defmodule ToweropsWeb.UserAuthTest do
  use ToweropsWeb.ConnCase, async: true

  import Towerops.AccountsFixtures

  alias Phoenix.LiveView.Socket
  alias Towerops.Accounts
  alias Towerops.Accounts.Scope
  alias ToweropsWeb.UserAuth

  @remember_me_cookie "_towerops_web_user_remember_me"
  @remember_me_cookie_max_age 60 * 60 * 24 * 14

  setup %{conn: conn} do
    conn =
      conn
      |> Map.replace!(:secret_key_base, ToweropsWeb.Endpoint.config(:secret_key_base))
      |> init_test_session(%{})

    %{user: %{user_fixture() | authenticated_at: DateTime.utc_now(:second)}, conn: conn}
  end

  describe "log_in_user/3" do
    test "stores the user token in the session", %{conn: conn, user: user} do
      conn = UserAuth.log_in_user(conn, user)
      assert token = get_session(conn, :user_token)
      assert redirected_to(conn) == ~p"/orgs"
      assert Accounts.get_user_by_session_token(token)
    end

    test "clears everything previously stored in the session", %{conn: conn, user: user} do
      conn = conn |> put_session(:to_be_removed, "value") |> UserAuth.log_in_user(user)
      refute get_session(conn, :to_be_removed)
    end

    test "keeps session when re-authenticating", %{conn: conn, user: user} do
      conn =
        conn
        |> assign(:current_scope, Scope.for_user(user))
        |> put_session(:to_be_removed, "value")
        |> UserAuth.log_in_user(user)

      assert get_session(conn, :to_be_removed)
    end

    test "clears session when user does not match when re-authenticating", %{
      conn: conn,
      user: user
    } do
      other_user = user_fixture()

      conn =
        conn
        |> assign(:current_scope, Scope.for_user(other_user))
        |> put_session(:to_be_removed, "value")
        |> UserAuth.log_in_user(user)

      refute get_session(conn, :to_be_removed)
    end

    test "redirects to the configured path", %{conn: conn, user: user} do
      conn = conn |> put_session(:user_return_to, "/hello") |> UserAuth.log_in_user(user)
      assert redirected_to(conn) == "/hello"
    end

    test "writes a cookie if remember_me is configured", %{conn: conn, user: user} do
      conn = conn |> fetch_cookies() |> UserAuth.log_in_user(user, %{"remember_me" => "true"})
      assert get_session(conn, :user_token) == conn.cookies[@remember_me_cookie]
      assert get_session(conn, :user_remember_me) == true

      assert %{value: signed_token, max_age: max_age} = conn.resp_cookies[@remember_me_cookie]
      assert signed_token != get_session(conn, :user_token)
      assert max_age == @remember_me_cookie_max_age
    end

    test "writes a cookie if remember_me was set in previous session", %{conn: conn, user: user} do
      conn = conn |> fetch_cookies() |> UserAuth.log_in_user(user, %{"remember_me" => "true"})
      assert get_session(conn, :user_token) == conn.cookies[@remember_me_cookie]
      assert get_session(conn, :user_remember_me) == true

      conn =
        conn
        |> recycle()
        |> Map.replace!(:secret_key_base, ToweropsWeb.Endpoint.config(:secret_key_base))
        |> fetch_cookies()
        |> init_test_session(%{user_remember_me: true})

      # the conn is already logged in and has the remember_me cookie set,
      # now we log in again and even without explicitly setting remember_me,
      # the cookie should be set again
      conn = UserAuth.log_in_user(conn, user, %{})
      assert %{value: signed_token, max_age: max_age} = conn.resp_cookies[@remember_me_cookie]
      assert signed_token != get_session(conn, :user_token)
      assert max_age == @remember_me_cookie_max_age
      assert get_session(conn, :user_remember_me) == true
    end
  end

  describe "logout_user/1" do
    test "erases session and cookies", %{conn: conn, user: user} do
      user_token = Accounts.generate_user_session_token(user)

      conn =
        conn
        |> put_session(:user_token, user_token)
        |> put_req_cookie(@remember_me_cookie, user_token)
        |> fetch_cookies()
        |> UserAuth.log_out_user()

      refute get_session(conn, :user_token)
      refute conn.cookies[@remember_me_cookie]
      assert %{max_age: 0} = conn.resp_cookies[@remember_me_cookie]
      assert redirected_to(conn) == ~p"/users/log-in"
      refute Accounts.get_user_by_session_token(user_token)
    end

