<?php

namespace Tests\Unit\app\Domain\Oidc\Controllers;

use Leantime\Core\Application;
use Leantime\Core\Auth\Permissions\PermissionEnforcer;
use Leantime\Core\Bootstrap\LoadConfig;
use Leantime\Core\Bootstrap\SetRequestForConsole;
use Leantime\Core\Http\IncomingRequest;
use Leantime\Core\Language;
use Leantime\Core\UI\Template;
use Leantime\Domain\Auth\Repositories\AccessTokenRepository;
use Leantime\Domain\Oidc\Controllers\Mobile;
use Leantime\Domain\Oidc\Services\OidcMobileCode;
use Leantime\Domain\Plugins\Services\Plugins;
use Leantime\Domain\Users\Repositories\Users as UserRepository;

/**
 * Unit tests for the mobile SSO exchange endpoint.
 *
 * These pin the security-critical contract: POST-only, PKCE-before-consume
 * (a bad verifier must NOT burn the code), and orphan-token prevention
 * (mint only after user existence is confirmed).
 */
class MobileTest extends \Unit\TestCase
{
    private OidcMobileCode $codes;

    private AccessTokenRepository $tokens;

    private UserRepository $userRepo;

    protected function setUp(): void
    {
        parent::setUp();

        $this->app = new Application(APP_ROOT);
        $this->app->bootstrapWith([LoadConfig::class, SetRequestForConsole::class]);
        $this->app->boot();
        $this->app['view'] = $this->createMock(\Illuminate\View\Factory::class);
        $this->app['session'] = $this->createMock(\Illuminate\Session\SessionManager::class);
        $this->app->instance(PermissionEnforcer::class, $this->createMock(PermissionEnforcer::class));

        $this->codes = $this->createMock(OidcMobileCode::class);
        $this->tokens = $this->createMock(AccessTokenRepository::class);
        $this->userRepo = $this->createMock(UserRepository::class);
        $this->app->instance(OidcMobileCode::class, $this->codes);
        $this->app->instance(AccessTokenRepository::class, $this->tokens);
        $this->app->instance(UserRepository::class, $this->userRepo);

        // Mobile SSO is gated on AdvancedAuth (see Mobile::exchange). Mock the
        // plugin as installed so these exchange-contract tests run past the gate;
        // the gate itself is verified live e2e (AdvancedAuth off -> 404).
        $plugins = $this->createMock(Plugins::class);
        $plugins->method('isEnabled')->willReturn(true);
        $this->app->instance(Plugins::class, $plugins);

        // Back the RateLimiter facade with a fresh in-memory store so throttle
        // state is deterministic and isolated per test.
        \Illuminate\Support\Facades\Facade::setFacadeApplication($this->app);
        $this->app->instance(
            \Illuminate\Cache\RateLimiter::class,
            new \Illuminate\Cache\RateLimiter(
                new \Illuminate\Cache\Repository(new \Illuminate\Cache\ArrayStore)
            )
        );
    }

    private function makeController(string $method = 'POST', array $body = []): Mobile
    {
        // IncomingRequest inherits getMethod() from Symfony's Request, where it
        // reads from the request's internal server bag. Building a real instance
        // is simpler and more accurate than mocking through the inheritance chain.
        // $body populates the POST (request) bag — what the controller reads via
        // ->post(); a query string on the URL is deliberately NOT read.
        $request = IncomingRequest::create('/oidc/mobile/exchange', $method, $body);
        $this->app->instance(IncomingRequest::class, $request);

        return new Mobile($request, $this->createMock(Template::class), $this->createMock(Language::class));
    }

    private function bodyOf($response): array
    {
        return json_decode($response->getContent(), true);
    }

    public function test_get_is_rejected_with_405(): void
    {
        // Peek must never be called — the request is rejected before the code store is touched.
        $this->codes->expects($this->never())->method('peekCode');

        $controller = $this->makeController('GET', ['code' => 'x', 'code_verifier' => 'y']);
        $response = $controller->exchange([]);

        $this->assertSame(405, $response->getStatusCode());
        $this->assertSame('POST', $response->headers->get('Allow'));
        $this->assertSame('method_not_allowed', $this->bodyOf($response)['error']);
    }

    public function test_missing_code_returns_400(): void
    {
        $this->codes->expects($this->never())->method('peekCode');

        $controller = $this->makeController();
        $response = $controller->exchange([]);

        $this->assertSame(400, $response->getStatusCode());
        $this->assertSame('missing_code', $this->bodyOf($response)['error']);
    }

    public function test_unknown_code_returns_401_and_does_not_consume(): void
    {
        $this->codes->method('peekCode')->with('bad')->willReturn(null);
        // Nothing to consume for an unknown code — but assert it explicitly.
        $this->codes->expects($this->never())->method('consumeCode');

        $controller = $this->makeController('POST', ['code' => 'bad', 'code_verifier' => 'v']);
        $response = $controller->exchange([]);

        $this->assertSame(401, $response->getStatusCode());
        $this->assertSame('invalid_code', $this->bodyOf($response)['error']);
    }

    public function test_invalid_verifier_does_not_burn_the_code(): void
    {
        // The core DoS-protection contract: a wrong verifier from a scheme-
        // hijacker must not consume the code, so the legitimate app can still
        // exchange it.
        $this->codes->method('peekCode')->willReturn([
            'userId' => 42,
            'challenge' => 'somechallenge',
        ]);
        $this->codes->expects($this->never())->method('consumeCode');
        $this->tokens->expects($this->never())->method('createToken');

