//! Black-box tests for the theme and language preferences: the appearance settings page, the
//! `data-theme` attribute on `<html>`, and the anonymous footer cookie. Like the other e2e
//! tests, this starts the real `forge` binary and drives it over HTTP. Cookies are set by hand
//! because the session cookie is `__Host-` and `Secure`.

mod common;
use common::{BIN, Server, describe, launch, pick_ports, write_config};
use std::path::Path;
use std::process::Command;
use std::time::Duration;

use reqwest::header::{COOKIE, HeaderMap, HeaderName, SET_COOKIE};

const PW: &str = "alice-password-123";

struct Resp {
    status: u16,
    headers: HeaderMap,
    body: String,
}

impl Resp {
    fn header(&self, name: HeaderName) -> Option<String> {
        self.headers
            .get(name)
            .and_then(|v| v.to_str().ok())
            .map(str::to_owned)
    }

    fn set_cookies(&self) -> Vec<String> {
        self.headers
            .get_all(SET_COOKIE)
            .iter()
            .filter_map(|v| v.to_str().ok().map(str::to_owned))
            .collect()
    }
}

struct Http {
    client: reqwest::Client,
    base: String,
}

impl Http {
    fn new(port: u16) -> Self {
        let client = reqwest::Client::builder()
            .redirect(reqwest::redirect::Policy::none())
            .timeout(Duration::from_secs(60))
            .build()
            .expect("http client");
        Self {
            client,
            base: format!("http://127.0.0.1:{port}"),
        }
    }

    async fn get(&self, path: &str, cookie: Option<&str>) -> Resp {
        self.send(self.client.get(format!("{}{path}", self.base)), cookie)
            .await
    }

    async fn post_form(&self, path: &str, form: &[(&str, &str)], cookie: Option<&str>) -> Resp {
        self.send(
            self.client.post(format!("{}{path}", self.base)).form(form),
            cookie,
        )
        .await
    }

    async fn send(&self, req: reqwest::RequestBuilder, cookie: Option<&str>) -> Resp {
        let req = match cookie {
            Some(cookie) => req.header(COOKIE, cookie),
            None => req,
        };
        let res = req.send().await.expect("http request");
        let status = res.status().as_u16();
        let headers = res.headers().clone();
        let body = res.text().await.expect("read body");
        Resp {
            status,
            headers,
            body,
        }
    }
}

/// `name=value` for the cookie whose name ends with `suffix`, ignoring cleared cookies.
fn cookie_named(resp: &Resp, suffix: &str) -> Option<String> {
    resp.set_cookies().iter().find_map(|set| {
        let pair = set.split(';').next()?;
        let (name, value) = pair.split_once('=')?;
        (name.ends_with(suffix) && !value.is_empty()).then(|| format!("{name}={value}"))
    })
}

/// The value of the first `<input name="...">` on a page.
fn input_value(body: &str, name: &str) -> String {
    let doc = scraper::Html::parse_document(body);
    let selector = scraper::Selector::parse(&format!("input[name=\"{name}\"]")).expect("selector");
    doc.select(&selector)
        .next()
        .and_then(|el| el.value().attr("value"))
        .unwrap_or_else(|| panic!("no input named {name} on page"))
        .to_owned()
}

/// The `data-theme` attribute of `<html>`, if the page sets one.
fn html_theme(body: &str) -> Option<String> {
    let doc = scraper::Html::parse_document(body);
    doc.root_element().attr("data-theme").map(str::to_owned)
}

/// The option value that is selected in the `<select name="...">` on a page.
fn selected_option(body: &str, select: &str) -> Option<String> {
    let doc = scraper::Html::parse_document(body);
    let selector = scraper::Selector::parse(&format!("select[name=\"{select}\"] option[selected]"))
        .expect("selector");
    doc.select(&selector)
        .next()
        .and_then(|el| el.value().attr("value"))
        .map(str::to_owned)
}

/// The top-bar theme button: the value it posts and its accessible label.
fn theme_button(body: &str) -> (String, String) {
    let doc = scraper::Html::parse_document(body);
    let form = scraper::Selector::parse("form.theme-form").expect("selector");
    let form = doc
        .select(&form)
        .next()
        .unwrap_or_else(|| panic!("no theme button on page"));
    let value = scraper::Selector::parse("input[name=\"theme\"]").expect("selector");
    let value = form
        .select(&value)
        .next()
        .and_then(|el| el.value().attr("value"))
        .expect("theme value")
        .to_owned();
    let button = scraper::Selector::parse("button").expect("selector");
    let label = form
        .select(&button)
        .next()
        .and_then(|el| el.value().attr("aria-label"))
        .expect("aria-label")
        .to_owned();
    (value, label)
}

