// Create floating-ip with 2 vmi references, delete it and verify that
// the back_refs are updated as expected.
func TestDeleteRefs(t *testing.T) {
	db := NewInMemDatabase()

	vmi1 := new(types.VirtualMachineInterface)
	vmi1.SetUuid(uuid.New())
	vmi1.SetName("port1")
	assert.NoError(t, db.Put(vmi1, nil, GetReferenceList(vmi1)))

	vmi2 := new(types.VirtualMachineInterface)
	vmi2.SetUuid(uuid.New())
	vmi2.SetName("port2")
	assert.NoError(t, db.Put(vmi2, nil, GetReferenceList(vmi2)))

	fip := new(types.FloatingIp)
	fip.SetUuid(uuid.New())
	fip.SetName("fip")
	fip.AddVirtualMachineInterface(vmi1)
	fip.AddVirtualMachineInterface(vmi2)
	assert.NoError(t, db.Put(fip, nil, GetReferenceList(fip)))

	assert.Error(t, db.Delete(vmi1))

	result, err := db.GetBackReferences(parseUID(vmi2.GetUuid()), "floating_ip")
	assert.NoError(t, err)
	assert.Len(t, result, 1)

	assert.NoError(t, db.Delete(fip))

	result, err = db.GetBackReferences(parseUID(vmi2.GetUuid()), "floating_ip")
	assert.NoError(t, err)
	assert.Len(t, result, 0)

	assert.NoError(t, db.Delete(vmi1))
	assert.NoError(t, db.Delete(vmi2))
}

func TestState_LoadCluster(t *testing.T) {
	t.Parallel()

	testPrefix := "TestState_LoadClusterState"
	testutil.ResetEtcd(t, testPrefix)
	logger := testutil.NewTestLogger(testPrefix, t)

	state, err := NewStateEtcdWithPrefix(testutil.LocalEtcdConfig, testPrefix, logger)
	if err != nil {
		t.Fatalf("Could not create state", err)
	}

	instanceID := structs.ClusterID(uuid.New())
	planID := uuid.New()
	clusterState := structs.ClusterState{
		InstanceID:       instanceID,
		OrganizationGUID: "OrganizationGUID",
		PlanID:           planID,
		ServiceID:        "ServiceID",
		SpaceGUID:        "SpaceGUID",
	}
	err = state.SaveCluster(clusterState)
	if err != nil {
		t.Fatalf("SaveCluster failed %s", err)
	}

	loadedState, err := state.LoadCluster(instanceID)
	if !reflect.DeepEqual(clusterState, loadedState) {
		t.Fatalf("Failed to load ClusterState")
	}
}

func TestUpdateOne(t *testing.T) {
	db := NewInMemDatabase()

	instance := new(types.VirtualMachine)
	instance.SetUuid(uuid.New())
	instance.SetName("instance")
	assert.NoError(t, db.Put(instance, nil, UIDList{}))

	vmi1 := new(types.VirtualMachineInterface)
	vmi1.SetUuid(uuid.New())
	vmi1.SetName("port1")
	assert.NoError(t, db.Put(vmi1, nil, GetReferenceList(vmi1)))

	vmi1.AddVirtualMachine(instance)
	assert.NoError(t, db.Update(vmi1, GetReferenceList(vmi1)))

	result, err := db.GetBackReferences(parseUID(instance.GetUuid()), "virtual_machine_interface")
	assert.NoError(t, err)
	assert.Contains(t, result, parseUID(vmi1.GetUuid()))

	vmi1.ClearVirtualMachine()
	assert.NoError(t, db.Update(vmi1, GetReferenceList(vmi1)))
	result, err = db.GetBackReferences(parseUID(instance.GetUuid()), "virtual_machine_interface")
	assert.NoError(t, err)
	assert.Len(t, result, 0)
}

