package supervisor

import (
	"context"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

func TestAllocatedStartInjectsDynamicEndpointAndCallsReadyAfterProbe(t *testing.T) {
	ready := false
	readyCalled := false
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case "/gameserver":
			_, _ = w.Write([]byte(`{"status":{"address":"203.0.113.9","ports":[{"name":"game","port":31001}]}}`))
		case "/ready-probe":
			if ready {
				w.WriteHeader(http.StatusOK)
			} else {
				w.WriteHeader(http.StatusServiceUnavailable)
			}
		case "/ready":
			readyCalled = true
			w.WriteHeader(http.StatusOK)
		default:
			w.WriteHeader(http.StatusNotFound)
		}
	}))
	defer server.Close()

	ready = true
	path := filepath.Join(t.TempDir(), "env.txt")
	argsPath := filepath.Join(t.TempDir(), "args.txt")
	command := []string{"/bin/sh", "-c", "env > " + path + "; printf '%s' \"$@\" > " + argsPath, "shell"}
	s, err := New(Config{Command: command, SDKBaseURL: server.URL, ReadyURL: server.URL + "/ready-probe", Transport: "steam_sdr", ReadyTimeout: time.Second, PollInterval: time.Millisecond})
	if err != nil {
		t.Fatal(err)
	}
	if err := s.Start(context.Background()); err != nil {
		t.Fatal(err)
	}
	if err := s.Wait(); err != nil {
		t.Fatal(err)
	}
	contents, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(contents), "SDR_LISTEN_PORT=31001") || !strings.Contains(string(contents), "SDR_IP=203.0.113.9:31001") {
		t.Fatalf("dynamic endpoint not injected: %s", contents)
	}
	args, err := os.ReadFile(argsPath)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(args), "--port=31001") {
		t.Fatalf("dynamic port argument not injected: %s", args)
	}
	if !readyCalled {
		t.Fatal("Agones Ready was called before process-ready probe")
	}
}

func TestAllocatedENetDoesNotReceiveSDRVariables(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/gameserver" {
			_, _ = w.Write([]byte(`{"status":{"address":"127.0.0.1","ports":[{"name":"game","port":31002}]}}`))
			return
		}
		if r.URL.Path == "/ready-probe" {
			w.WriteHeader(http.StatusOK)
			return
		}
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()
	path := filepath.Join(t.TempDir(), "env.txt")
	s, err := New(Config{Command: []string{"/bin/sh", "-c", "env > " + path}, SDKBaseURL: server.URL, ReadyURL: server.URL + "/ready-probe", Transport: "enet", ReadyTimeout: time.Second})
	if err != nil {
		t.Fatal(err)
	}
	if err := s.Start(context.Background()); err != nil {
		t.Fatal(err)
	}
	if err := s.Wait(); err != nil {
		t.Fatal(err)
	}
	contents, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(contents), "SDR_LISTEN_PORT=") || strings.Contains(string(contents), "SDR_IP=") {
		t.Fatalf("ENet received SDR variables: %s", contents)
	}
}

func TestDirectModeDoesNotRequireAgonesReadiness(t *testing.T) {
	s, err := New(Config{Command: []string{"/bin/sh", "-c", "exit 0"}})
	if err != nil {
		t.Fatal(err)
	}
	if err := s.Start(context.Background()); err != nil {
		t.Fatal(err)
	}
	if err := s.Wait(); err != nil {
		t.Fatal(err)
	}
}

func TestDrainRequiresAndUsesAuthenticatedLocalEndpoint(t *testing.T) {
	seenToken := ""
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/drain" {
			w.WriteHeader(http.StatusNotFound)
			return
		}
		seenToken = r.Header.Get("Authorization")
		if seenToken != "Bearer secret-token" {
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		w.WriteHeader(http.StatusAccepted)
	}))
	defer server.Close()
	s, err := New(Config{Command: []string{"/bin/sh", "-c", "exit 0"}, DrainURL: server.URL + "/drain", DrainToken: "secret-token"})
	if err != nil {
		t.Fatal(err)
	}
	if err := s.Drain(context.Background()); err != nil {
		t.Fatal(err)
	}
	if seenToken != "Bearer secret-token" {
		t.Fatalf("unexpected drain token: %q", seenToken)
	}
	missing, _ := New(Config{Command: []string{"/bin/sh", "-c", "exit 0"}})
	if err := missing.Drain(context.Background()); err == nil {
		t.Fatal("unauthenticated drain was allowed")
	}
}