/// Runs an admin subcommand with the password in FORGE_PASSWORD and asserts it succeeded.
fn admin(config: &Path, args: &[&str]) {
    let out = Command::new(BIN)
        .arg("--config")
        .arg(config)
        .arg("admin")
        .args(args)
        .env("FORGE_PASSWORD", PW)
        .output()
        .expect("run admin command");
    assert!(
        out.status.success(),
        "admin {args:?} failed:\n{}",
        describe(&out)
    );
}

async fn login(http: &Http, username: &str) -> String {
    let page = http.get("/login", None).await;
    assert_eq!(page.status, 200, "GET /login");
    let precsrf_cookie = cookie_named(&page, "forge_precsrf").expect("precsrf cookie");
    let precsrf = input_value(&page.body, "precsrf");
    let res = http
        .post_form(
            "/login",
            &[
                ("username", username),
                ("password", PW),
                ("next", "/"),
                ("precsrf", &precsrf),
            ],
            Some(&precsrf_cookie),
        )
        .await;
    assert_eq!(res.status, 303, "login as {username}: {}", res.body);
    cookie_named(&res, "forge_session").expect("session cookie after login")
}

/// A running server with user `alice`. The temp dir lives as long as the test.
struct Env {
    _root: tempfile::TempDir,
    _server: Server,
    http: Http,
}

async fn start() -> Env {
    let root = tempfile::tempdir().expect("temp dir");
    let dir = root.path().to_path_buf();
    let ports = pick_ports();
    let config = write_config(&dir, ports);
    admin(&config, &["create-user", "alice"]);
    let (server, ports) = launch(&dir, ports).await;
    let http = Http::new(ports.http);
    Env {
        _root: root,
        _server: server,
        http,
    }
}

#[tokio::test]
async fn appearance_setting_persists_and_renders_the_html_attribute() {
    let env = start().await;
    let session = login(&env.http, "alice").await;

    let page = env.http.get("/settings/appearance", Some(&session)).await;
    assert_eq!(page.status, 200);
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("light")
    );
    assert_eq!(
        html_theme(&page.body).as_deref(),
        Some("light"),
        "the default is light, which renders data-theme=light"
    );
    let csrf = input_value(&page.body, "csrf");

    let saved = env
        .http
        .post_form(
            "/settings/appearance",
            &[("csrf", &csrf), ("theme", "dark"), ("language", "tr")],
            Some(&session),
        )
        .await;
    assert_eq!(saved.status, 303, "save: {}", saved.body);
    assert_eq!(
        saved.header(reqwest::header::LOCATION).as_deref(),
        Some("/settings/appearance?saved=1")
    );

    let page = env
        .http
        .get("/settings/appearance?saved=1", Some(&session))
        .await;
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("dark")
    );
    assert_eq!(
        selected_option(&page.body, "language").as_deref(),
        Some("tr")
    );

    let home = env.http.get("/settings/appearance", Some(&session)).await;
    assert_eq!(html_theme(&home.body).as_deref(), Some("dark"));

    let page = env.http.get("/settings/appearance", Some(&session)).await;
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("dark")
    );
    assert_eq!(
        selected_option(&page.body, "language").as_deref(),
        Some("tr")
    );
}

#[tokio::test]
async fn appearance_save_without_a_valid_csrf_token_is_403() {
    let env = start().await;
    let session = login(&env.http, "alice").await;
    let res = env
        .http
        .post_form(
            "/settings/appearance",
            &[("csrf", "forged"), ("theme", "dark"), ("language", "en")],
            Some(&session),
        )
        .await;
    assert_eq!(res.status, 403);
    let page = env.http.get("/settings/appearance", Some(&session)).await;
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("light"),
        "nothing saved"
    );
}

#[tokio::test]
async fn unoffered_theme_or_language_is_rejected_and_nothing_is_saved() {
    let env = start().await;
    let session = login(&env.http, "alice").await;
    let page = env.http.get("/settings/appearance", Some(&session)).await;
    let csrf = input_value(&page.body, "csrf");
    for form in [
        [
            ("csrf", csrf.as_str()),
            ("theme", "neon"),
            ("language", "en"),
        ],
        [
            ("csrf", csrf.as_str()),
            ("theme", "light"),
            ("language", "de"),
        ],
    ] {
        let res = env
            .http
            .post_form("/settings/appearance", &form, Some(&session))
            .await;
        assert_ne!(res.status, 303, "bad choice must not redirect as saved");
    }
    let page = env.http.get("/settings/appearance", Some(&session)).await;
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("light")
    );
    assert_eq!(
        selected_option(&page.body, "language").as_deref(),
        Some("auto")
    );
}

