// Integration tests for every /api/v1/ endpoint exposed by gitly.
//
// The suite spawns its own gitly process on a non-default port using a
// dedicated sqlite database, so it can be executed independently of any
// long-running dev instance (run with `v test api/` or `v test .`).
//
// Endpoints covered:
//   GET  /api/v1/me
//   GET  /api/v1/users/:username
//   GET  /api/v1/users/:username/repos
//   GET  /api/v1/repos/:username/:repo_name
//   GET  /api/v1/repos/:username/:repo_name/issues
//   POST /api/v1/repos/:username/:repo_name/issues
//   GET  /api/v1/repos/:username/:repo_name/issues/:id
//   GET  /api/v1/repos/:username/:repo_name/pulls
//   GET  /api/v1/repos/:username/:repo_name/pulls/:id
//   GET  /api/v1/repos/:username/:repo_name/pulls/:id/comments
//   POST /api/v1/repos/:repo_id/star
//   POST /api/v1/repos/:repo_id/watch
//   GET  /api/v1/repos/:repo_id_str/tree/files
//   GET  /api/v1/:user/:repo_name/branches/count
//   GET  /api/v1/:user/:repo_name/:branch_name/commits/count
//   GET  /api/v1/:username/:repo_name/issues/count
//   POST /api/v1/users/avatar
//   POST /api/v1/ci/status
module api

import os
import log
import net.http
import time
import json

const test_port = 8765
const test_url = 'http://127.0.0.1:${test_port}'
const test_username = 'apitester'
const test_password = '1234zxcv'
const test_email = '[email protected]'
const test_repo = 'apitest'
const test_other_user = 'apitester2'
const test_other_password = '5678qwer'
const test_other_email = '[email protected]'

const test_binary = 'gitly_apitest.exe'
const test_sqlite_path = 'gitly_apitest.sqlite'

// Test-wide state is passed between testsuite_begin and individual tests via
// environment variables, since `v test` does not allow `__global` declarations
// in module test files.
const env_session = 'GITLY_APITEST_SESSION'
const env_other_session = 'GITLY_APITEST_OTHER_SESSION'
const env_bearer = 'GITLY_APITEST_BEARER'
const env_repo_id = 'GITLY_APITEST_REPO_ID'

fn session_cookie() string {
    return os.getenv(env_session)
}

fn other_session_cookie() string {
    return os.getenv(env_other_session)
}

fn bearer_token() string {
    return os.getenv(env_bearer)
}

fn repo_id() int {
    return os.getenv(env_repo_id).int()
}

// -- testsuite plumbing -------------------------------------------------------

fn testsuite_begin() {
    chdir_to_project_root()
    kill_test_gitly()
    cleanup_test_state()
    ensure_gitly_binary()
    spawn_test_gitly()
    wait_for_test_gitly()

    session := register(test_username, test_password, test_email) or {
        fail('register primary user: ${err}')
    }
    os.setenv(env_session, session, true)

    other := register(test_other_user, test_other_password, test_other_email) or {
        fail('register secondary user: ${err}')
    }
    os.setenv(env_other_session, other, true)

    token := create_api_token(session, test_username) or { fail('create api token: ${err}') }
    os.setenv(env_bearer, token, true)

    create_repo(session, test_repo) or { fail('create repo: ${err}') }

    rid := fetch_test_repo_id() or { fail('fetch repo id: ${err}') }
    os.setenv(env_repo_id, rid.str(), true)
}

fn testsuite_end() {
    kill_test_gitly()
    cleanup_test_state()
}

@[noreturn]
fn fail(msg string) {
    log.error('api endpoints_test: ${msg}')
    kill_test_gitly()
    cleanup_test_state()
    exit(1)
}

fn chdir_to_project_root() {
    project_root := os.real_path(os.join_path(os.dir(@FILE), '..'))
    os.chdir(project_root) or { fail('chdir to project root ${project_root}: ${err}') }
}

fn cleanup_test_state() {
    for ext in ['', '-shm', '-wal'] {
        path := test_sqlite_path + ext
        if os.exists(path) {
            os.rm(path) or {}
        }
    }
    for user in [test_username, test_other_user] {
        repo_path := os.join_path('repos', user)
        if os.exists(repo_path) {
            os.rmdir_all(repo_path) or {}
        }
    }
}

fn ensure_gitly_binary() {
    if os.exists(test_binary) {
        return
    }
    log.info('building ${test_binary} ...')
    res := os.execute('v -d sqlite -d use_libbacktrace -d use_openssl -o ${test_binary} .')
    if res.exit_code != 0 {
        fail('failed to build gitly: ${res.output}')
    }
}