    test "works even if user is already logged out", %{conn: conn} do
      conn = conn |> fetch_cookies() |> UserAuth.log_out_user()
      refute get_session(conn, :user_token)
      assert %{max_age: 0} = conn.resp_cookies[@remember_me_cookie]
      assert redirected_to(conn) == ~p"/users/log-in"
    end
  end

  describe "fetch_current_scope_for_user/2" do
    test "authenticates user from session", %{conn: conn, user: user} do
      user_token = Accounts.generate_user_session_token(user)

      conn =
        conn |> put_session(:user_token, user_token) |> UserAuth.fetch_current_scope_for_user([])

      assert conn.assigns.current_scope.user.id == user.id
      assert conn.assigns.current_scope.user.authenticated_at == user.authenticated_at
      assert get_session(conn, :user_token) == user_token
    end

    test "authenticates user from cookies", %{conn: conn, user: user} do
      logged_in_conn =
        conn |> fetch_cookies() |> UserAuth.log_in_user(user, %{"remember_me" => "true"})

      user_token = logged_in_conn.cookies[@remember_me_cookie]
      %{value: signed_token} = logged_in_conn.resp_cookies[@remember_me_cookie]

      conn =
        conn
        |> put_req_cookie(@remember_me_cookie, signed_token)
        |> UserAuth.fetch_current_scope_for_user([])

      assert conn.assigns.current_scope.user.id == user.id
      assert conn.assigns.current_scope.user.authenticated_at == user.authenticated_at
      assert get_session(conn, :user_token) == user_token
      assert get_session(conn, :user_remember_me)
    end

    test "does not authenticate if data is missing", %{conn: conn, user: user} do
      _ = Accounts.generate_user_session_token(user)
      conn = UserAuth.fetch_current_scope_for_user(conn, [])
      refute get_session(conn, :user_token)
      refute conn.assigns.current_scope
    end

    test "reissues a new token after a few days and refreshes cookie", %{conn: conn, user: user} do
      logged_in_conn =
        conn |> fetch_cookies() |> UserAuth.log_in_user(user, %{"remember_me" => "true"})

      token = logged_in_conn.cookies[@remember_me_cookie]
      %{value: signed_token} = logged_in_conn.resp_cookies[@remember_me_cookie]

      offset_user_token(token, -10, :day)
      {user, _} = Accounts.get_user_by_session_token(token)

      conn =
        conn
        |> put_session(:user_token, token)
        |> put_session(:user_remember_me, true)
        |> put_req_cookie(@remember_me_cookie, signed_token)
        |> UserAuth.fetch_current_scope_for_user([])

      assert conn.assigns.current_scope.user.id == user.id
      assert conn.assigns.current_scope.user.authenticated_at == user.authenticated_at
      assert new_token = get_session(conn, :user_token)
      assert new_token != token
      assert %{value: new_signed_token, max_age: max_age} = conn.resp_cookies[@remember_me_cookie]
      assert new_signed_token != signed_token
      assert max_age == @remember_me_cookie_max_age
    end
  end

  describe "require_sudo_mode/2" do
    test "allows users that have authenticated in the last 10 minutes", %{conn: conn, user: user} do
      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(user))
        |> UserAuth.require_sudo_mode([])

      refute conn.halted
      refute conn.status
    end

    test "redirects when authentication is too old", %{conn: conn, user: user} do
      eleven_minutes_ago = :second |> DateTime.utc_now() |> DateTime.add(-11, :minute)
      user = %{user | authenticated_at: eleven_minutes_ago}
      user_token = Accounts.generate_user_session_token(user)
      {user, token_inserted_at} = Accounts.get_user_by_session_token(user_token)
      assert DateTime.after?(token_inserted_at, user.authenticated_at)

      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(user))
        |> UserAuth.require_sudo_mode([])

      assert redirected_to(conn) == ~p"/users/log-in"

      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
               "You must re-authenticate to access this page."
    end
  end

  describe "redirect_if_user_is_authenticated/2" do
    setup %{conn: conn} do
      %{conn: UserAuth.fetch_current_scope_for_user(conn, [])}
    end

    test "redirects if user is authenticated", %{conn: conn, user: user} do
      conn =
        conn
        |> assign(:current_scope, Scope.for_user(user))
        |> UserAuth.redirect_if_user_is_authenticated([])

      assert conn.halted
      assert redirected_to(conn) == ~p"/orgs"
    end

    test "does not redirect if user is not authenticated", %{conn: conn} do
      conn = UserAuth.redirect_if_user_is_authenticated(conn, [])
      refute conn.halted
      refute conn.status
    end
  end

  describe "require_authenticated_user/2" do
    setup %{conn: conn} do
      %{conn: UserAuth.fetch_current_scope_for_user(conn, [])}
    end

    test "redirects if user is not authenticated", %{conn: conn} do
      conn = conn |> fetch_flash() |> UserAuth.require_authenticated_user([])
      assert conn.halted

      assert redirected_to(conn) == ~p"/users/log-in"

