// Vikunja is a to-do list application to facilitate your life.
// Copyright 2018-present Vikunja and contributors. All rights reserved.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <https://www.gnu.org/licenses/>.

package webtests

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"net/url"
	"strconv"
	"strings"
	"testing"

	"code.vikunja.io/api/pkg/config"
	"code.vikunja.io/api/pkg/db"
	"code.vikunja.io/api/pkg/user"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// teamNamesFromListBody parses the v2 Paginated envelope and returns the names
// of the teams it contains, so tests can assert the EXACT result set rather
// than merely contains/not-contains. Mirrors v1's reflect-based length checks
// in pkg/models/teams_test.go but at the HTTP layer.
func teamNamesFromListBody(t *testing.T, body string) []string {
	t.Helper()
	var env struct {
		Items []struct {
			Name string `json:"name"`
		} `json:"items"`
	}
	require.NoError(t, json.Unmarshal([]byte(body), &env))
	names := make([]string, 0, len(env.Items))
	for _, it := range env.Items {
		names = append(names, it.Name)
	}
	return names
}

// TestHumaTeam mirrors v1's model TestTeam shape so v2 contract parity is
// readable side-by-side. Named TestHumaTeam to avoid clashing with the v1
// model test (pkg/models/teams_test.go TestTeam).
//
// This is a 1:1 port of the v1 model coverage (Team has no v1 webtest):
//   - pkg/models/teams_test.go: TestTeam_Create / ReadOne / ReadAll / Update /
//     Delete
//   - pkg/models/teams_permissions_test.go: TestTeam_CanDoSomething (the
//     owner/member/non-member permission matrix)
//
// Mapped to v2 HTTP semantics: 201 create, 204 delete, 403 forbidden, 404
// not-found, 422 validation. v2-only assertions (status codes, ETag) are kept
// on top of the v1 behaviours.
//
// Fixture facts (pkg/db/fixtures/team_members.yml, teams.yml): user1 is an
// ADMIN of team 1 and a non-admin member of teams 2-8. user2 is a non-admin
// member of team 1. Membership rows for teams 5/6/7 reference teams that don't
// exist in teams.yml, so they're dropped by the INNER JOIN — user1's effective
// teams are 1, 2, 3, 4 and 8 (exactly 5, matching v1's ReadAll count). Team 9
// (created by user 7) lists only user 2, so user1 is not a member. testteam13
// and testteam15 are public and list only user 10.
func TestHumaTeam(t *testing.T) {
	// Each subtest gets a fresh handler (and therefore a fresh setupTestEnv with
	// freshly loaded fixtures), mirroring v1's per-subtest db.LoadAndAssertFixtures.
	// Sharing one handler across subtests is unsafe here: setupTestEnv reruns
	// config.InitDefaultConfig, which rotates the random JWT secret, so a reused
	// echo.Echo would reject tokens signed after a sibling subtest reset the env.
	handlerFor := func(u *user.User) *webHandlerTestV2 {
		return &webHandlerTestV2{user: u, basePath: "/api/v2/teams", idParam: "team", t: t}
	}

	t.Run("ReadAll", func(t *testing.T) {
		t.Run("Normal", func(t *testing.T) {
			testHandler := handlerFor(&testuser1)
			rec, err := testHandler.testReadAllWithUser(nil, nil)
			require.NoError(t, err)
			// User 1 is a member of teams 1-8.
			assert.Contains(t, rec.Body.String(), `testteam1`)
			// User 1 is not a member of team 9 (only user 2 is).
			assert.NotContains(t, rec.Body.String(), `testteam9`)
		})
		// Exact cardinality: v1's TestTeam_ReadAll/normal asserts len == 5.
		// Run against a pristine env so create/delete subtests can't perturb it.
		t.Run("Exact result set", func(t *testing.T) {
			h := handlerFor(&testuser1)
			rec, err := h.testReadAllWithUser(nil, nil)
			require.NoError(t, err)
			names := teamNamesFromListBody(t, rec.Body.String())
			assert.ElementsMatch(t, []string{
				"testteam1",
				"testteam2_read_only_on_project6",
				"testteam3_write_on_project7",
				"testteam4_admin_on_project8",
				"testteam8",
			}, names, "user1's teams are exactly 1,2,3,4,8 (5 total)")
		})
		// v1's TestTeam_ReadAll/search: q matches exactly one team (id 2).
		t.Run("Search", func(t *testing.T) {
			h := handlerFor(&testuser1)
			rec, err := h.testReadAllWithUser(url.Values{"q": []string{"READ_only_on_project6"}}, nil)
			require.NoError(t, err)
			names := teamNamesFromListBody(t, rec.Body.String())
			assert.Equal(t, []string{"testteam2_read_only_on_project6"}, names)
		})
		// testteam13 and testteam15 are public (teams.yml) and user1 is not a
		// member of either (team_members.yml only lists user 10 there).
		// v1's TestTeam_ReadAll/"public discovery disabled": with the instance
		// gate off, include_public is a no-op and the count stays 5.
		t.Run("Include public, but public teams disabled", func(t *testing.T) {
			// The config gate is off by default: include_public must be a no-op
			// so public teams the user is not a member of stay hidden.
			require.False(t, config.ServiceEnablePublicTeams.GetBool())

