using System.Net;
using System.Text;
using MoShiro.Backend.Api;

namespace MoShiro.Backend.Tests;

/// <summary>
/// 内嵌前端：白名单、不碰文件系统，路径穿越的各种写法全部 404；SPA 回退只给没有扩展名的路径，不吞 API 的 404；
/// 页面带 CSP 等响应头，哈希文件名的资源长缓存、入口页不缓存。
/// </summary>
public sealed class StaticSiteTests
{
    private static StaticSite Site() => new(
    [
        ("/index.html", Encoding.UTF8.GetBytes("<html>display</html>")),
        ("/assets/app-1a2b.js", Encoding.UTF8.GetBytes("console.log(1)")),
        ("/flags/cn.svg", Encoding.UTF8.GetBytes("<svg/>")),
        ("/admin/index.html", Encoding.UTF8.GetBytes("<html>admin</html>")),
        ("/admin/assets/app-3c4d.css", Encoding.UTF8.GetBytes("body{}")),
        ("/../secret.txt", Encoding.UTF8.GetBytes("must never be registered")),
    ]);

    private static string Text(SiteAsset? asset) => Encoding.UTF8.GetString(asset!.Content);

    [Fact]
    public void KnownFiles_AreServed_WithTypeAndCaching()
    {
        StaticSite site = Site();

        Assert.Equal("<html>display</html>", Text(site.Resolve("/").Asset));
        Assert.Equal("<html>admin</html>", Text(site.Resolve("/admin/").Asset));

        SiteAsset? js = site.Resolve("/assets/app-1a2b.js").Asset;
        Assert.StartsWith("text/javascript", js!.ContentType, StringComparison.Ordinal);
        Assert.Contains("immutable", js.CacheControl, StringComparison.Ordinal);
        Assert.False(js.Html);

        SiteAsset? index = site.Resolve("/index.html").Asset;
        Assert.Equal("no-cache", index!.CacheControl);
        Assert.True(index.Html);
        Assert.Equal("image/svg+xml", site.Resolve("/flags/cn.svg").Asset!.ContentType);
        Assert.StartsWith("text/css", site.Resolve("/admin/assets/app-3c4d.css").Asset!.ContentType, StringComparison.Ordinal);
    }

    [Fact]
    public void AdminWithoutSlash_RedirectsToAFixedPath()
    {
        SiteResolution resolution = Site().Resolve("/admin");

        Assert.Null(resolution.Asset);
        Assert.Equal("/admin/", resolution.Redirect);
    }

    [Theory]
    [InlineData("/../secret.txt")]
    [InlineData("/admin/../../etc/passwd")]
    [InlineData("/assets/../index.html")]
    [InlineData("/./index.html")]
    [InlineData("/%2e%2e/secret.txt")]
    [InlineData("/%2E%2E%2Fsecret.txt")]
    [InlineData("/..%2fsecret.txt")]
    [InlineData("/..%5csecret.txt")]
    [InlineData("/%252e%252e/secret.txt")]
    [InlineData("/..\\secret.txt")]
    [InlineData("/assets\\app-1a2b.js")]
    [InlineData("/assets//app-1a2b.js")]
    [InlineData("//assets/app-1a2b.js")]
    [InlineData("/index.html\0.png")]
    [InlineData("/index.html\r\nSet-Cookie: a=b")]
    [InlineData("/文件")]
    [InlineData("assets/app-1a2b.js")]
    [InlineData("")]
    public void TraversalAndMalformedPaths_AreNotFound_NeverNormalized(string path)
    {
        SiteResolution resolution = Site().Resolve(path);

        Assert.Null(resolution.Asset);
        Assert.Null(resolution.Redirect);
    }

    [Fact]
    public void OverlongPath_IsNotFound()
    {
        Assert.Null(Site().Resolve("/" + new string('a', 5000)).Asset);
    }

    [Fact]
    public void SpaFallback_OnlyForPathsWithoutAnExtension()
    {
        StaticSite site = Site();

        Assert.Equal("<html>display</html>", Text(site.Resolve("/lines/abc").Asset));
        Assert.Equal("<html>admin</html>", Text(site.Resolve("/admin/agents").Asset));
        Assert.Equal("<html>admin</html>", Text(site.Resolve("/admin/system/trust").Asset));

        // 缺失的文件不是页面：脚本、样式、图片 404 要保持 404，不能变成 HTML
        Assert.Null(site.Resolve("/assets/missing.js").Asset);
        Assert.Null(site.Resolve("/admin/assets/missing.css").Asset);
        Assert.Null(site.Resolve("/favicon.ico").Asset);
        Assert.Null(site.Resolve("/robots.txt").Asset);
    }

    [Fact]
    public void AdminAndDisplay_AreNotMixed()
    {
        StaticSite site = Site();

        // 展示端的路径永远不会得到管理端的页面，反过来管理端的前缀之外也一样
        Assert.Equal("<html>display</html>", Text(site.Resolve("/administrator").Asset));
        Assert.Equal("<html>display</html>", Text(site.Resolve("/adminx/agents").Asset));
        Assert.Null(site.Resolve("/admin/index.htm").Asset);
    }

