// Copyright 2022 The LUCI Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package gerrit

import (
	"context"
	"encoding/base64"
	"fmt"
	"net/http"
	"net/http/httptest"
	"net/url"
	"testing"
	"time"

	"go.chromium.org/luci/common/clock/testclock"
	"go.chromium.org/luci/common/data/caching/lru"
	"go.chromium.org/luci/common/errors"
	gerritpb "go.chromium.org/luci/common/proto/gerrit"
	"go.chromium.org/luci/gae/impl/memory"
	"go.chromium.org/luci/gae/service/datastore"
	"go.chromium.org/luci/server/auth/authtest"
	"google.golang.org/grpc"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"

	. "github.com/smartystreets/goconvey/convey"
	. "go.chromium.org/luci/common/testing/assertions"
)

func TestPSSAMigrationClient(t *testing.T) {
	t.Parallel()

	Convey("PSSAMigrationClient", t, func() {
		ctx := memory.Use(context.Background())
		ctx, tclock := testclock.UseTime(ctx, testclock.TestRecentTimeUTC)
		ctx = authtest.MockAuthConfig(ctx)
		const migratedProject = "lProject"
		So(projectsToMigrate.Has(migratedProject), ShouldBeFalse)
		notMigratedProject, ok := projectsToMigrate.Peek()
		So(ok, ShouldBeTrue)
		So(notMigratedProject, ShouldNotBeEmpty)
		var httpRequests []*http.Request
		srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			// This test calls ListChanges RPC because it is the easiest to mock empty
			// response for.
			httpRequests = append(httpRequests, r)
			_, _ = w.Write([]byte(")]}'\n[]")) // no changes.
		}))
		defer srv.Close()
		u, err := url.Parse(srv.URL)
		So(err, ShouldBeNil)
		gHost := u.Host
		So(datastore.Put(ctx, &netrcToken{gHost, "legacy-tok"}), ShouldBeNil)
		factory := pssaMigrationFactory{
			passClientfactory: fakeFactory{},
			baseTransport:     srv.Client().Transport,
			legacyTokenCache:  lru.New(10),
		}

		Convey("For migrated project", func() {
			Convey("Work", func() {
				client, err := factory.MakeClient(ctx, gHost, migratedProject)
				So(err, ShouldBeNil)
				So(client.(pssaMigrationClient).legacyClient, ShouldBeNil)
				res, err := client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldBeNil)
				So(res, ShouldResembleProto, &gerritpb.ListChangesResponse{})
				So(httpRequests, ShouldBeEmpty)
			})

			Convey("Error is passed through", func() {
				factory.passClientfactory = fakeFactory{returnErr: errors.New("bad request")}
				client, err := factory.MakeClient(ctx, gHost, migratedProject)
				So(err, ShouldBeNil)
				_, err = client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldErrLike, "bad request")
			})
		})

		Convey("For not migrated project", func() {
			Convey("Request goes through using pssa", func() {
				client, err := factory.MakeClient(ctx, gHost, notMigratedProject)
				So(err, ShouldBeNil)
				res, err := client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldBeNil)
				So(res, ShouldResembleProto, &gerritpb.ListChangesResponse{})
				So(httpRequests, ShouldBeEmpty)
			})

			Convey("Fallback to legacy netrc token", func() {
				Convey("When pssa client returns empty project token error", func() {
					factory.passClientfactory = fakeFactory{
						// Mimic production error.
						returnErr: status.Errorf(codes.Internal, "failed to execute GET HTTP request: %s", errors.Annotate(errEmptyProjectToken, "project %q", notMigratedProject).Err()),
					}
				})
				Convey("When pssa client returns permission denied", func() {
					factory.passClientfactory = fakeFactory{
						returnErr: status.Errorf(codes.PermissionDenied, "no access"),
					}
				})
				client, err := factory.MakeClient(ctx, gHost, notMigratedProject)
				So(err, ShouldBeNil)
				res, err := client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldBeNil)
				So(res, ShouldResembleProto, &gerritpb.ListChangesResponse{})
				So(httpRequests, ShouldHaveLength, 1)
				tokenB64 := base64.StdEncoding.EncodeToString([]byte("legacy-tok"))
				So(httpRequests[0].Header["Authorization"], ShouldResemble, []string{"Basic " + tokenB64})
			})

