package passkey

import (
	"crypto/tls"
	"net/http/httptest"
	"testing"

	"github.com/QuantumNous/new-api/setting/system_setting"
	"github.com/stretchr/testify/require"
)

func TestResolveOriginsRejectsInsecureConfiguredOriginUnlessAllowed(t *testing.T) {
	request := httptest.NewRequest("GET", "https://gateway.example", nil)
	settings := &system_setting.PasskeySettings{Origins: "http://gateway.example", AllowInsecureOrigin: false}

	_, err := resolveOrigins(request, settings)

	require.Error(t, err)
	settings.AllowInsecureOrigin = true
	origins, err := resolveOrigins(request, settings)
	require.NoError(t, err)
	require.Equal(t, []string{"http://gateway.example"}, origins)
}

func TestResolveOriginsUsesForwardedHTTPSAndRejectsUnsecuredPublicHost(t *testing.T) {
	settings := &system_setting.PasskeySettings{}
	request := httptest.NewRequest("GET", "http://gateway.example:8443", nil)
	request.Header.Set("X-Forwarded-Proto", "https, http")

	origins, err := resolveOrigins(request, settings)
	require.NoError(t, err)
	require.Equal(t, []string{"https://gateway.example:8443"}, origins)

	request = httptest.NewRequest("GET", "http://gateway.example", nil)
	_, err = resolveOrigins(request, settings)
	require.Error(t, err)
}

func TestResolveRPIDAndSchemeDetection(t *testing.T) {
	settings := &system_setting.PasskeySettings{}
	rpID, err := resolveRPID(nil, settings, []string{"https://gateway.example:8443"})
	require.NoError(t, err)
	require.Equal(t, "gateway.example", rpID)

	settings.RPID = " configured.example:9443 "
	rpID, err = resolveRPID(nil, settings, nil)
	require.NoError(t, err)
	require.Equal(t, "configured.example", rpID)

	request := httptest.NewRequest("GET", "http://localhost", nil)
	request.TLS = &tls.ConnectionState{}
	require.Equal(t, "https", detectScheme(request))
	require.Equal(t, "::1", hostWithoutPort("[::1]:443"))
}