package nginx

import (
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/havline/havline/internal/config"
	"github.com/havline/havline/internal/proxy"
)

func TestGenerateSecurityDirectives(t *testing.T) {
	dir := t.TempDir()
	if err := os.WriteFile(filepath.Join(dir, "mime.types"), []byte("types { text/html html; }\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	cidrPath := filepath.Join(dir, "nginx", "china_cidr.conf")
	if err := os.MkdirAll(filepath.Dir(cidrPath), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(cidrPath, []byte("1.0.0.0/8 1;\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	cfg := config.Config{
		DataDir:        dir,
		NginxPIDFile:   filepath.Join(dir, "nginx.pid"),
		NginxMimeTypes: filepath.Join(dir, "mime.types"),
	}
	rules := []proxy.Rule{{
		ID:           7,
		ListenPort:   8080,
		ListenIPv4:   true,
		Hosts:        []proxy.Host{{Hostname: "app.example.com"}},
		Upstream:     "http://127.0.0.1:3000",
		Enabled:      true,
		HTTPSEnabled: false,
		Security: proxy.SecurityConfig{
			IPBlacklist:     []string{"1.2.3.4", "10.0.0.0/8"},
			IPWhitelistMode: true,
			IPWhitelist:     []string{"192.168.1.0/24"},
			ChinaOnly:       true,
			BasicAuth: &proxy.BasicAuthConfig{
				Enabled:      true,
				Username:     "user",
				PasswordHash: "$2a$10$abcdefghijklmnopqrstuv",
			},
			RateLimit: &proxy.RateLimitConfig{Enabled: true, Rate: 10, Burst: 20},
			ConnLimit: &proxy.ConnLimitConfig{Enabled: true, Max: 20},
		},
	}}

	opts := GenerateOptions{
		GlobalIPWhitelist:  []string{"203.0.113.10"},
		GlobalIPBlacklist:  []string{"8.8.8.8"},
		ChinaCIDRAvailable: true,
	}
	content, err := Generate(cfg, rules, nil, opts)
	if err != nil {
		t.Fatalf("generate: %v", err)
	}
	checks := []string{
		"allow 10.0.0.0/8;",
		"allow 203.0.113.10;",
		"deny 8.8.8.8;",
		"limit_req_zone $binary_remote_addr zone=havline_rule_7_req",
		"limit_conn_zone $binary_remote_addr zone=havline_rule_7_conn",
		"deny 1.2.3.4;",
		"geo $havline_client_ip $havline_is_private",
		"geo $havline_client_ip $havline_rule_7_china_bypass",
		"192.168.0.0/16 1;",
		"192.168.1.0/24 1;",
		"203.0.113.10 1;",
		"set $havline_china_block 0;",
		"if ($havline_is_private = 1)",
		"if ($havline_rule_7_china_bypass = 1)",
		"allow 192.168.1.0/24;",
		"deny all;",
		"auth_basic",
		"limit_req zone=havline_rule_7_req burst=20",
		"limit_conn havline_rule_7_conn 20",
		"error_page 403 /havline-errors/403.html",
		"location = /havline-errors/error.png",
		"location = /havline-errors/429.png",
		"X-Forwarded-Host $host",
		"X-Forwarded-Port $server_port",
		"X-Real-Proto $scheme",
	}
	for _, want := range checks {
		if !strings.Contains(content, want) {
			t.Fatalf("missing %q in:\n%s", want, content)
		}
	}
}