package clientapi_test

import (
	"net/http"
	"net/url"
	"testing"

	"github.com/dariuszjaniak/warp/server/internal/httputil"
)

// TestOpenIDToken is the exchange the LiveKit JWT service relies on: a user
// asks for a token, hands it over, and the service asks this server who it
// belongs to.
func TestOpenIDToken(t *testing.T) {
	ts := newTestServer(t, nil)
	alice := ts.register("alice", "correct-horse-battery-staple")
	bob := ts.register("bob", "correct-horse-battery-staple")
	path := "/_matrix/client/v3/user/" + url.PathEscape(alice.UserID) + "/openid/request_token"

	rec := ts.post(path, alice.AccessToken, map[string]any{})
	expectStatus(t, rec, http.StatusOK)
	body := jsonBody(t, rec)
	token, _ := body["access_token"].(string)
	if token == "" || body["token_type"] != "Bearer" || body["matrix_server_name"] != testServerName ||
		body["expires_in"] != float64(3600) {
		t.Fatalf("request_token = %s", rec.Body.String())
	}

	// The token is no access token.
	expectError(t, ts.get("/_matrix/client/v3/account/whoami", token), http.StatusUnauthorized, httputil.ErrCodeUnknownToken)

	rec = ts.get("/_matrix/federation/v1/openid/userinfo?access_token="+url.QueryEscape(token), "")
	expectStatus(t, rec, http.StatusOK)
	if got := jsonBody(t, rec)["sub"]; got != alice.UserID {
		t.Errorf("sub = %v, want %s", got, alice.UserID)
	}

	expectError(t, ts.get("/_matrix/federation/v1/openid/userinfo?access_token=nope", ""),
		http.StatusUnauthorized, httputil.ErrCodeUnknownToken)
	expectError(t, ts.get("/_matrix/federation/v1/openid/userinfo", ""),
		http.StatusUnauthorized, "M_MISSING_TOKEN")

	// Nobody gets a token in someone else's name.
	expectError(t, ts.post(path, bob.AccessToken, map[string]any{}), http.StatusForbidden, httputil.ErrCodeForbidden)
}

// TestOpenIDUserInfoIgnoresFederationSwitch: the userinfo endpoint answers
// with federation off, so a server that does not federate can still let its
// users into group calls.
func TestOpenIDUserInfoIgnoresFederationSwitch(t *testing.T) {
	ts := newTestServer(t, nil)
	if ts.settings.FederationEnabled() {
		t.Fatal("the test server is expected to start with federation off")
	}
	alice := ts.register("alice", "correct-horse-battery-staple")
	rec := ts.post("/_matrix/client/v3/user/"+url.PathEscape(alice.UserID)+"/openid/request_token",
		alice.AccessToken, nil)
	expectStatus(t, rec, http.StatusOK)
	token, _ := jsonBody(t, rec)["access_token"].(string)
	expectStatus(t, ts.get("/_matrix/federation/v1/openid/userinfo?access_token="+url.QueryEscape(token), ""), http.StatusOK)
}