      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
               "You must log in to access this page."
    end

    test "stores the path to redirect to on GET", %{conn: conn} do
      halted_conn =
        %{conn | path_info: ["foo"], query_string: ""}
        |> fetch_flash()
        |> UserAuth.require_authenticated_user([])

      assert halted_conn.halted
      assert get_session(halted_conn, :user_return_to) == "/foo"

      halted_conn =
        %{conn | path_info: ["foo"], query_string: "bar=baz"}
        |> fetch_flash()
        |> UserAuth.require_authenticated_user([])

      assert halted_conn.halted
      assert get_session(halted_conn, :user_return_to) == "/foo?bar=baz"

      halted_conn =
        %{conn | path_info: ["foo"], query_string: "bar", method: "POST"}
        |> fetch_flash()
        |> UserAuth.require_authenticated_user([])

      assert halted_conn.halted
      refute get_session(halted_conn, :user_return_to)
    end

    test "does not redirect if user is authenticated", %{conn: conn, user: user} do
      conn =
        conn
        |> assign(:current_scope, Scope.for_user(user))
        |> UserAuth.require_authenticated_user([])

      refute conn.halted
      refute conn.status
    end
  end

  describe "require_superuser/2" do
    test "allows superusers", %{conn: conn} do
      superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(superuser))
        |> UserAuth.require_superuser([])

      refute conn.halted
    end

    test "redirects non-superusers", %{conn: conn, user: user} do
      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(user))
        |> UserAuth.require_superuser([])

      assert conn.halted
      assert redirected_to(conn) == ~p"/orgs"

      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
               "You must be a superuser to access this page."
    end

    test "redirects if not authenticated", %{conn: conn} do
      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(nil))
        |> UserAuth.require_superuser([])

      assert conn.halted
      assert redirected_to(conn) == ~p"/orgs"
    end
  end

  describe "load_current_organization/2" do
    test "loads organization for member", %{conn: conn, user: user} do
      {:ok, organization} = Towerops.Organizations.create_organization(%{name: "Test Org"}, user.id)

      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(user))
        |> Map.put(:path_params, %{"org_slug" => organization.slug})
        |> UserAuth.load_current_organization([])

      refute conn.halted
      assert conn.assigns.current_organization.id == organization.id
      assert conn.assigns.current_membership
    end

    test "redirects for non-member", %{conn: conn, user: user} do
      other_user = user_fixture()
      {:ok, organization} = Towerops.Organizations.create_organization(%{name: "Other Org"}, other_user.id)

      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(user))
        |> Map.put(:path_params, %{"org_slug" => organization.slug})
        |> UserAuth.load_current_organization([])

      assert conn.halted
      assert redirected_to(conn) == ~p"/orgs"

      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
               "You don't have access to this organization."
    end

    test "redirects for non-existent organization", %{conn: conn, user: user} do
      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(user))
        |> Map.put(:path_params, %{"org_slug" => "non-existent"})
        |> UserAuth.load_current_organization([])

      assert conn.halted
      assert redirected_to(conn) == ~p"/orgs"
      assert Phoenix.Flash.get(conn.assigns.flash, :error) == "Organization not found."
    end

    test "redirects if no org_slug", %{conn: conn, user: user} do
      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(user))
        |> Map.put(:path_params, %{})
        |> UserAuth.load_current_organization([])

      assert conn.halted
      assert redirected_to(conn) == ~p"/orgs"
    end

    test "redirects if no user", %{conn: conn} do
      conn =
        conn
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(nil))
        |> Map.put(:path_params, %{"org_slug" => "test"})
        |> UserAuth.load_current_organization([])

      assert conn.halted
      assert redirected_to(conn) == ~p"/orgs"
    end
  end

  describe "fetch_current_scope_for_user/2 with impersonation" do
    test "handles valid impersonation", %{conn: conn} do
      superuser = user_fixture(%{is_superuser: true})
      target_user = user_fixture()