			h := handlerFor(&testuser1)

			// Without include_public.
			rec, err := h.testReadAllWithUser(nil, nil)
			require.NoError(t, err)
			assert.Len(t, teamNamesFromListBody(t, rec.Body.String()), 5)

			// With include_public the result is unchanged while the gate is off.
			rec, err = h.testReadAllWithUser(url.Values{"include_public": []string{"true"}}, nil)
			require.NoError(t, err)
			names := teamNamesFromListBody(t, rec.Body.String())
			assert.Len(t, names, 5)
			assert.Contains(t, names, "testteam1")
			assert.NotContains(t, names, "testteam13")
			assert.NotContains(t, names, "testteam15")
		})
		// v1's TestTeam_ReadAll/"public discovery enabled": with the gate on,
		// include_public surfaces the two public teams (count 5 -> 7).
		t.Run("Include public when public teams enabled", func(t *testing.T) {
			prev := config.ServiceEnablePublicTeams.GetBool()
			config.ServiceEnablePublicTeams.Set(true)
			defer config.ServiceEnablePublicTeams.Set(prev)

			h := handlerFor(&testuser1)

			// Without include_public the public teams stay hidden even with the
			// instance setting on; the count is still exactly 5.
			rec, err := h.testReadAllWithUser(nil, nil)
			require.NoError(t, err)
			names := teamNamesFromListBody(t, rec.Body.String())
			assert.Len(t, names, 5)
			assert.Contains(t, names, "testteam1")
			assert.NotContains(t, names, "testteam13")
			assert.NotContains(t, names, "testteam15")

			// With include_public=true the public teams the user is not a member
			// of are surfaced: 5 own teams + the 2 public teams = 7.
			rec, err = h.testReadAllWithUser(url.Values{"include_public": []string{"true"}}, nil)
			require.NoError(t, err)
			names = teamNamesFromListBody(t, rec.Body.String())
			assert.Len(t, names, 7)
			assert.Contains(t, names, "testteam1")
			assert.Contains(t, names, "testteam13")
			assert.Contains(t, names, "testteam15")
		})
	})

	t.Run("ReadOne", func(t *testing.T) {
		t.Run("Normal", func(t *testing.T) {
			testHandler := handlerFor(&testuser1)
			rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"team": "1"})
			require.NoError(t, err)
			assert.Contains(t, rec.Body.String(), `"name":"testteam1"`)
			// v1's TestTeam_ReadOne also asserts the description and created_by.
			assert.Contains(t, rec.Body.String(), `"description":"Lorem Ipsum"`)
			assert.Contains(t, rec.Body.String(), `"created_by"`)
			assert.NotEmpty(t, rec.Result().Header.Get("ETag"))
		})
		// v1's TestTeam_ReadOne/{invalid id, nonexisting} expects
		// ErrTeamDoesNotExist. At the HTTP layer CanRead refuses non-members
		// before existence is checked, so a missing team returns 403, not 404.
		t.Run("Nonexisting", func(t *testing.T) {
			testHandler := handlerFor(&testuser1)
			_, err := testHandler.testReadOneWithUser(nil, map[string]string{"team": "9999"})
			require.Error(t, err)
			assert.Equal(t, http.StatusForbidden, getHTTPErrorCode(err))
		})
		t.Run("Permissions check", func(t *testing.T) {
			// Permission matrix from TestTeam_CanDoSomething: a non-member is
			// forbidden (CanRead == false).
			t.Run("Forbidden non-member", func(t *testing.T) {
				// Team 9: user1 is not a member.
				testHandler := handlerFor(&testuser1)
				_, err := testHandler.testReadOneWithUser(nil, map[string]string{"team": "9"})
				require.Error(t, err)
				assert.Equal(t, http.StatusForbidden, getHTTPErrorCode(err))
			})
			// CanRead is granted to ANY member, admin or not (Team.CanRead only
			// checks team membership). user2 is a non-admin member of team 1, so
			// the read must succeed even though update/delete below are denied.
			t.Run("Member but not admin can read", func(t *testing.T) {
				h := handlerFor(&testuser2)
				rec, err := h.testReadOneWithUser(nil, map[string]string{"team": "1"})
				require.NoError(t, err)
				assert.Contains(t, rec.Body.String(), `"name":"testteam1"`)
			})
		})
	})

