package server

import "testing"

func TestCollectExistingTunnelKeys(t *testing.T) {
	labels := map[string]string{
		"traefik.enable": "true",
		"traefik.http.routers.tunnel-king73-taylor-co-com-router.rule":                       "Host(`king73.taylor-co.com`)",
		"traefik.http.routers.tunnel-king73-taylor-co-com-router.entrypoints":                "websecure",
		"traefik.http.services.tunnel-king73-taylor-co-com-service.loadbalancer.server.port": "10007",
		"traefik.http.middlewares.tunnel-king73-taylor-co-com-auth.basicauth.users":          "user:hash",
	}

	tunnelKeys, authKeys := collectExistingTunnelKeys(labels)

	if !tunnelKeys["king73-taylor-co-com"] {
		t.Fatalf("expected tunnel key to be adopted")
	}
	if !authKeys["king73-taylor-co-com"] {
		t.Fatalf("expected auth key to be adopted")
	}
	if tunnelKeys["not-a-tunnel"] {
		t.Fatalf("unexpected non-tunnel key")
	}
}

func TestTunnelKeyFromLabelRejectsInvalidLabels(t *testing.T) {
	tests := []string{
		"traefik.enable",
		"traefik.http.routers.tunnel--router.rule",
		"traefik.http.routers.not-tunnel-king73-router.rule",
	}

	for _, test := range tests {
		if key, ok := tunnelKeyFromLabel(test, "traefik.http.routers.tunnel-", "-router."); ok {
			t.Fatalf("expected %q to be rejected, got key %q", test, key)
		}
	}
}

func TestRenderCustomLabelsReplacesPlaceholders(t *testing.T) {
	labels, err := renderCustomLabels(
		"app-example-com",
		"app.example.com",
		10042,
		"tunnel-app-example-com-router",
		"tunnel-app-example-com-service",
		"tunnel-app-example-com-auth",
		map[string]string{
			"traefik.http.routers.{router}.priority":                                                        "100",
			"traefik.http.middlewares.tunnel-{tunKey}-headers.headers.customrequestheaders.X-Tunnel-Domain": "{domain}",
		},
	)
	if err != nil {
		t.Fatalf("renderCustomLabels: %v", err)
	}

	if labels["traefik.http.routers.tunnel-app-example-com-router.priority"] != "100" {
		t.Fatalf("expected router placeholder replacement, got %#v", labels)
	}
	if labels["traefik.http.middlewares.tunnel-app-example-com-headers.headers.customrequestheaders.X-Tunnel-Domain"] != "app.example.com" {
		t.Fatalf("expected middleware/domain placeholder replacement, got %#v", labels)
	}
}

func TestCustomLabelValidation(t *testing.T) {
	tunKey := "app-example-com"
	routerName := "tunnel-app-example-com-router"
	serviceName := "tunnel-app-example-com-service"

	allowed := []string{
		"traefik.http.routers.tunnel-app-example-com-router.priority",
		"traefik.http.services.tunnel-app-example-com-service.loadbalancer.passhostheader",
		"traefik.http.middlewares.tunnel-app-example-com-headers.headers.customrequestheaders.X-Test",
	}
	for _, label := range allowed {
		if !isAllowedCustomLabel(label, tunKey, routerName, serviceName) {
			t.Fatalf("expected %q to be allowed", label)
		}
	}

	if isAllowedCustomLabel("traefik.http.routers.other-router.priority", tunKey, routerName, serviceName) {
		t.Fatalf("expected other router label to be rejected")
	}
	if !isProtectedCustomLabel("traefik.http.routers.tunnel-app-example-com-router.rule", routerName, serviceName) {
		t.Fatalf("expected route rule to be protected")
	}
	if isProtectedCustomLabel("traefik.http.routers.tunnel-app-example-com-router.priority", routerName, serviceName) {
		t.Fatalf("expected router priority to be customizable")
	}
	if isSafeLabelKey("traefik.http.routers.tunnel-app-example-com-router.priority;bad") {
		t.Fatalf("expected shell metacharacter in label key to be rejected")
	}
}

func TestMergeMiddlewaresDeduplicates(t *testing.T) {
	got := mergeMiddlewares("auth,headers", "headers,compress")
	want := "auth,headers,compress"
	if got != want {
		t.Fatalf("mergeMiddlewares() = %q, want %q", got, want)
	}
}

func TestLabelFlagShellQuotesSingleQuotes(t *testing.T) {
	got := labelFlag("test.label", "value'withquote")
	want := "'test.label=value'\\''withquote'"
	if got != want {
		t.Fatalf("labelFlag() = %q, want %q", got, want)
	}
}

func TestStaleLabelKeys(t *testing.T) {
	got := staleLabelKeys(
		[]string{"traefik.http.routers.tunnel-a-router.priority", "traefik.http.routers.tunnel-a-router.middlewares"},
		map[string]string{"traefik.http.routers.tunnel-a-router.middlewares": "auth"},
	)
	if len(got) != 1 || got[0] != "traefik.http.routers.tunnel-a-router.priority" {
		t.Fatalf("unexpected stale keys: %#v", got)
	}
}