fn spawn_test_gitly() {
    os.setenv('GITLY_PORT', test_port.str(), true)
    os.setenv('GITLY_SQLITE_PATH', test_sqlite_path, true)
    spawn fn () {
        os.execute('./${test_binary}')
    }()
}

fn wait_for_test_gitly() {
    for i := 0; i < 100; i++ {
        time.sleep(100 * time.millisecond)
        http.get(test_url + '/') or { continue }
        return
    }
    fail('gitly did not start listening on ${test_url}')
}

fn kill_test_gitly() {
    os.execute('pkill -9 ${test_binary}')
}

// -- helpers ------------------------------------------------------------------

fn url(path string) string {
    if path.starts_with('/') {
        return '${test_url}${path}'
    }
    return '${test_url}/${path}'
}

fn extract_token_cookie(h http.Header) string {
    for v in h.values(.set_cookie) {
        t := v.find_between('token=', ';')
        if t != '' {
            return t
        }
    }
    return ''
}

fn register(username string, password string, email string) !string {
    body := 'username=${username}&password=${password}&email=${email}&no_redirect=1'
    resp := http.post(url('/register'), body)!
    if resp.status_code != 200 {
        return error('register returned ${resp.status_code}: ${resp.body}')
    }
    tok := extract_token_cookie(resp.header)
    if tok == '' {
        return error('no session token cookie in register response')
    }
    return tok
}

fn create_repo(token string, name string) ! {
    resp := http.fetch(
        method:  .post
        url:     url('/new')
        cookies: {
            'token': token
        }
        data:    'name=${name}&description=api+test&clone_url=&repo_visibility=public&no_redirect=1'
    )!
    if resp.status_code != 200 || resp.body != 'ok' {
        return error('unexpected response ${resp.status_code}: ${resp.body}')
    }
}

fn create_api_token(token string, username string) !string {
    resp := http.fetch(
        method:         .post
        url:            url('/${username}/settings/api-tokens')
        cookies:        {
            'token': token
        }
        data:           'name=api-test'
        allow_redirect: false
    )!
    if resp.status_code != 302 && resp.status_code != 303 {
        return error('expected redirect, got ${resp.status_code}: ${resp.body}')
    }
    location := resp.header.get(.location) or { return error('no Location header') }
    plain := location.all_after('new_token=')
    if plain == '' || plain == location {
        return error('could not parse new_token from ${location}')
    }
    return plain
}

fn fetch_test_repo_id() !int {
    resp := http.get(url('/api/v1/users/${test_username}/repos'))!
    if resp.status_code != 200 {
        return error('listing returned ${resp.status_code}')
    }
    repos := json.decode([]ApiRepoSummary, resp.body)!
    for r in repos {
        if r.name == test_repo {
            return r.id
        }
    }
    return error('repo not found in listing')
}

struct ApiRepoSummary {
    id        int
    name      string
    user_name string
}

struct ApiUserSummary {
    id        int
    username  string
    full_name string
    avatar    string
}

struct ApiIssueSummary {
    id      int
    number  int
    repo_id int
    title   string
    body    string
    author  string
    status  string
}

struct ApiPullSummary {
    id          int
    repo_id     int
    title       string
    description string
    status      string
}

struct ApiCommentSummary {
    id     int
    author string
    text   string
}

struct ApiBoolResult {
    success bool
    result  bool
}

struct ApiFilesResult {
    success bool
    result  []FileSummary
}

struct FileSummary {
    name      string
    last_msg  string
    last_hash string
    last_time string
    size      string
}

fn bearer_header() http.Header {
    return http.new_header(key: .authorization, value: 'Bearer ${bearer_token()}')
}

// -- tests --------------------------------------------------------------------

fn test_api_v1_me_requires_auth() {
    resp := http.get(url('/api/v1/me')) or { panic(err) }
    assert resp.status_code == 401
}

fn test_api_v1_me_with_bearer() {
    resp := http.fetch(
        method: .get
        url:    url('/api/v1/me')
        header: bearer_header()
    ) or { panic(err) }
    assert resp.status_code == 200
    user := json.decode(ApiUserSummary, resp.body) or { panic(err) }
    assert user.username == test_username
}

fn test_api_v1_me_with_session_cookie() {
    resp := http.fetch(
        method:  .get
        url:     url('/api/v1/me')
        cookies: {
            'token': session_cookie()
        }
    ) or { panic(err) }
    assert resp.status_code == 200
    user := json.decode(ApiUserSummary, resp.body) or { panic(err) }
    assert user.username == test_username
}