#[tokio::test]
async fn anonymous_footer_cookie_sets_the_theme() {
    let env = start().await;
    let page = env.http.get("/login", None).await;
    assert_eq!(
        html_theme(&page.body).as_deref(),
        Some("light"),
        "no cookie defaults to light"
    );
    assert!(
        page.body.contains("action=\"/-/theme\""),
        "anonymous footer offers the theme form"
    );

    let set = env
        .http
        .post_form("/-/theme", &[("theme", "light")], None)
        .await;
    assert_eq!(set.status, 303, "set theme: {}", set.body);
    let cookie = cookie_named(&set, "forge_theme").expect("forge_theme cookie");
    assert_eq!(cookie, "forge_theme=light");

    let page = env.http.get("/login", Some(&cookie)).await;
    assert_eq!(html_theme(&page.body).as_deref(), Some("light"));
}

#[tokio::test]
async fn anonymous_theme_cookie_ignores_unknown_values() {
    let env = start().await;
    let res = env
        .http
        .post_form("/-/theme", &[("theme", "neon")], None)
        .await;
    assert_ne!(res.status, 303);
    assert!(cookie_named(&res, "forge_theme").is_none());
}

#[tokio::test]
async fn signed_in_preference_wins_over_the_anonymous_cookie() {
    let env = start().await;
    let session = login(&env.http, "alice").await;
    let page = env.http.get("/settings/appearance", Some(&session)).await;
    assert!(
        !page.body.contains("class=\"theme-picker\""),
        "signed-in viewers get no footer theme form"
    );
    let cookie = format!("{session}; forge_theme=dark");
    let page = env.http.get("/settings/appearance", Some(&cookie)).await;
    assert_eq!(
        html_theme(&page.body).as_deref(),
        Some("light"),
        "a light user ignores the cookie"
    );
}

#[tokio::test]
async fn appearance_page_needs_a_session() {
    let env = start().await;
    let res = env.http.get("/settings/appearance", None).await;
    assert_eq!(res.status, 303);
    assert!(
        res.header(reqwest::header::LOCATION)
            .is_some_and(|l| l.starts_with("/login"))
    );
}

#[tokio::test]
async fn signed_in_toggle_saves_the_preference_and_returns_to_back() {
    let env = start().await;
    let session = login(&env.http, "alice").await;
    let page = env.http.get("/settings/appearance", Some(&session)).await;
    let csrf = input_value(&page.body, "csrf");
    let saved = env
        .http
        .post_form(
            "/settings/appearance",
            &[("csrf", &csrf), ("theme", "auto"), ("language", "tr")],
            Some(&session),
        )
        .await;
    assert_eq!(saved.status, 303, "save: {}", saved.body);

    let toggle = env
        .http
        .post_form(
            "/-/theme",
            &[
                ("csrf", &csrf),
                ("theme", "dark"),
                ("back", "/explore?q=rust"),
            ],
            Some(&session),
        )
        .await;
    assert_eq!(toggle.status, 303, "toggle: {}", toggle.body);
    assert_eq!(
        toggle.header(reqwest::header::LOCATION).as_deref(),
        Some("/explore?q=rust")
    );
    assert!(
        cookie_named(&toggle, "forge_theme").is_none(),
        "no cookie for a signed-in user"
    );

    let page = env.http.get("/settings/appearance", Some(&session)).await;
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("dark")
    );
    assert_eq!(
        selected_option(&page.body, "language").as_deref(),
        Some("tr"),
        "language is kept"
    );
}

#[tokio::test]
async fn theme_toggle_with_an_unsafe_back_returns_to_the_root() {
    let env = start().await;
    let session = login(&env.http, "alice").await;
    let page = env.http.get("/settings/appearance", Some(&session)).await;
    let csrf = input_value(&page.body, "csrf");
    for back in ["//evil.com", "https://evil.com", "/\\evil"] {
        let res = env
            .http
            .post_form(
                "/-/theme",
                &[("csrf", &csrf), ("theme", "light"), ("back", back)],
                Some(&session),
            )
            .await;
        assert_eq!(res.status, 303, "{back}: {}", res.body);
        assert_eq!(
            res.header(reqwest::header::LOCATION).as_deref(),
            Some("/"),
            "back {back:?}"
        );
    }
}

