package transport

import (
	"context"
	"errors"
	"fmt"
	"strings"
	"testing"

	proxyDomain "github.com/proxy-pool/proxy-pool/internal/domain/proxy"
	platformCredentials "github.com/proxy-pool/proxy-pool/internal/platform/credentials"
)

func TestCredentialsFormattingRedactsPassword(t *testing.T) {
	t.Parallel()

	value := Credentials{Username: "alice", Password: "secret-password"}
	for _, formatted := range []string{
		fmt.Sprintf("%v", value),
		fmt.Sprintf("%+v", value),
		fmt.Sprintf("%#v", value),
	} {
		if strings.Contains(formatted, value.Username) || strings.Contains(formatted, value.Password) {
			t.Fatalf("formatted Credentials exposes credential material: %s", formatted)
		}
	}
}

func TestStoreCredentialResolverResolvesProxyReference(t *testing.T) {
	t.Parallel()

	store, err := platformCredentials.NewMemoryStore(1)
	if err != nil {
		t.Fatalf("NewMemoryStore() error = %v", err)
	}
	reference, err := store.Put(context.Background(), "provider-a/proxy-a", platformCredentials.Value{
		Username: "alice",
		Password: "secret",
	})
	if err != nil {
		t.Fatalf("Put() error = %v", err)
	}
	resolver, err := NewStoreCredentialResolver(store)
	if err != nil {
		t.Fatalf("NewStoreCredentialResolver() error = %v", err)
	}

	got, err := resolver.Resolve(context.Background(), proxyDomain.Proxy{
		Username:          "alice",
		SecretRef:         reference.SecretRef,
		CredentialVersion: reference.CredentialVersion,
	})
	if err != nil {
		t.Fatalf("Resolve() error = %v", err)
	}
	if got != (Credentials{Username: "alice", Password: "secret"}) {
		t.Fatalf("Resolve() returned unexpected credentials")
	}
}

func TestStoreCredentialResolverRejectsIncompleteOrMismatchedReference(t *testing.T) {
	t.Parallel()

	store, err := platformCredentials.NewMemoryStore(1)
	if err != nil {
		t.Fatalf("NewMemoryStore() error = %v", err)
	}
	reference, err := store.Put(context.Background(), "provider-a/proxy-a", platformCredentials.Value{
		Username: "alice",
		Password: "secret",
	})
	if err != nil {
		t.Fatalf("Put() error = %v", err)
	}
	resolver, err := NewStoreCredentialResolver(store)
	if err != nil {
		t.Fatalf("NewStoreCredentialResolver() error = %v", err)
	}

	for name, selected := range map[string]proxyDomain.Proxy{
		"missing version": {SecretRef: reference.SecretRef},
		"missing ref":     {CredentialVersion: reference.CredentialVersion},
	} {
		if _, err := resolver.Resolve(context.Background(), selected); !errors.Is(err, ErrIncompleteCredentialReference) {
			t.Fatalf("%s Resolve() error = %v, want ErrIncompleteCredentialReference", name, err)
		}
	}
	if _, err := resolver.Resolve(context.Background(), proxyDomain.Proxy{
		Username:          "bob",
		SecretRef:         reference.SecretRef,
		CredentialVersion: reference.CredentialVersion,
	}); !errors.Is(err, ErrCredentialUsernameMismatch) {
		t.Fatalf("mismatched Resolve() error = %v, want ErrCredentialUsernameMismatch", err)
	}
}

func TestStoreCredentialResolverAllowsCredentiallessProxy(t *testing.T) {
	t.Parallel()

	store, err := platformCredentials.NewMemoryStore(1)
	if err != nil {
		t.Fatalf("NewMemoryStore() error = %v", err)
	}
	resolver, err := NewStoreCredentialResolver(store)
	if err != nil {
		t.Fatalf("NewStoreCredentialResolver() error = %v", err)
	}
	got, err := resolver.Resolve(context.Background(), proxyDomain.Proxy{})
	if err != nil || got != (Credentials{}) {
		t.Fatalf("Resolve(credentialless) = (%+v, %v), want zero credentials", got, err)
	}
}