    [Fact]
    public void EmptySite_ServesNothing()
    {
        var site = new StaticSite([]);

        Assert.Equal(0, site.Count);
        Assert.Null(site.Resolve("/").Asset);
        Assert.Null(site.Resolve("/admin/agents").Asset);
        Assert.Null(site.Resolve("/admin").Redirect);
    }

    [Fact]
    public void UncleanPathsAreRejectedWhenRegistering()
    {
        StaticSite site = Site();

        Assert.Equal(5, site.Count - 2); // 五个干净的文件；两个别名 "/" 和 "/admin/" 不算；"/../secret.txt" 没登记
    }
}

/// <summary>HTTP 层：后端自己的路径不会被前端的回退吞掉；响应头对。</summary>
[Collection("probe-e2e")]
public sealed class StaticSiteHttpTests
{
    private readonly BackendFixture _backend;

    public StaticSiteHttpTests(BackendFixture backend)
    {
        _backend = backend;
    }

    [Theory]
    [InlineData("/api/admin/does-not-exist")]
    [InlineData("/api/public/does-not-exist")]
    [InlineData("/api/agent/v1/nope")]
    [InlineData("/api")]
    [InlineData("/openapi/missing.json")]
    [InlineData("/install/missing")]
    [InlineData("/healthz/x")]
    public async Task BackendPaths_KeepTheirOwnNotFound_NotTheFrontend(string path)
    {
        using HttpClient client = _backend.NewClient();
        using HttpResponseMessage response = await client.GetAsync(path);

        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
        string body = await response.Content.ReadAsStringAsync();
        Assert.DoesNotContain("<html", body, StringComparison.OrdinalIgnoreCase);
    }

    [Theory]
    [InlineData("/api/admin/agents")]
    [InlineData("/healthz")]
    public async Task ExistingEndpoints_AreNotShadowedByTheCatchAll(string path)
    {
        using HttpClient client = _backend.NewClient();
        using HttpResponseMessage response = await client.GetAsync(path);

        Assert.NotEqual(HttpStatusCode.NotFound, response.StatusCode);
        Assert.DoesNotContain("<html", await response.Content.ReadAsStringAsync(), StringComparison.OrdinalIgnoreCase);
    }

    [Theory]
    [InlineData("/../etc/passwd")]
    [InlineData("/%2e%2e/etc/passwd")]
    [InlineData("/admin/..%2f..%2fetc/passwd")]
    [InlineData("/..%5c..%5cwindows/win.ini")]
    public async Task Traversal_NeverReturnsAFileFromTheHost(string path)
    {
        using HttpClient client = _backend.NewClient();
        using HttpResponseMessage response = await client.GetAsync(path);
        string body = await response.Content.ReadAsStringAsync();

        Assert.DoesNotContain("root:", body, StringComparison.Ordinal);
        Assert.DoesNotContain("[fonts]", body, StringComparison.OrdinalIgnoreCase);
    }

    [Fact]
    public async Task WritesToTheSite_AreRejected()
    {
        using HttpClient client = _backend.NewClient();
        foreach (HttpMethod method in new[] { HttpMethod.Post, HttpMethod.Put, HttpMethod.Delete, HttpMethod.Patch })
        {
            using var request = new HttpRequestMessage(method, "/admin/index.html");
            using HttpResponseMessage response = await client.SendAsync(request);

            Assert.True(response.StatusCode is HttpStatusCode.MethodNotAllowed or HttpStatusCode.NotFound, $"{method}: {response.StatusCode}");
        }
    }

    [Fact]
    public async Task Pages_CarryTheSecurityHeaders_WhenTheFrontendIsEmbedded()
    {
        using HttpClient client = _backend.NewClient();
        using HttpResponseMessage response = await client.GetAsync("/admin/");
        if (response.StatusCode == HttpStatusCode.NotFound)
        {
            return; // 本地没构建前端时不嵌入（CI 的 Backend 测试同样没有）；响应头的逻辑由上面的单元测试和发布构建覆盖
        }

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        Assert.Equal("nosniff", response.Headers.GetValues("X-Content-Type-Options").Single());
        Assert.Equal("DENY", response.Headers.GetValues("X-Frame-Options").Single());
        string csp = response.Headers.GetValues("Content-Security-Policy").Single();
        Assert.Contains("script-src 'self'", csp, StringComparison.Ordinal);
        Assert.Contains("frame-ancestors 'none'", csp, StringComparison.Ordinal);
        Assert.Equal("no-cache", response.Headers.CacheControl!.ToString());

        string etag = response.Headers.ETag!.ToString();
        using var conditional = new HttpRequestMessage(HttpMethod.Get, "/admin/");
        conditional.Headers.TryAddWithoutValidation("If-None-Match", etag);
        using HttpResponseMessage notModified = await client.SendAsync(conditional);
        Assert.Equal(HttpStatusCode.NotModified, notModified.StatusCode);
    }
}