package auth

import (
	"crypto/sha256"
	"net/http"
	"testing"
	"time"

	"aigw/internal/domain"
)

func TestStaticAuthenticator(t *testing.T) {
	raw := `[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","scopes":["inference"]}]`
	authenticator, err := NewStatic(raw, false)
	if err != nil {
		t.Fatal(err)
	}

	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
	request.Header.Set("Authorization", "Bearer sk-client")
	principal, err := authenticator.Authenticate(request)
	if err != nil {
		t.Fatal(err)
	}
	if principal.TenantID != "tenant-1" || principal.ProjectID != "project-1" || principal.KeyID != "key-1" {
		t.Fatalf("unexpected principal: %+v", principal)
	}

	request.Header.Set("Authorization", "Bearer wrong")
	if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
		t.Fatalf("expected ErrUnauthorized, got %v", err)
	}
}

func TestDynamicAuthenticatorReplacesSnapshot(t *testing.T) {
	oldHash := sha256.Sum256([]byte("sk-old"))
	newHash := sha256.Sum256([]byte("sk-new"))
	authenticator := NewDynamic([]HashedKeyRecord{{
		Hash: oldHash,
		Principal: domain.Principal{
			KeyID: "old", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
		},
	}}, false)

	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
	request.Header.Set("Authorization", "Bearer sk-old")
	if _, err := authenticator.Authenticate(request); err != nil {
		t.Fatalf("old key should initially authenticate: %v", err)
	}

	authenticator.ReplaceHashed([]HashedKeyRecord{{
		Hash: newHash,
		Principal: domain.Principal{
			KeyID: "new", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
		},
	}})
	if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
		t.Fatalf("old key remained valid after snapshot replacement: %v", err)
	}
	request.Header.Set("Authorization", "Bearer sk-new")
	principal, err := authenticator.Authenticate(request)
	if err != nil || principal.KeyID != "new" {
		t.Fatalf("new key was not loaded: principal=%+v err=%v", principal, err)
	}
}

func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) {
	authenticator, err := NewStatic(`[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1"}]`, false)
	if err != nil {
		t.Fatal(err)
	}
	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/anthropic/v1/models", nil)
	request.Header.Set("x-api-key", "sk-client")
	if _, err := authenticator.Authenticate(request); err != nil {
		t.Fatal(err)
	}
}

func TestStaticAuthenticatorLoadsRestrictionsAndRejectsExpiredKey(t *testing.T) {
	future := time.Now().Add(time.Hour).UTC().Format(time.RFC3339Nano)
	authenticator, err := NewStatic(`[{"key":"sk-limited","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","allowed_models":["model/allowed"],"monthly_spend_micros":1250000,"daily_spend_micros":250000,"requests_per_minute":12,"tokens_per_minute":3400,"expires_at":"`+future+`"}]`, false)
	if err != nil {
		t.Fatal(err)
	}
	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
	request.Header.Set("Authorization", "Bearer sk-limited")
	principal, err := authenticator.Authenticate(request)
	if err != nil {
		t.Fatal(err)
	}
	if principal.MonthlySpendMicros != 1_250_000 {
		t.Fatalf("monthly spend limit = %d", principal.MonthlySpendMicros)
	}
	if principal.DailySpendMicros != 250_000 || principal.RequestsPerMinute != 12 || principal.TokensPerMinute != 3400 {
		t.Fatalf("key spend or rate controls were not loaded: %+v", principal)
	}
	if _, ok := principal.AllowedModels["model/allowed"]; !ok {
		t.Fatalf("allowed model was not loaded: %+v", principal.AllowedModels)
	}

	past := time.Now().Add(-time.Minute)
	hash := sha256.Sum256([]byte("sk-expired"))
	authenticator.ReplaceHashed([]HashedKeyRecord{{Hash: hash, Principal: domain.Principal{
		KeyID: "expired", TenantID: "tenant-1", ProjectID: "project-1", ExpiresAt: &past,
	}}})
	request.Header.Set("Authorization", "Bearer sk-expired")
	if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
		t.Fatalf("expired key error = %v, want ErrUnauthorized", err)
	}
}