func TestStoreFailsOnInvalidUserData(t *testing.T) {
	client := &osin.DefaultClient{Id: "3", Secret: "secret", RedirectUri: "http://localhost/", UserData: ""}
	authorize := &osin.AuthorizeData{
		Client:      client,
		Code:        uuid.New(),
		ExpiresIn:   int32(60),
		Scope:       "scope",
		RedirectUri: "http://localhost/",
		State:       "state",
		CreatedAt:   time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC),
		UserData:    struct{ foo string }{"bar"},
	}
	access := &osin.AccessData{
		Client:        client,
		AuthorizeData: authorize,
		AccessData:    nil,
		AccessToken:   uuid.New(),
		RefreshToken:  uuid.New(),
		ExpiresIn:     int32(60),
		Scope:         "scope",
		RedirectUri:   "https://localhost/",
		CreatedAt:     time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC),
		UserData:      struct{ foo string }{"bar"},
	}
	assert.NotNil(t, store.SaveAuthorize(authorize))
	assert.NotNil(t, store.SaveAccess(access))
}

func TestToolDoesNotExist(t *testing.T) {
	// Build the Queue with the SimpleTool timer
	q := Queue{authToken: "ResourceTest"}

	// Add the tool
	st := new(SimpleTimerTooler)
	st.SetUUID(uuid.New())
	q.tools = append(q.tools, st)

	// Create the RPC server and bind the Queue
	listen := startRPCOnce("tcp", addr, &q)
	defer listen.Close()

	// Connect to the RPC server
	client, err := rpc.Dial("tcp", addr)
	if err != nil {
		t.Fatal("Error dailing RPC server.", err)
	}
	defer client.Close()

	// Setup the Job information to start the service
	params := map[string]string{"timer": "1"}
	j := common.NewJob(uuid.New(), "Testing Job", "GoTestSuite", params)

	// Create RPC call for starting a job
	startJob := common.RPCCall{Auth: "ResourceTest", Job: j}

	// Make call and expect an error of bad job
	err = client.Call("Queue.AddTask", startJob, &j)
	if err == nil || err.Error() != ERROR_NO_TOOL {
		t.Fatal("No tool error was not returned.", err)
	}
}

func tryCrypto() {
	pwd := "pwd"
	hash, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
	if err != nil {
		P("bcrypt err: ", err)
	}

	P("first, pwd and hansh: \n", pwd, string(hash), len(string(hash)))
	hash2, _ := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
	P("second, pwd and hash: \n", pwd, string(hash2), len(string(hash2)))

	P("check pwd..")
	P("check hash1: ")
	err = bcrypt.CompareHashAndPassword(hash, []byte(pwd))
	P(err == nil)
	err = bcrypt.CompareHashAndPassword(hash, []byte("pwds"))
	P(err == nil)
	P("check has2:")
	P("hash1 != hash2: ", string(hash) != string(hash2))
	err = bcrypt.CompareHashAndPassword(hash2, []byte(pwd))
	P(err == nil)
	u := uuid.New()
	P("uuid: ", u, len(u), len(uuid.New()), len(uuid.New()))
	unix := time.Now().Unix()
	unixStr := fmt.Sprintf("%d", unix)
	P("time: ", unix, len(unixStr))

}

func TestUpdateUsername(t *testing.T) {
	id := uuid.New()
	_, _ = store.Create(account.CreateAccountRequest{
		ID:       id,
		Username: uuid.New(),
		Password: "secret",
	})

	_, err := store.UpdateUsername(id, account.UpdateUsernameRequest{
		Username: uuid.New(),
		Password: "wrong secret",
	})
	assert.NotNil(t, err)

	r, err := store.UpdateUsername(id, account.UpdateUsernameRequest{
		Username: "[email protected]",
		Password: "secret",
	})
	assert.Nil(t, err)
	assert.Equal(t, "[email protected]", r.GetUsername())

