package auth

import (
	"testing"
	"time"

	"k8s.io/client-go/rest"
)

func TestConfig_Enabled(t *testing.T) {
	tests := []struct {
		mode string
		want bool
	}{
		{"", false},
		{"none", false},
		{"proxy", true},
		{"oidc", true},
	}

	for _, tt := range tests {
		t.Run(tt.mode, func(t *testing.T) {
			cfg := Config{Mode: tt.mode}
			if cfg.Enabled() != tt.want {
				t.Errorf("Config{Mode: %q}.Enabled() = %v, want %v", tt.mode, cfg.Enabled(), tt.want)
			}
		})
	}
}

func TestConfig_Defaults(t *testing.T) {
	cfg := Config{Mode: "proxy"}
	cfg.Defaults()

	if cfg.CookieTTL != 4*time.Hour {
		t.Errorf("CookieTTL = %v, want 4h", cfg.CookieTTL)
	}
	if cfg.UserHeader != "X-Forwarded-User" {
		t.Errorf("UserHeader = %q, want %q", cfg.UserHeader, "X-Forwarded-User")
	}
	if cfg.GroupsHeader != "X-Forwarded-Groups" {
		t.Errorf("GroupsHeader = %q, want %q", cfg.GroupsHeader, "X-Forwarded-Groups")
	}
	if cfg.OIDCGroupsClaim != "groups" {
		t.Errorf("OIDCGroupsClaim = %q, want %q", cfg.OIDCGroupsClaim, "groups")
	}
	wantScopes := []string{"openid", "profile", "email", "groups"}
	if len(cfg.OIDCScopes) != len(wantScopes) {
		t.Fatalf("OIDCScopes = %v, want %v", cfg.OIDCScopes, wantScopes)
	}
	for i, s := range wantScopes {
		if cfg.OIDCScopes[i] != s {
			t.Errorf("OIDCScopes[%d] = %q, want %q", i, cfg.OIDCScopes[i], s)
		}
	}
	if cfg.Secret == "" {
		t.Error("Secret should be auto-generated when auth is enabled")
	}
}

func TestConfig_Defaults_NoSecretWhenDisabled(t *testing.T) {
	cfg := Config{Mode: "none"}
	cfg.Defaults()

	if cfg.Secret != "" {
		t.Error("Secret should not be auto-generated when auth is disabled")
	}
}

func TestConfig_Defaults_PreservesExistingValues(t *testing.T) {
	cfg := Config{
		Mode:            "proxy",
		Secret:          "my-secret",
		CookieTTL:       2 * time.Hour,
		UserHeader:      "X-Custom-User",
		GroupsHeader:    "X-Custom-Groups",
		OIDCGroupsClaim: "roles",
		OIDCScopes:      []string{"openid", "email"},
	}
	cfg.Defaults()

	if cfg.Secret != "my-secret" {
		t.Error("Defaults should not overwrite existing Secret")
	}
	if cfg.CookieTTL != 2*time.Hour {
		t.Error("Defaults should not overwrite existing CookieTTL")
	}
	if cfg.UserHeader != "X-Custom-User" {
		t.Error("Defaults should not overwrite existing UserHeader")
	}
	if cfg.GroupsHeader != "X-Custom-Groups" {
		t.Error("Defaults should not overwrite existing GroupsHeader")
	}
	if cfg.OIDCGroupsClaim != "roles" {
		t.Error("Defaults should not overwrite existing OIDCGroupsClaim")
	}
	if len(cfg.OIDCScopes) != 2 || cfg.OIDCScopes[0] != "openid" || cfg.OIDCScopes[1] != "email" {
		t.Errorf("Defaults should not overwrite existing OIDCScopes, got %v", cfg.OIDCScopes)
	}
}

func TestConfig_Defaults_AutoGeneratedSecretUnique(t *testing.T) {
	cfg1 := Config{Mode: "proxy"}
	cfg1.Defaults()

	cfg2 := Config{Mode: "proxy"}
	cfg2.Defaults()

	if cfg1.Secret == cfg2.Secret {
		t.Error("Auto-generated secrets should be unique")
	}
}

func TestImpersonatedConfig_SetsImpersonationFields(t *testing.T) {
	base := &rest.Config{Host: "https://k8s.example.com"}
	username := "alice"
	groups := []string{"dev", "ops"}

	result := ImpersonatedConfig(base, username, groups)

	if result.Impersonate.UserName != username {
		t.Errorf("Impersonate.UserName = %q, want %q", result.Impersonate.UserName, username)
	}
	if len(result.Impersonate.Groups) != len(groups) {
		t.Fatalf("Impersonate.Groups len = %d, want %d", len(result.Impersonate.Groups), len(groups))
	}
	for i, g := range groups {
		if result.Impersonate.Groups[i] != g {
			t.Errorf("Impersonate.Groups[%d] = %q, want %q", i, result.Impersonate.Groups[i], g)
		}
	}
}

func TestImpersonatedConfig_DoesNotMutateBase(t *testing.T) {
	base := &rest.Config{Host: "https://k8s.example.com"}
	_ = ImpersonatedConfig(base, "alice", []string{"dev"})

	if base.Impersonate.UserName != "" {
		t.Error("ImpersonatedConfig must not mutate the base config")
	}
}