func TestAssignedEndpointRejectsMalformedAddressAndPort(t *testing.T) {
	for _, response := range []string{
		`{"status":{"address":"203.0.113.9","ports":[{"name":"game","port":65536}]}}`,
		`{"status":{"address":"   ","ports":[{"name":"game","port":31001}]}}`,
		`{"status":{"address":"203.0.113.9 bad","ports":[{"name":"game","port":31001}]}}`,
	} {
		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if r.URL.Path == "/gameserver" {
				_, _ = w.Write([]byte(response))
				return
			}
			w.WriteHeader(http.StatusOK)
		}))
		s, err := New(Config{Command: []string{"/bin/sh", "-c", "exit 0"}, SDKBaseURL: server.URL, ReadyURL: server.URL + "/probe", ReadyTimeout: time.Second})
		if err != nil {
			server.Close()
			t.Fatal(err)
		}
		if err := s.Start(context.Background()); err == nil {
			t.Errorf("malformed endpoint was accepted: %s", response)
		}
		server.Close()
	}
}

func TestSupervisorRejectsRemoteOrPartialDrainConfiguration(t *testing.T) {
	for _, config := range []Config{
		{Command: []string{"/bin/sh", "-c", "exit 0"}, DrainURL: "https://example.com/drain", DrainToken: "token-1234567890123456"},
		{Command: []string{"/bin/sh", "-c", "exit 0"}, DrainURL: "http://127.0.0.1/drain"},
		{Command: []string{"/bin/sh", "-c", "exit 0"}, DrainToken: "token-1234567890123456"},
		{Command: []string{"/bin/sh", "-c", "exit 0"}, DrainURL: "http://127.0.0.1/drain?token=leaked", DrainToken: "token-1234567890123456"},
	} {
		if _, err := New(config); err == nil {
			t.Fatalf("unsafe drain configuration accepted: %+v", config)
		}
	}
}

func TestRunDrainsBeforeChildExit(t *testing.T) {
	marker := filepath.Join(t.TempDir(), "drained")
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/drain" {
			w.WriteHeader(http.StatusNotFound)
			return
		}
		if r.Header.Get("Authorization") != "Bearer run-secret" {
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		if err := os.WriteFile(marker, []byte("drained"), 0600); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusAccepted)
	}))
	defer server.Close()
	command := []string{"/bin/sh", "-c", "while [ ! -f '" + marker + "' ]; do sleep 0.01; done"}
	s, err := New(Config{Command: command, DrainURL: server.URL + "/drain", DrainToken: "run-secret"})
	if err != nil {
		t.Fatal(err)
	}
	ctx, cancel := context.WithCancel(context.Background())
	time.AfterFunc(30*time.Millisecond, cancel)
	if err := s.Run(ctx, time.Second); err != nil {
		t.Fatalf("graceful run: %v", err)
	}
	if _, err := os.Stat(marker); err != nil {
		t.Fatalf("drain endpoint was not called: %v", err)
	}
}

func TestRunForceKillsUnresponsiveChildAtDeadline(t *testing.T) {
	s, err := New(Config{Command: []string{"/bin/sh", "-c", "trap '' TERM; sleep 5"}})
	if err != nil {
		t.Fatal(err)
	}
	ctx, cancel := context.WithCancel(context.Background())
	time.AfterFunc(30*time.Millisecond, cancel)
	started := time.Now()
	err = s.Run(ctx, 50*time.Millisecond)
	if err == nil || !strings.Contains(err.Error(), "force-killed") {
		t.Fatalf("unresponsive child result = %v", err)
	}
	if elapsed := time.Since(started); elapsed > time.Second {
		t.Fatalf("force-kill exceeded bounded deadline: %s", elapsed)
	}
}