      conn =
        conn
        |> put_session(:impersonating, true)
        |> put_session(:superuser_id, superuser.id)
        |> put_session(:target_user_id, target_user.id)
        |> UserAuth.fetch_current_scope_for_user([])

      assert conn.assigns.current_scope.user.id == target_user.id
      assert conn.assigns.current_scope.superuser.id == superuser.id
    end

    test "clears invalid impersonation - missing superuser", %{conn: conn} do
      target_user = user_fixture()

      conn =
        conn
        |> put_session(:impersonating, true)
        |> put_session(:superuser_id, Ecto.UUID.generate())
        |> put_session(:target_user_id, target_user.id)
        |> UserAuth.fetch_current_scope_for_user([])

      refute get_session(conn, :impersonating)
      refute get_session(conn, :superuser_id)
      refute get_session(conn, :target_user_id)
    end

    test "clears invalid impersonation - missing target", %{conn: conn} do
      superuser = user_fixture(%{is_superuser: true})

      conn =
        conn
        |> put_session(:impersonating, true)
        |> put_session(:superuser_id, superuser.id)
        |> put_session(:target_user_id, Ecto.UUID.generate())
        |> UserAuth.fetch_current_scope_for_user([])

      refute get_session(conn, :impersonating)
      refute get_session(conn, :superuser_id)
      refute get_session(conn, :target_user_id)
    end

    test "clears invalid impersonation - missing IDs", %{conn: conn} do
      conn =
        conn
        |> put_session(:impersonating, true)
        |> UserAuth.fetch_current_scope_for_user([])

      refute get_session(conn, :impersonating)
    end
  end

  describe "start_impersonation/2" do
    test "allows superuser to impersonate regular user", %{conn: conn} do
      superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      target_user = user_fixture()

      conn =
        conn
        |> Map.put(:remote_ip, {127, 0, 0, 1})
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(superuser))
        |> UserAuth.start_impersonation(target_user.id)

      assert get_session(conn, :impersonating)
      assert get_session(conn, :superuser_id) == superuser.id
      assert get_session(conn, :target_user_id) == target_user.id
      assert conn.assigns.current_scope.user.id == target_user.id
      assert conn.assigns.current_scope.superuser.id == superuser.id
      assert redirected_to(conn) == ~p"/orgs"
    end

    test "prevents superuser from impersonating self", %{conn: conn} do
      superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      conn =
        conn
        |> Map.put(:remote_ip, {127, 0, 0, 1})
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(superuser))
        |> UserAuth.start_impersonation(superuser.id)

      # Check that the error was set
      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
               "You cannot impersonate yourself."

      assert conn.halted
    end

    test "prevents superuser from impersonating other superusers", %{conn: conn} do
      superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      other_superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      conn =
        conn
        |> Map.put(:remote_ip, {127, 0, 0, 1})
        |> fetch_flash()
        |> assign(:current_scope, Scope.for_user(superuser))
        |> UserAuth.start_impersonation(other_superuser.id)

      # Check that the error was set
      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
               "You cannot impersonate other superusers."

      assert conn.halted
    end
  end

  describe "stop_impersonation/1" do
    test "stops impersonation and restores superuser session", %{conn: conn} do
      superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      target_user = user_fixture()

      {:ok, organization} =
        Towerops.Organizations.create_organization(%{name: "Super Org"}, superuser.id)

      conn =
        conn
        |> Map.put(:remote_ip, {127, 0, 0, 1})
        |> fetch_flash()
        |> put_session(:impersonating, true)
        |> put_session(:superuser_id, superuser.id)
        |> put_session(:target_user_id, target_user.id)
        |> assign(:current_scope, Scope.for_impersonation(superuser, target_user))
        |> UserAuth.stop_impersonation()

      refute get_session(conn, :impersonating)
      refute get_session(conn, :superuser_id)
      refute get_session(conn, :target_user_id)
      assert conn.assigns.current_scope.user.id == superuser.id
      assert redirected_to(conn) == ~p"/orgs/#{organization.slug}/devices"
    end

    test "redirects to /orgs when superuser has no organizations", %{conn: conn} do
      superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      target_user = user_fixture()

      conn =
        conn
        |> Map.put(:remote_ip, {127, 0, 0, 1})
        |> fetch_flash()
        |> put_session(:impersonating, true)
        |> put_session(:superuser_id, superuser.id)
        |> put_session(:target_user_id, target_user.id)
        |> assign(:current_scope, Scope.for_impersonation(superuser, target_user))
        |> UserAuth.stop_impersonation()

      assert redirected_to(conn) == ~p"/orgs"
    end
  end

  describe "on_mount/4 - :redirect_if_user_is_authenticated" do
    test "redirects authenticated users to signed in path", %{user: user} do
      user_token = Accounts.generate_user_session_token(user)