			Convey("Error when missing netrc token", func() {
				So(datastore.Delete(ctx, &netrcToken{gHost, "legacy-tok"}), ShouldBeNil)
				factory.passClientfactory = fakeFactory{
					// Mimic production error.
					returnErr: status.Errorf(codes.Internal, "failed to execute GET HTTP request: %s", errors.Annotate(errEmptyProjectToken, "project %q", notMigratedProject).Err()),
				}
				client, err := factory.MakeClient(ctx, gHost, notMigratedProject)
				So(err, ShouldBeNil)
				_, err = client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldErrLike, "No legacy credentials for host", gHost)
			})

			Convey("Pass through other errors", func() {
				factory.passClientfactory = fakeFactory{
					returnErr: status.Errorf(codes.InvalidArgument, "invalid query"),
				}
				client, err := factory.MakeClient(ctx, gHost, notMigratedProject)
				So(err, ShouldBeNil)
				_, err = client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldErrLike, "invalid query")
				So(httpRequests, ShouldBeEmpty)
			})

			Convey("Cache token for 10 minutes", func() {
				factory.passClientfactory = fakeFactory{
					// Mimic production error.
					returnErr: status.Errorf(codes.Internal, "failed to execute GET HTTP request: %s", errors.Annotate(errEmptyProjectToken, "project %q", notMigratedProject).Err()),
				}
				client, err := factory.MakeClient(ctx, gHost, notMigratedProject)
				So(err, ShouldBeNil)
				_, err = client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldBeNil)
				tclock.Add(10*time.Minute + 1*time.Second)
				So(datastore.Put(ctx, &netrcToken{gHost, "legacy-tok-2"}), ShouldBeNil)
				_, err = client.ListChanges(ctx, &gerritpb.ListChangesRequest{})
				So(err, ShouldBeNil)
				So(httpRequests, ShouldHaveLength, 2)
				So(httpRequests[0].Header["Authorization"], ShouldResemble, []string{"Basic " + base64.StdEncoding.EncodeToString([]byte("legacy-tok"))})
				So(httpRequests[1].Header["Authorization"], ShouldResemble, []string{"Basic " + base64.StdEncoding.EncodeToString([]byte("legacy-tok-2"))})
			})
		})
	})
}

type fakeFactory struct {
	returnErr error
}

func (f fakeFactory) MakeClient(ctx context.Context, gerritHost, luciProject string) (Client, error) {
	return fakePSSAClient{err: f.returnErr}, nil
}
func (f fakeFactory) MakeMirrorIterator(ctx context.Context) *MirrorIterator {
	return nil
}

type fakePSSAClient struct {
	err error
}

func (f fakePSSAClient) ListChanges(ctx context.Context, in *gerritpb.ListChangesRequest, opts ...grpc.CallOption) (*gerritpb.ListChangesResponse, error) {
	// ListChanges is the only rpc called.
	if f.err != nil {
		return nil, f.err
	}
	return &gerritpb.ListChangesResponse{}, nil
}

func (f fakePSSAClient) GetChange(ctx context.Context, in *gerritpb.GetChangeRequest, opts ...grpc.CallOption) (*gerritpb.ChangeInfo, error) {
	panic(fmt.Errorf("not implemented"))
}

func (f fakePSSAClient) GetRelatedChanges(ctx context.Context, in *gerritpb.GetRelatedChangesRequest, opts ...grpc.CallOption) (*gerritpb.GetRelatedChangesResponse, error) {
	panic(fmt.Errorf("not implemented"))
}

func (f fakePSSAClient) ListFiles(ctx context.Context, in *gerritpb.ListFilesRequest, opts ...grpc.CallOption) (*gerritpb.ListFilesResponse, error) {
	panic(fmt.Errorf("not implemented"))
}

func (f fakePSSAClient) SetReview(ctx context.Context, in *gerritpb.SetReviewRequest, opts ...grpc.CallOption) (*gerritpb.ReviewResult, error) {
	panic(fmt.Errorf("not implemented"))
}

func (f fakePSSAClient) SubmitRevision(ctx context.Context, in *gerritpb.SubmitRevisionRequest, opts ...grpc.CallOption) (*gerritpb.SubmitInfo, error) {
	panic(fmt.Errorf("not implemented"))
}