	// Did it persist?
	r, err = store.Get(id)
	assert.Nil(t, err)
	assert.Equal(t, "[email protected]", r.GetUsername())
}

func TestRefreshOperations(t *testing.T) {
	client := &osin.DefaultClient{Id: "4", Secret: "secret", RedirectUri: "http://localhost/", UserData: ""}
	type test struct {
		access *osin.AccessData
	}

	for k, c := range []*test{
		{
			access: &osin.AccessData{
				Client: client,
				AuthorizeData: &osin.AuthorizeData{
					Client:      client,
					Code:        uuid.New(),
					ExpiresIn:   int32(60),
					Scope:       "scope",
					RedirectUri: "http://localhost/",
					State:       "state",
					CreatedAt:   time.Now().Round(time.Second),
					UserData:    userDataMock,
				},
				AccessData:   nil,
				AccessToken:  uuid.New(),
				RefreshToken: uuid.New(),
				ExpiresIn:    int32(60),
				Scope:        "scope",
				RedirectUri:  "https://localhost/",
				CreatedAt:    time.Now().Round(time.Second),
				UserData:     userDataMock,
			},
		},
	} {
		createClient(t, store, client)
		require.Nil(t, store.SaveAuthorize(c.access.AuthorizeData), "Case %d", k)
		require.Nil(t, store.SaveAccess(c.access), "Case %d", k)

		result, err := store.LoadRefresh(c.access.RefreshToken)
		require.Nil(t, err)
		require.Equal(t, c.access.CreatedAt.Unix(), result.CreatedAt.Unix())
		require.Equal(t, c.access.AuthorizeData.CreatedAt.Unix(), result.AuthorizeData.CreatedAt.Unix())
		c.access.CreatedAt = result.CreatedAt
		c.access.AuthorizeData.CreatedAt = result.AuthorizeData.CreatedAt
		require.Equal(t, c.access, result, "Case %d", k)

		require.Nil(t, store.RemoveRefresh(c.access.RefreshToken))
		_, err = store.LoadRefresh(c.access.RefreshToken)

		require.NotNil(t, err, "Case %d", k)
		require.Nil(t, store.RemoveAccess(c.access.AccessToken), "Case %d", k)
		require.Nil(t, store.SaveAccess(c.access), "Case %d", k)

		_, err = store.LoadRefresh(c.access.RefreshToken)
		require.Nil(t, err, "Case %d", k)

		require.Nil(t, store.RemoveAccess(c.access.AccessToken), "Case %d", k)
		_, err = store.LoadRefresh(c.access.RefreshToken)
		require.NotNil(t, err, "Case %d", k)

	}
	removeClient(t, store, client)
}

func TestCreateAndGetCases(t *testing.T) {
	var stateDataSet = map[string]storage.StateData{
		"valid": {
			ID:          uuid.New(),
			ClientID:    uuid.New(),
			RedirectURL: "http://localhost/",
			Scope:       "scope",
			State:       "state",
			Type:        "code",
			Provider:    "facebook",
			ExpiresAt:   time.Now().Add(time.Hour),
		},
		"invalid": {},
	}

	for k, c := range []struct {
		sd         storage.StateData
		passCreate bool
		passGet    bool
	}{
		{stateDataSet["valid"], true, true},
	} {
		assert.Equal(t, c.passCreate, store.SaveStateData(&c.sd) == nil, "Case %d", k)
		if !c.passCreate {
			continue
		}

		result, err := store.GetStateData(c.sd.ID)
		assert.Nil(t, err, "Case %d", k)

		assert.Equal(t, c.sd.IsExpired(), result.IsExpired(), "Case %d", k)
		c.sd.ExpiresAt = result.ExpiresAt
		assert.Equal(t, &c.sd, result, "Case %d", k)
	}
}

func TestState_ClusterExists(t *testing.T) {
	t.Parallel()

	testPrefix := "TestState_ClusterExists"
	testutil.ResetEtcd(t, testPrefix)
	logger := testutil.NewTestLogger(testPrefix, t)

	state, err := NewStateEtcdWithPrefix(testutil.LocalEtcdConfig, testPrefix, logger)
	if err != nil {
		t.Fatalf("Could not create state", err)
	}

	clusterID := structs.ClusterID(uuid.New())
	planID := uuid.New()
	clusterState := structs.ClusterState{
		InstanceID:       clusterID,
		OrganizationGUID: "OrganizationGUID",
		PlanID:           planID,
		ServiceID:        "ServiceID",
		SpaceGUID:        "SpaceGUID",
	}
	err = state.SaveCluster(clusterState)
	if err != nil {
		t.Fatalf("SaveCluster failed %s", err)
	}

