from __future__ import annotations

import hashlib
import hmac
import json

import pytest
from fastapi.testclient import TestClient

import app.main as main
import app.routes as routes
import app.security as security

WEBHOOK_SECRET = "w" * 64
SYNC_API_KEY = "s" * 64
SEARCH_API_KEY = "a" * 64

EXPECTED_REPOSITORY = "KEMT/zpwiki"


def sign(
    body: bytes,
) -> str:
    return hmac.new(
        WEBHOOK_SECRET.encode("utf-8"),
        body,
        hashlib.sha256,
    ).hexdigest()


@pytest.fixture
def client(
    security_environment,
) -> TestClient:
    with TestClient(main.app) as test_client:
        yield test_client


def test_security_configuration_accepts_valid_configuration(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    monkeypatch.setenv(
        "WEBHOOK_SECRET",
        WEBHOOK_SECRET,
    )

    monkeypatch.setenv(
        "SYNC_API_KEY",
        SYNC_API_KEY,
    )

    monkeypatch.setenv(
        "SEARCH_API_KEY",
        SEARCH_API_KEY,
    )

    monkeypatch.setenv(
        "EXPECTED_GITEA_REPOSITORY",
        EXPECTED_REPOSITORY,
    )

    monkeypatch.setenv(
        "WEBHOOK_PULL_GIT",
        "false",
    )

    security.validate_security_configuration()


def test_security_configuration_rejects_shared_secrets(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    shared = "x" * 64

    monkeypatch.setenv(
        "WEBHOOK_SECRET",
        shared,
    )

    monkeypatch.setenv(
        "SYNC_API_KEY",
        shared,
    )

    monkeypatch.setenv(
        "SEARCH_API_KEY",
        SEARCH_API_KEY,
    )

    monkeypatch.setenv(
        "EXPECTED_GITEA_REPOSITORY",
        EXPECTED_REPOSITORY,
    )

    with pytest.raises(
        RuntimeError,
        match="navzájom rozdielne",
    ):
        security.validate_security_configuration()


@pytest.mark.parametrize(
    "value",
    [
        "zpwiki",
        "/zpwiki",
        "KEMT/",
        "KEMT/zpwiki/extra",
        "KEMT /zpwiki",
        "KEMT/zp wiki",
    ],
)
def test_expected_repository_rejects_invalid_format(
    monkeypatch: pytest.MonkeyPatch,
    value: str,
) -> None:
    monkeypatch.setenv(
        "EXPECTED_GITEA_REPOSITORY",
        value,
    )

    with pytest.raises(
        RuntimeError,
        match="vlastník/repozitár",
    ):
        security.expected_gitea_repository()


@pytest.mark.parametrize(
    (
        "value",
        "expected",
    ),
    [
        ("true", True),
        ("TRUE", True),
        ("1", True),
        ("yes", True),
        ("on", True),
        ("false", False),
        ("FALSE", False),
        ("0", False),
        ("no", False),
        ("off", False),
    ],
)
def test_webhook_pull_git_boolean_values(
    monkeypatch: pytest.MonkeyPatch,
    value: str,
    expected: bool,
) -> None:
    monkeypatch.setenv(
        "WEBHOOK_PULL_GIT",
        value,
    )

    assert security.webhook_should_pull_git() is expected


def test_webhook_pull_git_rejects_invalid_value(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    monkeypatch.setenv(
        "WEBHOOK_PULL_GIT",
        "maybe",
    )

    with pytest.raises(
        RuntimeError,
        match="boolean",
    ):
        security.webhook_should_pull_git()


def test_repository_payload_requires_full_name() -> None:
    payload = {
        "repository": {
            "name": "zpwiki",
        }
    }

    assert security.repository_name_from_payload(payload) is None


def test_repository_payload_accepts_full_name() -> None:
    payload = {
        "repository": {
            "full_name": ("KEMT/zpwiki"),
        }
    }

    assert security.repository_name_from_payload(payload) == "KEMT/zpwiki"


def test_repository_comparison_is_case_insensitive() -> None:
    assert (
        security.same_repository(
            "kemt/ZPWIKI",
            "KEMT/zpwiki",
        )
        is True
    )


def test_gitea_signature_accepts_valid_digest() -> None:
    body = b'{"test":true}'

    signature = sign(body)

    assert (
        security.verify_gitea_signature(
            body,
            signature,
            WEBHOOK_SECRET,
        )
        is True
    )


def test_gitea_signature_accepts_sha256_prefix() -> None:
    body = b'{"test":true}'

    signature = "sha256=" + sign(body)

    assert (
        security.verify_gitea_signature(
            body,
            signature,
            WEBHOOK_SECRET,
        )
        is True
    )


def test_gitea_signature_rejects_modified_body() -> None:
    original = b'{"test":true}'

    modified = b'{"test":false}'

    signature = sign(original)

    assert (
        security.verify_gitea_signature(
            modified,
            signature,
            WEBHOOK_SECRET,
        )
        is False
    )


