package workerruntime

import (
	"crypto/sha256"
	"errors"
	"net/url"
	"testing"
	"time"
)

func TestSPIFFEIdentityAcceptsOnlyExactWorkloadURI(t *testing.T) {
	tests := []struct {
		name string
		raw  string
		want string
	}{
		{name: "exact worker", raw: "spiffe://proxy.example/prod/worker/worker-a", want: "worker-a"},
		{name: "checker is not worker", raw: "spiffe://proxy.example/prod/checker/checker-a"},
		{name: "query", raw: "spiffe://proxy.example/prod/worker/worker-a?scope=ignored"},
		{name: "user info", raw: "spiffe://worker@proxy.example/prod/worker/worker-a"},
		{name: "port", raw: "spiffe://proxy.example:8443/prod/worker/worker-a"},
		{name: "trailing slash", raw: "spiffe://proxy.example/prod/worker/worker-a/"},
		{name: "escaped path", raw: "spiffe://proxy.example/prod/worker/worker%2Da"},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			uri, err := url.Parse(test.raw)
			if err != nil {
				t.Fatal(err)
			}
			got, ok := SPIFFEIdentity(uri, "proxy.example", "prod", "worker")
			if (test.want != "") != ok || got != test.want {
				t.Fatalf("SPIFFEIdentity() = (%q, %t), want (%q, %t)", got, ok, test.want, test.want != "")
			}
		})
	}
}

func TestSingleSPIFFEIdentityRejectsMultipleURISANs(t *testing.T) {
	worker, err := url.Parse("spiffe://proxy.example/prod/worker/worker-a")
	if err != nil {
		t.Fatal(err)
	}
	checker, err := url.Parse("spiffe://proxy.example/prod/checker/checker-a")
	if err != nil {
		t.Fatal(err)
	}
	if _, ok := SingleSPIFFEIdentity([]*url.URL{worker, checker}, "proxy.example", "prod", "worker"); ok {
		t.Fatal("SingleSPIFFEIdentity() accepted multiple URI SANs")
	}
	if got, ok := SingleSPIFFEIdentity([]*url.URL{worker}, "proxy.example", "prod", "worker"); !ok || got != "worker-a" {
		t.Fatalf("SingleSPIFFEIdentity() = (%q, %t), want (worker-a, true)", got, ok)
	}
}

func TestNormalizeLabelsClonesAndBoundsValues(t *testing.T) {
	source := map[string]string{"region": "cn-north"}
	labels, err := NormalizeLabels(source)
	if err != nil {
		t.Fatalf("NormalizeLabels(): %v", err)
	}
	labels["region"] = "changed"
	if source["region"] != "cn-north" {
		t.Fatal("NormalizeLabels() aliases the source map")
	}
	if !ValidIdentifier("worker-a:1") || ValidIdentifier("worker a") || ValidIdentifier("") {
		t.Fatal("ValidIdentifier() accepted or rejected an invalid value")
	}
	if _, err := NormalizeLabels(map[string]string{" region": "cn"}); !errors.Is(err, ErrInvalidSession) {
		t.Fatalf("NormalizeLabels(invalid key) error = %v", err)
	}
}

func TestNormalizeReportUsesStableCounterOrdering(t *testing.T) {
	now := time.Date(2026, 7, 31, 9, 0, 0, 0, time.FixedZone("UTC+8", 8*60*60))
	base := Report{
		WorkerID: "worker-a", SessionID: "session-a", Sequence: 1, SnapshotVersion: 7, OwnershipEpoch: 3,
		ObservedAt: now, Counters: []Counter{{ProxyID: "proxy-b", Active: 2}, {ProxyID: "proxy-a", Reserved: 1}},
	}
	normalized, digest, err := NormalizeReport(base)
	if err != nil || normalized.ObservedAt.Location() != time.UTC || normalized.Counters[0].ProxyID != "proxy-a" {
		t.Fatalf("NormalizeReport() = %+v, %x, %v", normalized, digest, err)
	}
	base.Counters[0], base.Counters[1] = base.Counters[1], base.Counters[0]
	_, replayDigest, err := NormalizeReport(base)
	if err != nil || digest != replayDigest {
		t.Fatalf("NormalizeReport(reordered) digest = %x, %v; want %x", replayDigest, err, digest)
	}
	if _, _, err := NormalizeReport(Report{}); !errors.Is(err, ErrInvalidReport) {
		t.Fatalf("NormalizeReport(invalid) error = %v", err)
	}
}

func TestNormalizeSnapshotReferenceAndAcknowledgement(t *testing.T) {
	reference := SnapshotReference{
		WorkerID: "worker-a", Version: 7, OwnershipEpoch: 3, Checksum: sha256.Sum256([]byte("snapshot")),
	}
	if _, err := NormalizeSnapshotReference(reference); err != nil {
		t.Fatalf("NormalizeSnapshotReference(): %v", err)
	}
	acknowledgement := SnapshotAcknowledgement{WorkerID: "worker-a", SessionID: "session-a", Reference: reference, ErrorCode: "apply_failed"}
	if _, err := NormalizeAcknowledgement(acknowledgement); err != nil {
		t.Fatalf("NormalizeAcknowledgement(): %v", err)
	}
	acknowledgement.Reference.WorkerID = "worker-b"
	if _, err := NormalizeAcknowledgement(acknowledgement); !errors.Is(err, ErrInvalidAcknowledgement) {
		t.Fatalf("NormalizeAcknowledgement(worker mismatch) error = %v", err)
	}
}