package jwks

import (
	"context"
	"crypto/rand"
	"crypto/rsa"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"sync/atomic"
	"testing"

	"github.com/rakutentech/jwk-go/jwk"
	"github.com/stretchr/testify/require"
)

type testKey struct {
	Kid string
	Key any
}

func parseRSA(t *testing.T, k *JWK) *rsa.PublicKey {
	t.Helper()
	spec, err := k.ParseKeySpec()
	require.NoError(t, err)
	pub, ok := spec.Key.(*rsa.PublicKey)
	require.True(t, ok)
	return pub
}

func randomKeys() (*rsa.PrivateKey, *rsa.PublicKey, error) {
	privateKey, err := rsa.GenerateKey(rand.Reader, 1024)
	if err != nil {
		return nil, nil, err
	}

	return privateKey, &privateKey.PublicKey, nil
}

func jwksHandler(keys ...testKey) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		specs := jwk.KeySpecSet{}

		for _, key := range keys {
			spec := jwk.NewSpecWithID(key.Kid, key.Key)
			spec.Use = "sig"
			specs.Keys = append(specs.Keys, *spec)
		}

		data, err := json.Marshal(specs)
		if err != nil {
			http.Error(w, "Server Error", http.StatusInternalServerError)
			return
		}

		w.Header().Set("Content-Type", "application/json")
		_, _ = w.Write(data)
	})
}

func TestManagerFetchKey_UnmarshalError(t *testing.T) {
	mux := http.NewServeMux()
	path := "/.well-known/jwks.json"
	mux.HandleFunc(path, func(writer http.ResponseWriter, request *http.Request) {
		writer.WriteHeader(http.StatusOK)
		_, _ = writer.Write([]byte(`...`))
	})
	server := httptest.NewServer(mux)
	defer server.Close()

	manager, err := NewManager(server.URL + path)
	require.NoError(t, err)

	_, err = manager.FetchKey(context.Background(), "202101", nil)
	require.ErrorIs(t, err, errUnmarshal)
}

func TestManagerFetchKey_KeyNotFound(t *testing.T) {
	mux := http.NewServeMux()
	path := "/.well-known/jwks.json"
	mux.HandleFunc(path, func(writer http.ResponseWriter, request *http.Request) {
		writer.WriteHeader(http.StatusOK)
		_, _ = writer.Write([]byte(`{"keys": []}`))
	})
	server := httptest.NewServer(mux)
	defer server.Close()

	manager, err := NewManager(server.URL + path)
	require.NoError(t, err)

	_, err = manager.FetchKey(context.Background(), "202101", nil)
	require.ErrorIs(t, err, ErrPublicKeyNotFound)
}

func TestManagerFetchKey_WrongStatusCode(t *testing.T) {
	mux := http.NewServeMux()
	path := "/.well-known/jwks.json"
	mux.HandleFunc(path, func(writer http.ResponseWriter, request *http.Request) {
		writer.WriteHeader(http.StatusInternalServerError)
	})
	server := httptest.NewServer(mux)
	defer server.Close()

	manager, err := NewManager(server.URL + path)
	require.NoError(t, err)

	_, err = manager.FetchKey(context.Background(), "202101", nil)
	require.ErrorIs(t, err, errUnexpectedStatusCode)
}

func TestManagerInitialFetchKey(t *testing.T) {
	_, pubKey, err := randomKeys()
	require.NoError(t, err)

	testCases := []struct {
		Name    string
		Handler http.Handler
		Kid     string
		Error   error
	}{
		{
			Name:    "OK",
			Handler: jwksHandler(testKey{"202101", pubKey}),
			Kid:     "202101",
		},
		{
			Name:    "NotFound",
			Handler: jwksHandler(testKey{"202101", pubKey}),
			Kid:     "202102",
			Error:   ErrPublicKeyNotFound,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.Name, func(t *testing.T) {
			r := require.New(t)

			ts := httptest.NewServer(tc.Handler)
			defer ts.Close()

			manager, err := NewManager(ts.URL)
			r.NoError(err)

			key, err := manager.FetchKey(context.Background(), tc.Kid, nil)
			if tc.Error != nil {
				r.Error(err)
				r.ErrorIs(err, tc.Error)
			} else {
				r.NoError(err)
				r.Equal(tc.Kid, key.Kid)
			}
		})
	}
}

func TestManagerFetchKey_PathTraversalRejected(t *testing.T) {
	kid := "test-kid"

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		t.Fatal("request should have been rejected before reaching the server")
	}))
	defer ts.Close()

	manager, err := NewManager(ts.URL + "/tenants/{{tenant}}/jwks.json")
	require.NoError(t, err)

	// Path traversal via ".." — must be rejected.
	tokenVars := map[string]any{"tenant": "../../etc"}
	_, err = manager.FetchKey(context.Background(), kid, tokenVars)
	require.Error(t, err)
	require.Contains(t, err.Error(), "traversal")