	if !state.ClusterExists(clusterID) {
		t.Fatalf("Cluster %s should exist", clusterID)
	}

	if state.ClusterExists("fakeID") {
		t.Fatalf("Cluster %s should not exist", "fakeID")
	}
}

func (s *RequestTestSuite) TestValidate() {
	rh, _ := url.ParseRequestURI("unix:///tmp")

	tests := []struct {
		description  string
		id           string
		task         string
		responseHook *url.URL
		expectedErr  bool
	}{
		{"missing ID", "", "foo", rh, true},
		{"missing Task", uuid.New(), "", rh, true},
		{"missing ResponseHook", uuid.New(), "foo", nil, true},
		{"valid", uuid.New(), "foo", rh, false},
	}

	for _, test := range tests {
		msg := testMsgFunc(test.description)
		req := &acomm.Request{
			ID:           test.id,
			Task:         test.task,
			ResponseHook: test.responseHook,
		}
		if test.expectedErr {
			s.Error(req.Validate(), msg("should not be valid"))
		} else {
			s.NoError(req.Validate(), msg("should be valid"))
		}
	}
}

func TestUpdatePassword(t *testing.T) {
	id := uuid.New()
	ac, _ := store.Create(account.CreateAccountRequest{
		ID:       id,
		Username: uuid.New(),
		Password: "secret",
	})

	_, err := store.UpdatePassword(id, account.UpdatePasswordRequest{
		CurrentPassword: "wrong old secret",
		NewPassword:     "new secret",
	})
	assert.NotNil(t, err)

	updatedAccount, err := store.UpdatePassword(id, account.UpdatePasswordRequest{
		CurrentPassword: "secret",
		NewPassword:     "new secret",
	})
	assert.Nil(t, err)

	resultAccount, err := store.Get(id)
	assert.Nil(t, err)

	assert.Equal(t, updatedAccount.GetPassword(), resultAccount.GetPassword())
	assert.NotEqual(t, ac.GetPassword(), resultAccount.GetPassword())
}

func TestAcquireExistsWait(t *testing.T) {
	t.Parallel()

	key := "lock-TestAcquireExistsWait"
	id1 := uuid.New()
	id2 := uuid.New()
	ttl := uint64(2)
	c := newClient(t)
	defer cleanup(c, key)

	_, err := Acquire(c, key, id1, ttl, false)
	if err != nil {
		t.Fatal(err)
	}

	tstart := time.Now().Unix()
	_, err = Acquire(c, key, id2, ttl, true)
	if err != nil {
		t.Fatal(err)
	}
	tstop := time.Now().Unix()
	if uint64(tstop-tstart) < ttl-1 {
		t.Fatalf("expected atleast %ds(ttl-1)  wait time, got: %d\n", ttl-1, tstop-tstart)
	}

	resp, err := c.Get(key, false, false)
	if err != nil {
		t.Fatal(err)
	}
	if resp.Node.Value != id2 {
		t.Fatalf("incorrect data in lock, wanted: %s, got: %s\n", id2, resp.Node.Value)
	}
}

func TestTLSGen(t *testing.T) {
	priv := filepath.Join(tmpDir, uuid.New())
	pub := filepath.Join(tmpDir, uuid.New())
	os.Args = []string{"hydra-host", "tls", "generate-dummy-certificate", "-c", priv, "-k", pub, "-u", "localhost", "--sd", "Jan 1 15:04:05 2011", "-d", "8760h0m0s", "--ca", "--rb", "4069", "--ec", "P521"}
	assert.Nil(t, NewApp().Run(os.Args))
	assertAndRemoveFile(t, priv)
	assertAndRemoveFile(t, pub)
}

func TestJWTGen(t *testing.T) {
	priv := filepath.Join(tmpDir, uuid.New())
	pub := filepath.Join(tmpDir, uuid.New())
	os.Args = []string{"hydra-host", "jwt", "generate-keypair", "-s", priv, "-p", pub}
	assert.Nil(t, NewApp().Run(os.Args))
	assertAndRemoveFile(t, priv)
	assertAndRemoveFile(t, pub)
}