fn test_api_v1_user_lookup() {
    resp := http.get(url('/api/v1/users/${test_username}')) or { panic(err) }
    assert resp.status_code == 200
    user := json.decode(ApiUserSummary, resp.body) or { panic(err) }
    assert user.username == test_username

    missing := http.get(url('/api/v1/users/ghost_user')) or { panic(err) }
    assert missing.status_code == 404
}

fn test_api_v1_user_repos() {
    resp := http.get(url('/api/v1/users/${test_username}/repos')) or { panic(err) }
    assert resp.status_code == 200
    repos := json.decode([]ApiRepoSummary, resp.body) or { panic(err) }
    assert repos.len >= 1
    mut found := false
    for r in repos {
        if r.name == test_repo {
            found = true
            break
        }
    }
    assert found
}

fn test_api_v1_repo_show() {
    resp := http.get(url('/api/v1/repos/${test_username}/${test_repo}')) or { panic(err) }
    assert resp.status_code == 200
    r := json.decode(ApiRepoSummary, resp.body) or { panic(err) }
    assert r.name == test_repo
    assert r.user_name == test_username

    missing := http.get(url('/api/v1/repos/${test_username}/nope')) or { panic(err) }
    assert missing.status_code == 404
}

fn test_api_v1_repo_issues_list_empty() {
    resp := http.get(url('/api/v1/repos/${test_username}/${test_repo}/issues')) or { panic(err) }
    assert resp.status_code == 200
    issues := json.decode([]ApiIssueSummary, resp.body) or { panic(err) }
    assert issues.len == 0
}

fn test_api_v1_create_issue_requires_auth() {
    resp := http.post_form(url('/api/v1/repos/${test_username}/${test_repo}/issues'), {
        'title': 'should-fail'
        'body':  'no token'
    }) or { panic(err) }
    assert resp.status_code == 401
}

fn test_api_v1_create_issue_requires_title() {
    resp := http.fetch(
        method: .post
        url:    url('/api/v1/repos/${test_username}/${test_repo}/issues')
        header: http.new_header_from_map({
            .authorization: 'Bearer ${bearer_token()}'
            .content_type:  'application/x-www-form-urlencoded'
        })
        data:   'body=missing-title'
    ) or { panic(err) }
    assert resp.status_code == 400
}

fn test_api_v1_create_issue_succeeds() {
    resp := http.fetch(
        method: .post
        url:    url('/api/v1/repos/${test_username}/${test_repo}/issues')
        header: http.new_header_from_map({
            .authorization: 'Bearer ${bearer_token()}'
            .content_type:  'application/x-www-form-urlencoded'
        })
        data:   'title=first-issue&body=hello'
    ) or { panic(err) }
    assert resp.status_code == 200
    issue := json.decode(ApiIssueSummary, resp.body) or { panic(err) }
    assert issue.title == 'first-issue'
    assert issue.status == 'open'

    listing := http.get(url('/api/v1/repos/${test_username}/${test_repo}/issues')) or { panic(err) }
    issues := json.decode([]ApiIssueSummary, listing.body) or { panic(err) }
    assert issues.len >= 1

    single := http.get(url('/api/v1/repos/${test_username}/${test_repo}/issues/${issue.id}')) or {
        panic(err)
    }
    assert single.status_code == 200
    got := json.decode(ApiIssueSummary, single.body) or { panic(err) }
    assert got.id == issue.id
}

fn test_api_v1_repo_issue_not_found() {
    resp := http.get(url('/api/v1/repos/${test_username}/${test_repo}/issues/99999')) or {
        panic(err)
    }
    assert resp.status_code == 404
}

fn test_api_v1_repo_pulls_empty() {
    resp := http.get(url('/api/v1/repos/${test_username}/${test_repo}/pulls')) or { panic(err) }
    assert resp.status_code == 200
    prs := json.decode([]ApiPullSummary, resp.body) or { panic(err) }
    assert prs.len == 0
}

fn test_api_v1_repo_pull_not_found() {
    resp := http.get(url('/api/v1/repos/${test_username}/${test_repo}/pulls/1')) or { panic(err) }
    assert resp.status_code == 404
}

fn test_api_v1_pull_comments_not_found() {
    resp := http.get(url('/api/v1/repos/${test_username}/${test_repo}/pulls/1/comments')) or {
        panic(err)
    }
    assert resp.status_code == 404
}

fn test_api_v1_issues_count() {
    resp := http.fetch(
        method:  .get
        url:     url('/api/v1/${test_username}/${test_repo}/issues/count')
        cookies: {
            'token': session_cookie()
        }
    ) or { panic(err) }
    assert resp.status_code == 200
    decoded := json.decode(ApiIssueCount, resp.body) or { panic(err) }
    assert decoded.success
    assert decoded.result >= 1
}

