use std::collections::HashMap;

use cielago::http::{fetch_token, send_request, send_with_auth};

use cielago::model::{AuthKind, AuthStyle, KeyValueRow, Method, OAuthConfig, SavedRequest};

use wiremock::matchers::{method, path, query_param};

use wiremock::{Mock, MockServer, ResponseTemplate};

#[tokio::test]

async fn sends_request_with_params_and_uuid_header() {

    let server = MockServer::start().await;

    Mock::given(method("GET"))

        .and(path("/pets/123"))

        .and(query_param("limit", "10"))

        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({"ok": true})))

        .mount(&server)

        .await;

    let mut req = SavedRequest::blank("get pet");

    req.method = Method::Get;

    req.path = "/pets/{petId}".into();

    req.path_params.push(KeyValueRow::new("petId", "123", true));

    req.query.push(KeyValueRow::new("limit", "10", true));

    req.query.push(KeyValueRow::new("disabled", "x", false));

    req.headers

        .push(KeyValueRow::new("X-Request-Id", "{{uuid}}", true));

    req.headers

        .push(KeyValueRow::new("X-Tenant", "{{tenant}}", true));

    let vars = HashMap::from([("tenant".to_string(), "acme".to_string())]);

    let client = reqwest::Client::new();

    let resp = send_request(&client, &server.uri(), &req, &vars, None, &[])

        .await

        .unwrap();

    assert_eq!(resp.status, 200);

    assert!(resp.body.contains("\"ok\": true"));

    // Inspect the recorded request.

    let received = server.received_requests().await.unwrap();

    assert_eq!(received.len(), 1);

    let r = &received[0];

    // {{uuid}} became a real UUID.

    let id = r.headers.get("x-request-id").unwrap().to_str().unwrap();

    assert!(uuid::Uuid::parse_str(id).is_ok(), "got {id}");

    // {{tenant}} became acme.

    assert_eq!(r.headers.get("x-tenant").unwrap().to_str().unwrap(), "acme");

    // disabled query param was not sent.

    assert!(!r.url.query().unwrap_or_default().contains("disabled"));

}

#[tokio::test]

async fn oauth_client_credentials_basic_flow() {

    let server = MockServer::start().await;

    Mock::given(method("POST"))

        .and(path("/token"))

        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({

            "access_token": "tok-abc",

            "expires_in": 3600

        })))

        .mount(&server)

        .await;

    let cfg = OAuthConfig {

        token_url: format!("{}/token", server.uri()),

        client_id: "my-id".into(),

        client_secret: "my-secret".into(),

        scopes: vec!["read".into(), "write".into()],

        auth_style: AuthStyle::Basic,

        ..Default::default()

    };

    let client = reqwest::Client::new();

    let token = fetch_token(&client, &cfg).await.unwrap();

    assert_eq!(token.access_token, "tok-abc");

    assert!(cielago::http::token_valid(&token));

    let received = server.received_requests().await.unwrap();

    assert_eq!(received.len(), 1);

    let r = &received[0];

    let auth = r

        .headers

        .get("authorization")

        .unwrap()

        .to_str()

        .unwrap()

        .to_string();

    assert!(auth.starts_with("Basic "), "got {auth}");

    let body = String::from_utf8_lossy(&r.body).into_owned();

    assert!(

        body.contains("grant_type=client_credentials"),

        "body: {body}"

    );

    assert!(body.contains("scope="), "body: {body}");

}

#[tokio::test]

async fn oauth_post_style_sends_creds_in_body() {

    let server = MockServer::start().await;

    Mock::given(method("POST"))

        .and(path("/token"))

        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({

            "access_token": "tok"

        })))

        .mount(&server)

        .await;

    let cfg = OAuthConfig {

        token_url: format!("{}/token", server.uri()),

        client_id: "id2".into(),

        client_secret: "secret2".into(),

        scopes: vec![],

        auth_style: AuthStyle::Post,

        ..Default::default()

    };

    let client = reqwest::Client::new();

    fetch_token(&client, &cfg).await.unwrap();

    let received = server.received_requests().await.unwrap();

    let r = &received[0];

    let body = String::from_utf8_lossy(&r.body).into_owned();

    assert!(body.contains("client_id=id2"), "body: {body}");

    assert!(body.contains("client_secret=secret2"), "body: {body}");

    assert!(r.headers.get("authorization").is_none());

}

#[tokio::test]

async fn bearer_token_injected_unless_header_present() {

    let server = MockServer::start().await;

    Mock::given(method("GET"))

        .and(path("/x"))

        .respond_with(ResponseTemplate::new(200))

        .mount(&server)

        .await;

    let client = reqwest::Client::new();

    let req = SavedRequest::blank("x");

    send_request(

        &client,

        &server.uri(),

        &req,

        &HashMap::new(),

        Some("tok-1"),

        &[],

    )

    .await

    .unwrap();

    let received = server.received_requests().await.unwrap();

    assert_eq!(

        received[0]