func (h *Handler) TokenHandler(w http.ResponseWriter, r *http.Request) {
	resp := h.server.NewResponse()
	r.ParseForm()
	defer resp.Close()
	if ar := h.server.HandleAccessRequest(resp, r); ar != nil {
		switch ar.Type {
		case osin.AUTHORIZATION_CODE:
			data, ok := ar.UserData.(string)
			if !ok {
				http.Error(w, fmt.Sprintf("Could not assert UserData to string: %v", ar.UserData), http.StatusInternalServerError)
				return
			}

			var claims jwt.ClaimsCarrier
			if err := json.Unmarshal([]byte(data), &claims); err != nil {
				http.Error(w, fmt.Sprintf("Could not unmarshal UserData: %v", ar.UserData), http.StatusInternalServerError)
				return
			}

			ar.UserData = jwt.NewClaimsCarrier(uuid.New(), claims.GetSubject(), h.Issuer, h.Audience, time.Now(), time.Now())
			ar.Authorized = true
		case osin.REFRESH_TOKEN:
			data, ok := ar.UserData.(map[string]interface{})
			if !ok {
				http.Error(w, fmt.Sprintf("Could not assert UserData type: %v", ar.UserData), http.StatusInternalServerError)
				return
			}
			claims := jwt.ClaimsCarrier(data)
			ar.UserData = jwt.NewClaimsCarrier(uuid.New(), claims.GetSubject(), h.Issuer, h.Audience, time.Now(), time.Now())
			ar.Authorized = true
		case osin.PASSWORD:
			// TODO if !ar.Client.isAllowedToAuthenticateUser
			// TODO ... return
			// TODO }

			if user, err := h.authenticate(w, r, ar.Username, ar.Password); err == nil {
				ar.UserData = jwt.NewClaimsCarrier(uuid.New(), user.GetID(), h.Issuer, h.Audience, time.Now(), time.Now())
				ar.Authorized = true
			}
		case osin.CLIENT_CREDENTIALS:
			ar.UserData = jwt.NewClaimsCarrier(uuid.New(), ar.Client.GetId(), h.Issuer, h.Audience, time.Now(), time.Now())
			ar.Authorized = true

			// TODO ASSERTION workflow http://leastprivilege.com/2013/12/23/advanced-oauth2-assertion-flow-why/
			// TODO Since assertions are only a draft for now and there is no need for SAML or similar this is postponed.
			//case osin.ASSERTION:
			//	if ar.AssertionType == "urn:hydra" && ar.Assertion == "osin.data" {
			//		ar.Authorized = true
			//	}
		}

		h.server.FinishAccessRequest(resp, r, ar)
	}
	if resp.IsError {
		resp.StatusCode = http.StatusUnauthorized
	}
	osin.OutputJSON(resp, w, r)
}

func SessionGet(app *forest.App, manager SessionManager) func(ctx *bear.Context) {
	return func(ctx *bear.Context) {
		cookieName := forest.SessionID
		createEmptySession := func(sessionID string) {
			path := app.Config.CookiePath
			if path == "" {
				path = "/"
			}
			cookieValue := sessionID
			duration := app.Duration("Cookie")
			// Reset the cookie.
			app.SetCookie(ctx, path, cookieName, cookieValue, duration)
			manager.CreateEmpty(sessionID, ctx)
			ctx.Next()
		}
		cookie, err := ctx.Request.Cookie(cookieName)
		if err != nil || cookie.Value == "" {
			createEmptySession(uuid.New())
			return
		}
		sessionID := cookie.Value
		userID, userJSON, err := manager.Read(sessionID)
		if err != nil || userID == "" || userJSON == "" {
			createEmptySession(uuid.New())
			return
		}
		if err := manager.Create(sessionID, userID, userJSON, ctx); err != nil {
			println(fmt.Sprintf("error creating session: %s", err))
			defer func(sessionID string, userID string) {
				if err := manager.Delete(sessionID, userID); err != nil {
					println(fmt.Sprintf("error deleting session: %s", err))
				}
			}(sessionID, userID)
			createEmptySession(uuid.New())
			return
		}
		// If SessionRefresh is set to false, the session will not refresh;
		// if it's not set or if it's set to true, the session is refreshed.
		refresh, ok := ctx.Get(forest.SessionRefresh).(bool)
		if !ok || refresh {
			path := app.Config.CookiePath
			if path == "" {
				path = "/"
			}
			cookieName := forest.SessionID
			cookieValue := sessionID
			duration := app.Duration("Cookie")
			// Refresh the cookie.
			app.SetCookie(ctx, path, cookieName, cookieValue, duration)
			err := manager.Update(sessionID, userID,
				userJSON, app.Duration("Session"))
			if err != nil {
				println(fmt.Sprintf("error updating session: %s", err))
			}
		}
		ctx.Next()
	}
}

