package main

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

// #34: the unlock cookie must be bound to the paste it unlocks, not a
// forgeable static value. A forged 'pw_<id>=1' cookie must not bypass the
// password check on the paste page.
func TestForgedUnlockCookieDoesNotBypassPassword(t *testing.T) {
	globalLimiter = newLimiter()
	s := testServer(t)
	h := s.routes()

	rec := httptest.NewRecorder()
	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"SECRETPASTECONTENT","password":"hunter2"}`))
	h.ServeHTTP(rec, req)
	if rec.Code != 201 {
		t.Fatalf("create: got %d", rec.Code)
	}
	var created struct {
		ID string `json:"id"`
	}
	json.Unmarshal(rec.Body.Bytes(), &created)
	id := created.ID

	// request the page with a forged unlock cookie in the old format
	rec = httptest.NewRecorder()
	req = httptest.NewRequest("GET", "/"+id, nil)
	req.AddCookie(&http.Cookie{Name: "pw_" + id, Value: "1"})
	h.ServeHTTP(rec, req)
	if rec.Code == 200 && strings.Contains(rec.Body.String(), "SECRETPASTECONTENT") {
		t.Fatal("forged pw_<id>=1 cookie bypassed password protection")
	}
	if rec.Code != 200 {
		t.Logf("forged-cookie request returned %d (page still locked) — good", rec.Code)
	}
}