@pytest.mark.parametrize(
    "signature",
    [
        None,
        "",
        "abc",
        "x" * 64,
        "0" * 63,
        "0" * 65,
    ],
)
def test_gitea_signature_rejects_invalid_signature(
    signature: str | None,
) -> None:
    assert (
        security.verify_gitea_signature(
            b"body",
            signature,
            WEBHOOK_SECRET,
        )
        is False
    )


def test_sync_key_cannot_access_rag(
    client: TestClient,
) -> None:
    response = client.post(
        "/rag",
        headers={
            "X-API-Key": (SYNC_API_KEY),
        },
        json={
            "query": "Ján Holp",
        },
    )

    assert response.status_code == 401


def test_search_key_cannot_access_sync(
    client: TestClient,
) -> None:
    response = client.post(
        "/sync",
        headers={
            "X-API-Key": (SEARCH_API_KEY),
        },
        json={
            "pull_git": False,
        },
    )

    assert response.status_code == 401


def test_sync_key_cannot_be_used_as_rag_bearer(
    client: TestClient,
) -> None:
    response = client.post(
        "/rag",
        headers={
            "Authorization": (f"Bearer {SYNC_API_KEY}"),
        },
        json={
            "query": "Ján Holp",
        },
    )

    assert response.status_code == 401


def test_health_does_not_expose_filesystem_paths(
    client: TestClient,
) -> None:
    response = client.get("/health")

    assert response.status_code == 200

    payload = response.json()

    assert "database_path" not in payload

    assert "zpwiki_root" not in payload

    assert "/home/" not in response.text


def test_swagger_docs_are_disabled(
    client: TestClient,
) -> None:
    assert client.get("/docs").status_code == 404

    assert client.get("/redoc").status_code == 404


def test_openapi_schema_remains_available(
    client: TestClient,
) -> None:
    response = client.get("/openapi.json")

    assert response.status_code == 200

    assert "/rag" in response.json()["paths"]


def test_security_response_headers(
    client: TestClient,
) -> None:
    response = client.get("/health")

    assert response.headers["cache-control"] == "no-store"

    assert response.headers["x-content-type-options"] == "nosniff"

    assert response.headers["referrer-policy"] == "no-referrer"

    assert response.headers["x-frame-options"] == "DENY"


def test_cors_accepts_openwebui_origin(
    client: TestClient,
) -> None:
    response = client.options(
        "/rag",
        headers={
            "Origin": ("https://ui.tukekemt.xyz"),
            "Access-Control-Request-Method": ("POST"),
            "Access-Control-Request-Headers": ("authorization," "content-type," "x-api-key"),
        },
    )

    assert response.status_code == 200

    assert response.headers["access-control-allow-origin"] == ("https://ui.tukekemt.xyz")


def test_cors_rejects_unknown_origin(
    client: TestClient,
) -> None:
    response = client.options(
        "/rag",
        headers={
            "Origin": ("https://evil.example"),
            "Access-Control-Request-Method": ("POST"),
            "Access-Control-Request-Headers": ("authorization"),
        },
    )

    assert response.headers.get("access-control-allow-origin") != "https://evil.example"


def test_webhook_rejects_oversized_payload(
    client: TestClient,
) -> None:
    body = b"x" * (routes.MAX_WEBHOOK_BODY_BYTES + 1)

    response = client.post(
        "/webhook/gitea",
        content=body,
        headers={
            "Content-Type": ("application/json"),
            "X-Gitea-Event": ("push"),
        },
    )

    assert response.status_code == 413


def test_webhook_requires_repository_full_name(
    client: TestClient,
) -> None:
    body = json.dumps(
        {
            "repository": {
                "name": ("zpwiki"),
            }
        }
    ).encode("utf-8")

    response = client.post(
        "/webhook/gitea",
        content=body,
        headers={
            "Content-Type": ("application/json"),
            "X-Gitea-Event": ("push"),
            "X-Gitea-Signature": (sign(body)),
        },
    )

    assert response.status_code == 400