"status":"running"}}`))
	}))
	defer server.Close()

	client := newTestClient(t, server, fingerprintForServer(server))
	status, err := client.GetVMStatus(context.Background(), "pve", 100)
	if err != nil {
		t.Fatalf("GetVMStatus() error = %v", err)
	}
	if status.Status != "running" {
		t.Fatalf("status = %q, want running", status.Status)
	}
}

func TestClientConfiguresHardware(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodPost {
			t.Fatalf("method = %s, want POST", r.Method)
		}
		if r.URL.Path != "/api2/json/nodes/pve/qemu/100/config" {
			t.Fatalf("path = %q", r.URL.Path)
		}
		body, err := io.ReadAll(r.Body)
		if err != nil {
			t.Fatalf("read body: %v", err)
		}
		if !strings.Contains(string(body), `"cores":4`) {
			t.Fatalf("body = %s, want cores", body)
		}
		if !strings.Contains(string(body), `"memory":6144`) {
			t.Fatalf("body = %s, want memory", body)
		}
		_, _ = w.Write([]byte(`{"data":"UPID:pve:config"}`))
	}))
	defer server.Close()

	client := newTestClient(t, server, fingerprintForServer(server))
	upid, err := client.ConfigureHardware(context.Background(), "pve", 100, HardwareConfig{Cores: 4, Memory: 6144})
	if err != nil {
		t.Fatalf("ConfigureHardware() error = %v", err)
	}
	if upid != "UPID:pve:config" {
		t.Fatalf("UPID = %q, want UPID:pve:config", upid)
	}
}

func TestClientResizesDisk(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodPut {
			t.Fatalf("method = %s, want PUT", r.Method)
		}
		if r.URL.Path != "/api2/json/nodes/pve/qemu/100/resize" {
			t.Fatalf("path = %q", r.URL.Path)
		}
		body, err := io.ReadAll(r.Body)
		if err != nil {
			t.Fatalf("read body: %v", err)
		}
		if !strings.Contains(string(body), `"disk":"scsi0"`) {
			t.Fatalf("body = %s, want disk", body)
		}
		if !strings.Contains(string(body), `"size":"30G"`) {
			t.Fatalf("body = %s, want size", body)
		}
		_, _ = w.Write([]byte(`{"data":"UPID:pve:resize"}`))
	}))
	defer server.Close()

	client := newTestClient(t, server, fingerprintForServer(server))
	upid, err := client.ResizeDisk(context.Background(), "pve", 100, "scsi0", 30)
	if err != nil {
		t.Fatalf("ResizeDisk() error = %v", err)
	}
	if upid != "UPID:pve:resize" {
		t.Fatalf("UPID = %q, want UPID:pve:resize", upid)
	}
}

func TestNewClientRejectsInvalidFingerprint(t *testing.T) {
	_, err := NewClient(cluster.Cluster{
		APIEndpoint:    "https://pve.example.test:8006/api2/json",
		TLSFingerprint: "invalid",
		TokenID:        "root@pam!proxui",
		TokenSecret:    "secret-token",
	})
	if err == nil {
		t.Fatal("NewClient() error = nil, want error")
	}
}

func newTestClient(t *testing.T, server *httptest.Server, fingerprint string) *Client {
	t.Helper()

	rootCAs := x509.NewCertPool()
	rootCAs.AddCert(server.Certificate())

	client, err := NewClient(cluster.Cluster{
		APIEndpoint:    server.URL + "/api2/json",
		TLSFingerprint: fingerprint,
		TokenID:        "root@pam!proxui",
		TokenSecret:    "secret-token",
	}, WithRootCAs(rootCAs), WithTimeout(time.Second), WithRetries(1))
	if err != nil {
		t.Fatalf("NewClient() error = %v", err)
	}
	return client
}

func fingerprintForServer(server *httptest.Server) string {
	sum := sha256.Sum256(server.Certificate().Raw)
	return hex.EncodeToString(sum[:])
}