package postgres

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"math/big"
	"net/url"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

func TestParseConfigDefaultsToLocalOutsideProduction(t *testing.T) {
	cfg, err := ParseConfig(env(map[string]string{"NODE_ENV": "development"}), os.ReadFile)
	if err != nil {
		t.Fatalf("ParseConfig() error = %v", err)
	}
	if cfg.Backend != BackendLocal {
		t.Fatalf("Backend = %q, want %q", cfg.Backend, BackendLocal)
	}
}

func TestParseConfigRequiresExplicitBackendInProduction(t *testing.T) {
	_, err := ParseConfig(env(map[string]string{"NODE_ENV": "production"}), os.ReadFile)
	if err == nil || !strings.Contains(err.Error(), "ZHINIAN_DATA_BACKEND") {
		t.Fatalf("ParseConfig() error = %v, want backend validation error", err)
	}
}

func TestParseConfigRequiresPostgresURL(t *testing.T) {
	_, err := ParseConfig(env(map[string]string{"ZHINIAN_DATA_BACKEND": "postgres"}), os.ReadFile)
	if err == nil || !strings.Contains(err.Error(), "DATABASE_URL") {
		t.Fatalf("ParseConfig() error = %v, want DATABASE_URL error", err)
	}
}

func TestParseConfigAcceptsOnlyPostgresSchemesAndRejectsUnsupportedSSLQueryParameters(t *testing.T) {
	tests := []struct {
		name string
		url  string
	}{
		{name: "wrong scheme", url: "https://db.example/app"},
		{name: "mixed case unsupported ssl parameter", url: "postgresql://db.example/app?SSLcert=x"},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			_, err := ParseConfig(env(map[string]string{
				"ZHINIAN_DATA_BACKEND": "postgres",
				"DATABASE_URL":         tt.url,
			}), os.ReadFile)
			if err == nil {
				t.Fatal("ParseConfig() error = nil, want validation error")
			}
		})
	}
}

func TestParseConfigBuildsVerifyFullTLSFromURLCA(t *testing.T) {
	dir := t.TempDir()
	caPath := filepath.Join(dir, "ca.pem")
	const ca = "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n"
	read := func(path string) ([]byte, error) {
		if path != caPath {
			t.Fatalf("read path = %q, want %q", path, caPath)
		}
		return []byte(ca), nil
	}
	_, err := ParseConfig(env(map[string]string{
		"ZHINIAN_DATA_BACKEND": "postgres",
		"DATABASE_URL":         "postgresql://db.example/app?sslmode=verify-full&sslrootcert=" + url.QueryEscape(caPath),
	}), read)
	if err == nil || !strings.Contains(err.Error(), "CA certificate") {
		t.Fatalf("ParseConfig() error = %v, want invalid CA certificate error", err)
	}
}

func TestParseConfigVerifyFullBuildsRootsWithoutDisablingVerification(t *testing.T) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Fatal(err)
	}
	template := &x509.Certificate{
		SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "test CA"},
		NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour),
		IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign,
	}
	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		t.Fatal(err)
	}
	ca := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
	cfg, err := ParseConfig(env(map[string]string{
		"ZHINIAN_DATA_BACKEND": "postgres",
		"DATABASE_URL":         "postgresql://db.example/app?sslmode=verify-full&sslrootcert=%2Fca.pem",
	}), func(string) ([]byte, error) { return ca, nil })
	if err != nil {
		t.Fatalf("ParseConfig() error = %v", err)
	}
	if cfg.TLSConfig == nil || cfg.TLSConfig.RootCAs == nil {
		t.Fatal("TLSConfig.RootCAs is nil")
	}
	if cfg.TLSConfig.InsecureSkipVerify {
		t.Fatal("TLSConfig.InsecureSkipVerify = true, want full certificate and hostname verification")
	}
}

func TestParseConfigDefaultsAndNumericValidation(t *testing.T) {
	cfg, err := ParseConfig(env(map[string]string{
		"ZHINIAN_DATA_BACKEND": "postgres",
		"DATABASE_URL":         "postgres://db.example/app",
	}), os.ReadFile)
	if err != nil {
		t.Fatalf("ParseConfig() error = %v", err)
	}
	if cfg.PoolMax != 10 || cfg.IdleTimeout != 30*time.Second || cfg.ConnectionTimeout != 10*time.Second || cfg.StatementTimeout != 30*time.Second {
		t.Fatalf("unexpected defaults: %+v", cfg)
	}
	if cfg.ApplicationName != "zhinian-go" || cfg.SSLMode != SSLVerifyFull {
		t.Fatalf("unexpected identity/TLS defaults: %+v", cfg)
	}
	if cfg.TLSConfig == nil || cfg.TLSConfig.InsecureSkipVerify {
		t.Fatal("default PostgreSQL configuration must verify the server certificate")
	}

	for name, value := range map[string]string{
		"DATABASE_POOL_MAX":              "0",
		"DATABASE_IDLE_TIMEOUT_MS":       "-1",
		"DATABASE_CONNECTION_TIMEOUT_MS": "0",
		"DATABASE_STATEMENT_TIMEOUT_MS":  "nope",
	} {
		t.Run(name, func(t *testing.T) {
			_, err := ParseConfig(env(map[string]string{
				"ZHINIAN_DATA_BACKEND": "postgres",
				"DATABASE_URL":         "postgres://db.example/app",
				name:                   value,
			}), os.ReadFile)
			if err == nil || !strings.Contains(err.Error(), name) {
				t.Fatalf("ParseConfig() error = %v, want %s validation error", err, name)
			}
		})
	}
}

func env(values map[string]string) Getenv {
	return func(name string) string { return values[name] }
}