	// Single ".." segment — also rejected.
	tokenVars = map[string]any{"tenant": ".."}
	_, err = manager.FetchKey(context.Background(), kid, tokenVars)
	require.Error(t, err)
	require.Contains(t, err.Error(), "traversal")

	// Clean value — must succeed (uses real server).
	_, pubKey, err := randomKeys()
	require.NoError(t, err)

	ts2 := httptest.NewServer(jwksHandler(testKey{kid, pubKey}))
	defer ts2.Close()

	manager, err = NewManager(ts2.URL + "/tenants/{{tenant}}/jwks.json")
	require.NoError(t, err)

	tokenVars = map[string]any{"tenant": "acme"}
	key, err := manager.FetchKey(context.Background(), kid, tokenVars)
	require.NoError(t, err)
	require.Equal(t, kid, key.Kid)
}

func TestManagerCachedFetchKey(t *testing.T) {
	testCases := []struct {
		Name         string
		Options      []Option
		ExpectedSize int
	}{
		{
			Name:         "Default",
			ExpectedSize: 1,
		},
		{
			Name:         "NoCacheLookup",
			Options:      []Option{WithUseCache(false)},
			ExpectedSize: 0,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.Name, func(t *testing.T) {
			r := require.New(t)

			ctx := context.Background()
			kid := "202101"

			_, pubKey, err := randomKeys()
			r.NoError(err)

			ts := httptest.NewServer(jwksHandler(testKey{kid, pubKey}))
			defer ts.Close()

			manager, err := NewManager(ts.URL, tc.Options...)
			r.NoError(err)

			key, err := manager.FetchKey(ctx, kid, nil)
			r.NoError(err)
			r.Equal(kid, key.Kid)

			size, err := manager.cache.Len()
			r.NoError(err)
			r.Equal(tc.ExpectedSize, size)
		})
	}
}

// TestManagerFetchKey_CacheScopedByResolvedURL is a regression test for a
// cross-trust-domain cache reuse bug: when JWKS URLs are templated from token
// claims (e.g., per-tenant endpoints), a key cached from tenant A's endpoint
// must NOT satisfy a lookup for tenant B's endpoint, even if both JWKS documents
// advertise the same kid. kid values are not globally unique by spec and may
// collide across issuers.
func TestManagerFetchKey_CacheScopedByResolvedURL(t *testing.T) {
	const sharedKid = "shared-kid"

	_, tenantAPubKey, err := randomKeys()
	require.NoError(t, err)
	_, tenantBPubKey, err := randomKeys()
	require.NoError(t, err)

	var tenantARequests, tenantBRequests int32

	mux := http.NewServeMux()
	mux.HandleFunc("/tenant-a/jwks.json", func(w http.ResponseWriter, r *http.Request) {
		atomic.AddInt32(&tenantARequests, 1)
		jwksHandler(testKey{sharedKid, tenantAPubKey}).ServeHTTP(w, r)
	})
	mux.HandleFunc("/tenant-b/jwks.json", func(w http.ResponseWriter, r *http.Request) {
		atomic.AddInt32(&tenantBRequests, 1)
		jwksHandler(testKey{sharedKid, tenantBPubKey}).ServeHTTP(w, r)
	})
	ts := httptest.NewServer(mux)
	defer ts.Close()

	manager, err := NewManager(ts.URL + "/{{tenant}}/jwks.json")
	require.NoError(t, err)

	ctx := context.Background()

	keyA, err := manager.FetchKey(ctx, sharedKid, map[string]any{"tenant": "tenant-a"})
	require.NoError(t, err)
	require.Equal(t, tenantAPubKey.N, parseRSA(t, keyA).N)
	require.Equal(t, int32(1), atomic.LoadInt32(&tenantARequests))
	require.Equal(t, int32(0), atomic.LoadInt32(&tenantBRequests))

	// Fetching for tenant B with the same kid must consult tenant B's endpoint,
	// not reuse the cached tenant A key.
	keyB, err := manager.FetchKey(ctx, sharedKid, map[string]any{"tenant": "tenant-b"})
	require.NoError(t, err)
	require.Equal(t, tenantBPubKey.N, parseRSA(t, keyB).N)
	require.Equal(t, int32(1), atomic.LoadInt32(&tenantARequests))
	require.Equal(t, int32(1), atomic.LoadInt32(&tenantBRequests))

	// Second fetch for tenant A should hit the cache — no new HTTP request.
	_, err = manager.FetchKey(ctx, sharedKid, map[string]any{"tenant": "tenant-a"})
	require.NoError(t, err)
	require.Equal(t, int32(1), atomic.LoadInt32(&tenantARequests))
	require.Equal(t, int32(1), atomic.LoadInt32(&tenantBRequests))
}