fn test_api_v1_issues_count_unauthenticated() {
    resp := http.get(url('/api/v1/${test_username}/${test_repo}/issues/count')) or { panic(err) }
    assert resp.body.contains('Not found')
}

fn test_api_v1_branches_count() {
    resp := http.fetch(
        method:  .get
        url:     url('/api/v1/${test_username}/${test_repo}/branches/count')
        cookies: {
            'token': session_cookie()
        }
    ) or { panic(err) }
    assert resp.status_code == 200
    decoded := json.decode(ApiBranchCount, resp.body) or { panic(err) }
    assert decoded.success
    assert decoded.result == 0
}

fn test_api_v1_commits_count() {
    resp := http.fetch(
        method:  .get
        url:     url('/api/v1/${test_username}/${test_repo}/main/commits/count')
        cookies: {
            'token': session_cookie()
        }
    ) or { panic(err) }
    assert resp.status_code == 200
    decoded := json.decode(ApiCommitCount, resp.body) or { panic(err) }
    assert decoded.success
    assert decoded.result == 0
}

fn test_api_v1_repo_star_toggle() {
    rid := repo_id()
    resp := http.fetch(
        method:  .post
        url:     url('/api/v1/repos/${rid}/star')
        cookies: {
            'token': session_cookie()
        }
    ) or { panic(err) }
    assert resp.status_code == 200
    first := json.decode(ApiBoolResult, resp.body) or { panic(err) }
    assert first.success
    assert first.result == true

    resp2 := http.fetch(
        method:  .post
        url:     url('/api/v1/repos/${rid}/star')
        cookies: {
            'token': session_cookie()
        }
    ) or { panic(err) }
    second := json.decode(ApiBoolResult, resp2.body) or { panic(err) }
    assert second.result == false
}

fn test_api_v1_repo_watch_toggle() {
    rid := repo_id()
    resp := http.fetch(
        method:  .post
        url:     url('/api/v1/repos/${rid}/watch')
        cookies: {
            'token': session_cookie()
        }
    ) or { panic(err) }
    assert resp.status_code == 200
    first := json.decode(ApiBoolResult, resp.body) or { panic(err) }
    assert first.success
}

fn test_api_v1_repo_tree_files_requires_branch() {
    rid := repo_id()
    resp := http.get(url('/api/v1/repos/${rid}/tree/files')) or { panic(err) }
    assert resp.body.contains('branch is required')
}

fn test_api_v1_repo_tree_files_with_branch() {
    rid := repo_id()
    resp := http.get(url('/api/v1/repos/${rid}/tree/files?branch=main')) or { panic(err) }
    assert resp.status_code == 200
    decoded := json.decode(ApiFilesResult, resp.body) or { panic(err) }
    assert decoded.success
}

fn test_api_v1_repo_tree_files_unknown_repo() {
    resp := http.get(url('/api/v1/repos/9999999/tree/files?branch=main')) or { panic(err) }
    assert resp.body.contains('Not found')
}

fn test_api_v1_users_avatar_requires_auth() {
    resp := http.post_multipart_form(url('/api/v1/users/avatar'),
        files: {
            'file': [
                http.FileData{
                    filename:     'a.png'
                    content_type: 'image/png'
                    data:         'x'
                },
            ]
        }
    ) or { panic(err) }
    assert resp.status_code == 404
}

fn test_api_v1_ci_status_callback() {
    rid := repo_id()
    payload := '{"run_id":"123","repo_id":"${rid}","commit_hash":"deadbeef","branch":"main","status":"running"}'
    resp := http.fetch(
        method: .post
        url:    url('/api/v1/ci/status')
        header: http.new_header(key: .content_type, value: 'application/json')
        data:   payload
    ) or { panic(err) }
    assert resp.status_code == 200
    assert resp.body.contains('"success":true') || resp.body.contains('"success": true')
}

fn test_api_v1_ci_status_callback_rejects_bad_json() {
    resp := http.fetch(
        method: .post
        url:    url('/api/v1/ci/status')
        header: http.new_header(key: .content_type, value: 'application/json')
        data:   'not-json'
    ) or { panic(err) }
    assert resp.body.contains('Invalid request body')
}

fn test_api_v1_private_repo_visibility_from_other_user() {
    // Sanity check: a second authenticated user can see the public test repo.
    resp := http.fetch(
        method:  .get
        url:     url('/api/v1/repos/${test_username}/${test_repo}')
        cookies: {
            'token': other_session_cookie()
        }
    ) or { panic(err) }
    assert resp.status_code == 200
}