      {:halt, socket} =
        UserAuth.on_mount(
          :redirect_if_user_is_authenticated,
          %{},
          %{"user_token" => user_token},
          %Socket{}
        )

      assert socket.redirected
    end

    test "continues for unauthenticated users" do
      {:cont, socket} =
        UserAuth.on_mount(
          :redirect_if_user_is_authenticated,
          %{},
          %{},
          %Socket{}
        )

      refute socket.redirected
    end
  end

  describe "on_mount/4 - :require_authenticated_user" do
    test "allows authenticated users", %{user: user} do
      user_token = Accounts.generate_user_session_token(user)

      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      {:cont, socket} =
        UserAuth.on_mount(
          :require_authenticated_user,
          %{},
          %{"user_token" => user_token},
          socket
        )

      assert socket.assigns.current_scope.user.id == user.id
    end

    test "redirects unauthenticated users to login" do
      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      {:halt, socket} =
        UserAuth.on_mount(
          :require_authenticated_user,
          %{},
          %{},
          socket
        )

      assert socket.redirected
    end
  end

  describe "on_mount/4 - :load_current_organization" do
    test "loads organization for authenticated member", %{user: user} do
      {:ok, organization} = Towerops.Organizations.create_organization(%{name: "Test Org"}, user.id)
      user_token = Accounts.generate_user_session_token(user)

      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      socket =
        Phoenix.Component.assign_new(socket, :current_scope, fn -> Scope.for_user(user) end)

      {:cont, socket} =
        UserAuth.on_mount(
          :load_current_organization,
          %{"org_slug" => organization.slug},
          %{"user_token" => user_token},
          socket
        )

      assert socket.assigns.current_organization.id == organization.id
      assert socket.assigns.current_membership.role == :owner
    end

    test "redirects non-members", %{user: user} do
      other_user = user_fixture()

      {:ok, organization} =
        Towerops.Organizations.create_organization(%{name: "Other Org"}, other_user.id)

      user_token = Accounts.generate_user_session_token(user)

      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      socket =
        Phoenix.Component.assign_new(socket, :current_scope, fn -> Scope.for_user(user) end)

      {:halt, socket} =
        UserAuth.on_mount(
          :load_current_organization,
          %{"org_slug" => organization.slug},
          %{"user_token" => user_token},
          socket
        )

      assert socket.redirected
    end

    test "redirects when organization not found", %{user: user} do
      user_token = Accounts.generate_user_session_token(user)

      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      socket =
        Phoenix.Component.assign_new(socket, :current_scope, fn -> Scope.for_user(user) end)

      {:halt, socket} =
        UserAuth.on_mount(
          :load_current_organization,
          %{"org_slug" => "non-existent"},
          %{"user_token" => user_token},
          socket
        )

      assert socket.redirected
    end

    test "continues when no org_slug in params" do
      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      {:cont, socket} =
        UserAuth.on_mount(
          :load_current_organization,
          %{},
          %{},
          socket
        )

      refute socket.redirected
    end
  end

  describe "on_mount/4 - :require_superuser" do
    test "allows superusers" do
      superuser =
        user_fixture()
        |> Ecto.Changeset.change(%{is_superuser: true})
        |> Towerops.Repo.update!()

      user_token = Accounts.generate_user_session_token(superuser)

      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      {:cont, socket} =
        UserAuth.on_mount(
          :require_superuser,
          %{},
          %{"user_token" => user_token},
          socket
        )

      assert socket.assigns.current_scope.user.id == superuser.id
    end

    test "redirects regular users", %{user: user} do
      user_token = Accounts.generate_user_session_token(user)

      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      {:halt, socket} =
        UserAuth.on_mount(
          :require_superuser,
          %{},
          %{"user_token" => user_token},
          socket
        )

      assert socket.redirected
    end

    test "redirects unauthenticated users" do
      socket = %Socket{assigns: %{__changed__: %{}, flash: %{}}}

      {:halt, socket} =
        UserAuth.on_mount(
          :require_superuser,
          %{},
          %{},
          socket
        )

      assert socket.redirected
    end
  end
end