            .headers

            .get("authorization")

            .unwrap()

            .to_str()

            .unwrap(),

        "Bearer tok-1"

    );

    // Explicit Authorization header wins over the injected bearer.

    let mut req2 = SavedRequest::blank("x2");

    req2.headers

        .push(KeyValueRow::new("Authorization", "Bearer manual", true));

    send_request(

        &client,

        &server.uri(),

        &req2,

        &HashMap::new(),

        Some("tok-2"),

        &[],

    )

    .await

    .unwrap();

    let received = server.received_requests().await.unwrap();

    assert_eq!(

        received[1]

            .headers

            .get("authorization")

            .unwrap()

            .to_str()

            .unwrap(),

        "Bearer manual"

    );

}

#[tokio::test]

async fn api_key_auth_resolves_shell_secret_into_header() {

    let server = MockServer::start().await;

    Mock::given(method("GET"))

        .and(path("/x"))

        .respond_with(ResponseTemplate::new(200))

        .mount(&server)

        .await;

    // Value is a `$(…)` command substitution, resolved at send time.

    let cfg = OAuthConfig {

        kind: AuthKind::ApiKey,

        token: "$(printf 'sk-secret')".into(),

        header: "X-Api-Key".into(),

        ..Default::default()

    };

    let req = SavedRequest::blank("x");

    let client = reqwest::Client::new();

    let outcome = send_with_auth(

        &client,

        &server.uri(),

        &req,

        &HashMap::new(),

        Some(&cfg),

        None,

    )

    .await;

    assert!(outcome.result.is_ok(), "{:?}", outcome.result.err());

    assert!(outcome.token.is_none());

    let received = server.received_requests().await.unwrap();

    assert_eq!(

        received[0]

            .headers

            .get("x-api-key")

            .unwrap()

            .to_str()

            .unwrap(),

        "sk-secret"

    );

}

#[tokio::test]

async fn bearer_auth_sends_resolved_token() {

    let server = MockServer::start().await;

    Mock::given(method("GET"))

        .and(path("/x"))

        .respond_with(ResponseTemplate::new(200))

        .mount(&server)

        .await;

    let cfg = OAuthConfig {

        kind: AuthKind::Bearer,

        token: "plain-tok".into(),

        ..Default::default()

    };

    let req = SavedRequest::blank("x");

    let client = reqwest::Client::new();

    let outcome = send_with_auth(

        &client,

        &server.uri(),

        &req,

        &HashMap::new(),

        Some(&cfg),

        None,

    )

    .await;

    assert!(outcome.result.is_ok(), "{:?}", outcome.result.err());

    let received = server.received_requests().await.unwrap();

    assert_eq!(

        received[0]

            .headers

            .get("authorization")

            .unwrap()

            .to_str()

            .unwrap(),

        "Bearer plain-tok"

    );

}

/// The compose/decompose contract: what `split_url_input` pulls apart,

/// `build_url` must put back together.

#[test]

fn pasted_url_round_trips_through_build_url() {

    let pasted = "https://api.example.com/orgs/{orgId}/pets?limit=10&sort=name";

    let parts = cielago::http::split_url_input(pasted);

    let mut req = SavedRequest::blank("round trip");

    req.path = parts.path;

    req.query = parts.query.unwrap();

    req.sync_path_params();

    // Path params come out of the paste blank; fill the one placeholder.

    assert_eq!(req.path_params.len(), 1);

    req.path_params[0].value = "acme".into();

    let base = parts.origin.unwrap();

    let url = cielago::http::client::build_url(&base, &req, &HashMap::new());

    assert_eq!(url, "https://api.example.com/orgs/acme/pets");

    // The query is applied by reqwest rather than `build_url`, so check the rows.

    let query: Vec<(&str, &str)> = req

        .query

        .iter()

        .map(|r| (r.key.as_str(), r.value.as_str()))

        .collect();

    assert_eq!(query, vec![("limit", "10"), ("sort", "name")]);

}

/// End to end: a pasted URL becomes a request that actually reaches the server

/// it named, with the query it carried.

#[tokio::test]

async fn a_pasted_url_sends_to_the_pasted_server() {

    let server = MockServer::start().await;

    Mock::given(method("GET"))

        .and(path("/v1/pets"))

        .and(query_param("limit", "5"))

        .respond_with(ResponseTemplate::new(200).set_body_string("ok"))

        .mount(&server)

        .await;

    let parts = cielago::http::split_url_input(&format!("{}/v1/pets?limit=5", server.uri()));

    let mut req = SavedRequest::blank("pasted");

    req.path = parts.path;

    req.query = parts.query.unwrap();

    req.sync_path_params();

    let client = reqwest::Client::new();

    let resp = send_request(

        &client,

        &parts.origin.unwrap(),

        &req,

        &HashMap::new(),

        None,

        &[],

    )

    .await

    .unwrap();

    assert_eq!(resp.status, 200);

}