package gateway

import (
	"context"
	"crypto/sha256"
	"crypto/tls"
	"crypto/x509"
	"encoding/hex"
	"encoding/pem"
	"net"
	"net/http"
	"net/http/httptest"
	"strconv"
	"testing"

	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
)

func TestNativeApolloManagementUsesSessionScopedMTLS(t *testing.T) {
	serverTLS, clientTLS := testTLS(t)
	server := httptest.NewUnstartedServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
		if request.URL.Path != "/serverinfo" || request.TLS == nil || len(request.TLS.PeerCertificates) != 1 {
			http.Error(response, "mTLS required", http.StatusUnauthorized)
			return
		}
		_, _ = response.Write([]byte("<root><uniqueid>apollo-server</uniqueid></root>"))
	}))
	server.TLS = serverTLS
	server.StartTLS()
	defer server.Close()
	host, portText, err := net.SplitHostPort(server.Listener.Addr().String())
	if err != nil {
		t.Fatal(err)
	}
	port, err := strconv.ParseInt(portText, 10, 64)
	if err != nil {
		t.Fatal(err)
	}
	pinned := sha256.Sum256(serverTLS.Certificates[0].Certificate[0])
	work := protocol.ProviderSessionWork{
		Version: "1", SessionID: "session-1", GatewayID: "gateway-1", ReconnectSequence: 0,
		ExpiresAt: "2099-01-01T00:00:00Z", ProviderProfile: ProviderProfileApollo,
		ProviderIdentity: "apollo-server#sha256:" + hex.EncodeToString(pinned[:]), PolicyVersionID: "policy-1", ApplicationID: "1",
		ManagementHost: host, ManagementPort: port, StreamHost: host, StreamPort: 47984,
		ClientCertificatePem: certificatePEM(t, clientTLS.Certificates[0]),
		ClientPrivateKeyPem:  privateKeyPEM(t, clientTLS.Certificates[0]),
		ServerCertificatePem: certificatePEM(t, tls.Certificate{Certificate: [][]byte{serverTLS.Certificates[0].Certificate[1]}}),
	}
	data, err := NewNativeApolloBackend().Management(context.Background(), LaunchRequest{SessionID: "session-1", ProviderProfile: ProviderProfileApollo, ProviderWork: work})
	if err != nil {
		t.Fatalf("Management() error = %v", err)
	}
	if info, err := ParseManagementXML(data); err != nil || info.Identity.UniqueID != "apollo-server" {
		t.Fatalf("ParseManagementXML() = %+v, %v", info, err)
	}
}

func certificatePEM(t *testing.T, certificate tls.Certificate) string {
	t.Helper()
	if len(certificate.Certificate) == 0 {
		t.Fatal("expected certificate")
	}
	return string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certificate.Certificate[0]}))
}

func privateKeyPEM(t *testing.T, certificate tls.Certificate) string {
	t.Helper()
	encoded, err := x509.MarshalPKCS8PrivateKey(certificate.PrivateKey)
	if err != nil {
		t.Fatal(err)
	}
	return string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: encoded}))
}