        $controller = $this->makeController('POST', ['code' => 'good', 'code_verifier' => 'wrong-verifier']);
        $response = $controller->exchange([]);

        $this->assertSame(401, $response->getStatusCode());
        $this->assertSame('invalid_verifier', $this->bodyOf($response)['error']);
    }

    public function test_missing_user_returns_401_without_minting(): void
    {
        // PKCE(S256) of the verifier 'testverifier' — used below to pass PKCE.
        $verifier = 'testverifier';
        $challenge = rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');

        $this->codes->method('peekCode')->willReturn(['userId' => 99, 'challenge' => $challenge]);
        $this->userRepo->method('getUser')->with(99)->willReturn([]);
        $this->codes->expects($this->never())->method('consumeCode');
        $this->tokens->expects($this->never())->method('createToken');

        $controller = $this->makeController('POST', ['code' => 'good', 'code_verifier' => $verifier]);
        $response = $controller->exchange([]);

        $this->assertSame(401, $response->getStatusCode());
        $this->assertSame('invalid_user', $this->bodyOf($response)['error']);
    }

    public function test_valid_exchange_consumes_code_and_mints_token(): void
    {
        $verifier = 'testverifier';
        $challenge = rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');

        $this->codes->method('peekCode')->with('good')->willReturn(['userId' => 7, 'challenge' => $challenge]);
        $this->userRepo->method('getUser')->with(7)->willReturn([
            'id' => 7, 'firstname' => 'A', 'lastname' => 'B', 'username' => 'a@b',
            'password' => 'SHOULD_NOT_APPEAR', 'twoFAEnabled' => 1,
        ]);
        // Code consumed exactly once, AFTER all validation; returns true (this
        // caller won the single-use race), so minting proceeds.
        $this->codes->expects($this->once())->method('consumeCode')->with('good')->willReturn(true);
        // Minted with full scope AND an explicit expiry (not non-expiring).
        $this->tokens->expects($this->once())->method('createToken')
            ->with(7, 'mobile-sso', ['*'], $this->isInstanceOf(\DateTimeInterface::class))
            ->willReturn(['token' => 'the-token']);

        $controller = $this->makeController('POST', ['code' => 'good', 'code_verifier' => $verifier]);
        $response = $controller->exchange([]);

        $this->assertSame(200, $response->getStatusCode());
        $body = $this->bodyOf($response);
        $this->assertSame('the-token', $body['token']);
        // Only safe identity fields — never password / 2FA state.
        $this->assertSame(['id', 'firstname', 'lastname', 'username'], array_keys($body['user']));
    }

    public function test_secrets_in_query_string_are_ignored(): void
    {
        // The code + verifier must come from the POST body, never the URL query
        // (URLs land in access logs). A ?code=... is not read, so this is a
        // missing_code — and the code store is never touched.
        $this->codes->expects($this->never())->method('peekCode');

        $request = IncomingRequest::create('/oidc/mobile/exchange?code=fromquery&code_verifier=v', 'POST');
        $this->app->instance(IncomingRequest::class, $request);
        $controller = new Mobile($request, $this->createMock(Template::class), $this->createMock(Language::class));
        $response = $controller->exchange([]);

        $this->assertSame(400, $response->getStatusCode());
        $this->assertSame('missing_code', $this->bodyOf($response)['error']);
    }

    public function test_exchange_is_rate_limited_per_ip(): void
    {
        // Once the per-IP cap is hit, further attempts are refused with 429
        // BEFORE the code store is consulted — throttling code/verifier probing.
        $this->codes->expects($this->never())->method('peekCode');

        for ($i = 0; $i < 10; $i++) {
            \Illuminate\Support\Facades\RateLimiter::hit('oidc.mobile.exchange:127.0.0.1', 60);
        }

        $controller = $this->makeController('POST', ['code' => 'x', 'code_verifier' => 'y']);
        $response = $controller->exchange([]);

        $this->assertSame(429, $response->getStatusCode());
        $this->assertSame('too_many_requests', $this->bodyOf($response)['error']);
        $this->assertNotNull($response->headers->get('Retry-After'));
    }

    public function test_lost_consume_race_does_not_mint(): void
    {
        // Two concurrent exchanges both peek the same valid code; the one whose
        // atomic consumeCode() returns false (the other burned it first) must
        // NOT mint a second token from a single-use code.
        $verifier = 'testverifier';
        $challenge = rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');

        $this->codes->method('peekCode')->willReturn(['userId' => 7, 'challenge' => $challenge]);
        $this->userRepo->method('getUser')->with(7)->willReturn([
            'id' => 7, 'firstname' => 'A', 'lastname' => 'B', 'username' => 'a@b',
        ]);
        $this->codes->method('consumeCode')->with('good')->willReturn(false);
        $this->tokens->expects($this->never())->method('createToken');

        $controller = $this->makeController('POST', ['code' => 'good', 'code_verifier' => $verifier]);
        $response = $controller->exchange([]);

        $this->assertSame(401, $response->getStatusCode());
        $this->assertSame('invalid_code', $this->bodyOf($response)['error']);
    }
}