package capsule_test

import (
	"bytes"
	"context"
	"encoding/hex"
	"fmt"
	"net/http"
	"net/http/httptest"
	"sync/atomic"
	"testing"

	datekeys "g.activething.com/go/DateKeys"
	"g.activething.com/go/DateKeys/capsule"
	"g.activething.com/go/DateKeys/internal/testkit"
	"g.activething.com/go/DateKeys/profile"
	"g.activething.com/go/DateKeys/provider"
	"g.activething.com/go/DateKeys/provider/drand"
)

// Spec §63 steps 9 and 10: a source that fetches releases over a network
// verifies each response with the rules of step 10 and discards the one that
// fails, so a relay whose only answer is a release of another round, or a
// signature that does not verify, gives ERR_RELEASE_UNAVAILABLE at step 9.
// The codes of step 10 are those of a release supplied directly, as in the
// official vectors.
func TestReleaseFromANetworkSource(t *testing.T) {
	f := loadFixture(t, "time_only")
	for _, tc := range []struct {
		name    string
		release provider.Release
		direct  error // the code of step 10, nil when the release is valid
	}{
		{"the published release", f.release, nil},
		{"a release of another round, signed for that round", testkit.Release(1001), datekeys.ErrRoundMismatch},
		{"a negated signature", provider.Release{Round: 1000, Signature: testkit.Negated(f.release.Signature)}, datekeys.ErrReleaseInvalid},
	} {
		var requests atomic.Int32
		relay := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			requests.Add(1)
			fmt.Fprintf(w, `{"round":%d,"signature":"%s"}`, tc.release.Round, hex.EncodeToString(tc.release.Signature))
		}))
		o := f.openOptions(t)
		o.Source = drand.NewWithHTTPClient(relay.Client(), relay.URL)
		step, err := openAt(t, f.dkc, o)
		relay.Close()
		switch {
		case requests.Load() != 1:
			t.Errorf("%s: %d relay requests", tc.name, requests.Load())
		case tc.direct == nil && err != nil:
			t.Errorf("%s, from a relay: %v at step %d", tc.name, err, step)
		case tc.direct != nil && (datekeys.Code(err) != "ERR_RELEASE_UNAVAILABLE" || step != 9):
			t.Errorf("%s, from a relay: got %v at step %d, want ERR_RELEASE_UNAVAILABLE at step 9", tc.name, err, step)
		}

		// The same release, supplied directly.
		o.Source = provider.ReleaseSourceFunc(func(context.Context, *profile.Profile, provider.Condition) (provider.Release, error) {
			return tc.release, nil
		})
		step, err = openAt(t, f.dkc, o)
		if tc.direct == nil {
			if err != nil {
				t.Errorf("%s, supplied directly: %v at step %d", tc.name, err, step)
			}
			continue
		}
		expectStep(t, tc.name+", supplied directly", step, err, tc.direct, 10)
	}
}

// openAt runs the whole flow and returns the step that failed, 0 on success.
func openAt(t *testing.T, dkc []byte, o capsule.OpenOptions) (int, error) {
	t.Helper()
	out, err := capsule.Open(context.Background(), discardWriter{}, bytes.NewReader(dkc), o)
	if out == nil {
		t.Fatalf("Open returned no result: %v", err)
	}
	return failedStep(t, out.Inspection.Checks, err), err
}