#[tokio::test]
async fn signed_in_theme_toggle_without_a_valid_csrf_is_refused() {
    let env = start().await;
    let session = login(&env.http, "alice").await;
    for form in [
        vec![("csrf", "forged"), ("theme", "dark")],
        vec![("theme", "dark")],
    ] {
        let res = env.http.post_form("/-/theme", &form, Some(&session)).await;
        assert_eq!(res.status, 403, "{form:?}: {}", res.body);
    }
    let page = env.http.get("/settings/appearance", Some(&session)).await;
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("light"),
        "nothing saved"
    );
}

#[tokio::test]
async fn anonymous_theme_toggle_sets_the_cookie_and_returns_to_back() {
    let env = start().await;
    let set = env
        .http
        .post_form("/-/theme", &[("theme", "dark"), ("back", "/login")], None)
        .await;
    assert_eq!(set.status, 303, "set theme: {}", set.body);
    assert_eq!(
        set.header(reqwest::header::LOCATION).as_deref(),
        Some("/login")
    );
    let cookie = cookie_named(&set, "forge_theme").expect("forge_theme cookie");
    assert_eq!(cookie, "forge_theme=dark");
}

#[tokio::test]
async fn theme_button_cycles_light_dark_auto_light_for_signed_in_users() {
    let env = start().await;
    let session = login(&env.http, "alice").await;
    let back = "/settings/appearance";

    // A new user starts on light, the default, so the button offers dark next.
    let page = env.http.get(back, Some(&session)).await;
    let csrf = input_value(&page.body, "csrf");
    assert_eq!(html_theme(&page.body).as_deref(), Some("light"));
    assert_eq!(
        theme_button(&page.body),
        ("dark".into(), "Theme: Light. Switch to Dark".into())
    );

    let step = env
        .http
        .post_form(
            "/-/theme",
            &[("csrf", &csrf), ("theme", "dark"), ("back", back)],
            Some(&session),
        )
        .await;
    assert_eq!(step.status, 303, "light to dark: {}", step.body);
    let page = env.http.get(back, Some(&session)).await;
    assert_eq!(html_theme(&page.body).as_deref(), Some("dark"));
    assert_eq!(
        theme_button(&page.body),
        (
            "auto".into(),
            "Theme: Dark. Switch to match the system".into()
        )
    );

    let step = env
        .http
        .post_form(
            "/-/theme",
            &[("csrf", &csrf), ("theme", "auto"), ("back", back)],
            Some(&session),
        )
        .await;
    assert_eq!(step.status, 303, "dark to auto: {}", step.body);
    let page = env.http.get(back, Some(&session)).await;
    assert_eq!(
        selected_option(&page.body, "theme").as_deref(),
        Some("auto"),
        "signed-in toggle to auto stores 'auto'"
    );
    assert_eq!(html_theme(&page.body), None, "auto renders no data-theme");
    assert_eq!(
        theme_button(&page.body),
        (
            "light".into(),
            "Theme: Match the system. Switch to Light".into()
        )
    );

    let step = env
        .http
        .post_form(
            "/-/theme",
            &[("csrf", &csrf), ("theme", "light"), ("back", back)],
            Some(&session),
        )
        .await;
    assert_eq!(step.status, 303, "auto to light: {}", step.body);
    let page = env.http.get(back, Some(&session)).await;
    assert_eq!(html_theme(&page.body).as_deref(), Some("light"));
}

#[tokio::test]
async fn theme_button_cycles_for_anonymous_visitors_through_the_cookie() {
    let env = start().await;
    // No cookie is the default, light, so the button offers dark next.
    let page = env.http.get("/login", None).await;
    assert_eq!(
        theme_button(&page.body),
        ("dark".into(), "Theme: Light. Switch to Dark".into())
    );

    let page = env.http.get("/login", Some("forge_theme=light")).await;
    assert_eq!(
        theme_button(&page.body),
        ("dark".into(), "Theme: Light. Switch to Dark".into())
    );
    assert_eq!(html_theme(&page.body).as_deref(), Some("light"));

    let page = env.http.get("/login", Some("forge_theme=dark")).await;
    assert_eq!(
        theme_button(&page.body),
        (
            "auto".into(),
            "Theme: Dark. Switch to match the system".into()
        )
    );
}