	t.Run("Create", func(t *testing.T) {
		// v1's TestTeam_Create/normal: creates a team and AssertExists with
		// is_public=false. Use a pristine env so we can read back + DB-assert.
		t.Run("Normal", func(t *testing.T) {
			h := handlerFor(&testuser1)
			rec, err := h.testCreateWithUser(nil, nil, `{"name":"Lorem","description":"Ipsum"}`)
			require.NoError(t, err)
			assert.Equal(t, http.StatusCreated, rec.Code)
			assert.Contains(t, rec.Body.String(), `"name":"Lorem"`)
			assert.Contains(t, rec.Body.String(), `"description":"Ipsum"`)
			// A freshly created team is private by default.
			assert.Contains(t, rec.Body.String(), `"is_public":false`)

			var created struct {
				ID int64 `json:"id"`
			}
			require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &created))
			require.NotZero(t, created.ID)
			// DB persistence: mirrors v1's db.AssertExists.
			db.AssertExists(t, "teams", map[string]interface{}{
				"id":          created.ID,
				"name":        "Lorem",
				"description": "Ipsum",
				"is_public":   false,
			}, false)
		})
		// v1's TestTeam_Create/public: is_public=true must persist and read back.
		t.Run("Public", func(t *testing.T) {
			h := handlerFor(&testuser1)
			rec, err := h.testCreateWithUser(nil, nil, `{"name":"LoremPublic","description":"Ipsum","is_public":true}`)
			require.NoError(t, err)
			assert.Equal(t, http.StatusCreated, rec.Code)
			assert.Contains(t, rec.Body.String(), `"is_public":true`)

			var created struct {
				ID int64 `json:"id"`
			}
			require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &created))
			require.NotZero(t, created.ID)
			db.AssertExists(t, "teams", map[string]interface{}{
				"id":        created.ID,
				"name":      "LoremPublic",
				"is_public": true,
			}, false)

			// Read it back through the API to prove the flag is served, too.
			rec, err = h.testReadOneWithUser(nil, map[string]string{"team": strconv.FormatInt(created.ID, 10)})
			require.NoError(t, err)
			assert.Contains(t, rec.Body.String(), `"is_public":true`)
		})
		// v1's TestTeam_Create/"empty name" -> ErrTeamNameCannotBeEmpty. Name has
		// minLength:1, so Huma rejects an empty name with 422 before the model is
		// touched.
		t.Run("Empty name", func(t *testing.T) {
			testHandler := handlerFor(&testuser1)
			_, err := testHandler.testCreateWithUser(nil, nil, `{"name":""}`)
			require.Error(t, err)
			assert.Equal(t, http.StatusUnprocessableEntity, getHTTPErrorCode(err))
		})
	})