func TestAccessOperations(t *testing.T) {
	client := &osin.DefaultClient{Id: "3", Secret: "secret", RedirectUri: "http://localhost/", UserData: ""}
	authorize := &osin.AuthorizeData{
		Client:      client,
		Code:        uuid.New(),
		ExpiresIn:   int32(60),
		Scope:       "scope",
		RedirectUri: "http://localhost/",
		State:       "state",
		// FIXME this should be time.Now(), but an upstream ( https://github.com/lib/pq/issues/329 ) issue prevents this.
		CreatedAt: time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC),
		UserData:  userDataMock,
	}
	nestedAccess := &osin.AccessData{
		Client:        client,
		AuthorizeData: authorize,
		AccessData:    nil,
		AccessToken:   uuid.New(),
		RefreshToken:  uuid.New(),
		ExpiresIn:     int32(60),
		Scope:         "scope",
		RedirectUri:   "https://localhost/",
		// FIXME this should be time.Now(), but an upstream ( https://github.com/lib/pq/issues/329 ) issue prevents this.
		CreatedAt: time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC),
		UserData:  userDataMock,
	}
	access := &osin.AccessData{
		Client:        client,
		AuthorizeData: authorize,
		AccessData:    nestedAccess,
		AccessToken:   uuid.New(),
		RefreshToken:  uuid.New(),
		ExpiresIn:     int32(60),
		Scope:         "scope",
		RedirectUri:   "https://localhost/",
		// FIXME this should be time.Now(), but an upstream ( https://github.com/lib/pq/issues/329 ) issue prevents this.
		CreatedAt: time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC),
		UserData:  userDataMock,
	}

	createClient(t, store, client)
	require.Nil(t, store.SaveAuthorize(authorize))
	require.Nil(t, store.SaveAccess(nestedAccess))
	require.Nil(t, store.SaveAccess(access))

	result, err := store.LoadAccess(access.AccessToken)
	require.Nil(t, err)
	require.True(t, reflect.DeepEqual(access, result))

	require.Nil(t, store.RemoveAccess(access.AccessToken))
	_, err = store.LoadAccess(access.AccessToken)
	require.NotNil(t, err)
	require.Nil(t, store.RemoveAuthorize(authorize.Code))

	removeClient(t, store, client)
}

// TestExec tests the exec.go source file
func TestExec(t *testing.T) {
	_, err := Exec(uuid.New(), "touch", uuid.New())
	assert.Error(t, err, "Exec should not be able to run in a not existing directory")

	o, err := Exec("/tmp", "echo", "test")
	assert.Nil(t, err, "Could not exec echo")
	assert.Equal(t, "test\n", string(o), "Could not exec echo")

	_, err = Exec("/tmp", uuid.New())
	assert.Error(t, err, "An invalid command should return an error")
}

func TestDelete(t *testing.T) {
	id := uuid.New()
	_, _ = store.Create(account.CreateAccountRequest{
		ID:       id,
		Username: uuid.New(),
		Password: "secret",
	})

	_, err := store.Get(id)
	assert.Nil(t, err)
	assert.Nil(t, store.Delete(id))
	_, err = store.Get(id)
	assert.NotNil(t, err)
}