	t.Run("Update", func(t *testing.T) {
		// v1's TestTeam_Update/normal: rename, then AssertExists. Use a pristine
		// env so we can DB-assert without other subtests interfering.
		t.Run("Normal", func(t *testing.T) {
			h := handlerFor(&testuser1)
			// Team 1: user1 is admin.
			rec, err := h.testUpdateWithUser(nil, map[string]string{"team": "1"}, `{"name":"SomethingNew"}`)
			require.NoError(t, err)
			assert.Contains(t, rec.Body.String(), `"name":"SomethingNew"`)
			// DB persistence: mirrors v1's db.AssertExists after Update.
			db.AssertExists(t, "teams", map[string]interface{}{
				"id":   1,
				"name": "SomethingNew",
			}, false)
		})
		// v1's TestTeam_Update/"empty name" -> ErrTeamNameCannotBeEmpty, this time
		// on an UPDATE (PUT) to an existing team the user can admin. Huma's
		// minLength:1 on the body rejects it with 422.
		t.Run("Empty name", func(t *testing.T) {
			h := handlerFor(&testuser1)
			_, err := h.testUpdateWithUser(nil, map[string]string{"team": "1"}, `{"name":""}`)
			require.Error(t, err)
			assert.Equal(t, http.StatusUnprocessableEntity, getHTTPErrorCode(err))
		})
		// v1's TestTeam_Update/nonexisting -> ErrTeamDoesNotExist.
		// CanUpdate -> IsAdmin -> GetTeamByID surfaces it as 404.
		t.Run("Nonexisting", func(t *testing.T) {
			testHandler := handlerFor(&testuser1)
			_, err := testHandler.testUpdateWithUser(nil, map[string]string{"team": "9999"}, `{"name":"TestLoremIpsum"}`)
			require.Error(t, err)
			assert.Equal(t, http.StatusNotFound, getHTTPErrorCode(err))
		})
		t.Run("Permissions check", func(t *testing.T) {
			// Permission matrix: a member who is not admin cannot update
			// (CanUpdate == false).
			t.Run("Forbidden non-admin", func(t *testing.T) {
				// Team 2: user1 is a member but not an admin.
				testHandler := handlerFor(&testuser1)
				_, err := testHandler.testUpdateWithUser(nil, map[string]string{"team": "2"}, `{"name":"TestLoremIpsum"}`)
				require.Error(t, err)
				assert.Equal(t, http.StatusForbidden, getHTTPErrorCode(err))
			})
			// A non-member is likewise forbidden (team 9, user1 not a member).
			t.Run("Forbidden non-member", func(t *testing.T) {
				testHandler := handlerFor(&testuser1)
				_, err := testHandler.testUpdateWithUser(nil, map[string]string{"team": "9"}, `{"name":"TestLoremIpsum"}`)
				require.Error(t, err)
				assert.Equal(t, http.StatusForbidden, getHTTPErrorCode(err))
			})
		})
	})

	t.Run("Delete", func(t *testing.T) {
		// v1's TestTeam_Delete/normal: delete, then AssertMissing. Use a pristine
		// env so the DB-missing assertion is unambiguous.
		t.Run("Normal", func(t *testing.T) {
			h := handlerFor(&testuser1)
			// Team 1: user1 is admin.
			rec, err := h.testDeleteWithUser(nil, map[string]string{"team": "1"})
			require.NoError(t, err)
			// v2 delete is 204 No Content; v1 returned 200 + a message body.
			assert.Equal(t, http.StatusNoContent, rec.Code)
			assert.Empty(t, rec.Body.String())
			// DB persistence: mirrors v1's db.AssertMissing after Delete.
			db.AssertMissing(t, "teams", map[string]interface{}{"id": 1})
		})
		t.Run("Nonexisting", func(t *testing.T) {
			testHandler := handlerFor(&testuser1)
			_, err := testHandler.testDeleteWithUser(nil, map[string]string{"team": "9999"})
			require.Error(t, err)
			assert.Equal(t, http.StatusNotFound, getHTTPErrorCode(err))
		})
		t.Run("Permissions check", func(t *testing.T) {
			// Permission matrix: a member who is not admin cannot delete
			// (CanDelete == false).
			t.Run("Forbidden non-admin", func(t *testing.T) {
				// Team 2: user1 is a member but not an admin.
				testHandler := handlerFor(&testuser1)
				_, err := testHandler.testDeleteWithUser(nil, map[string]string{"team": "2"})
				require.Error(t, err)
				assert.Equal(t, http.StatusForbidden, getHTTPErrorCode(err))
			})
			// A non-member is likewise forbidden (team 9, user1 not a member).
			t.Run("Forbidden non-member", func(t *testing.T) {
				testHandler := handlerFor(&testuser1)
				_, err := testHandler.testDeleteWithUser(nil, map[string]string{"team": "9"})
				require.Error(t, err)
				assert.Equal(t, http.StatusForbidden, getHTTPErrorCode(err))
			})
		})
	})
}

// TestHumaTeam_ETagReturns304 covers the v2-only conditional-request behaviour
// (ETag + If-None-Match -> 304) with no v1 counterpart.
func TestHumaTeam_ETagReturns304(t *testing.T) {
	e, err := setupTestEnv()
	require.NoError(t, err)
	token := humaTokenFor(t, &testuser1)

	rec := humaRequest(t, e, http.MethodGet, "/api/v2/teams/1", "", token, "")
	require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
	etag := rec.Header().Get("ETag")
	require.NotEmpty(t, etag, "GET must return an ETag header")

	req := httptest.NewRequest(http.MethodGet, "/api/v2/teams/1", strings.NewReader(""))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+token)
	req.Header.Set("If-None-Match", etag)
	rec = httptest.NewRecorder()
	e.ServeHTTP(rec, req)
	require.Equal(t, http.StatusNotModified, rec.Code, "body: %s", rec.Body.String())
}