package api

// #143: create responses must set the short-lived tok_<id> HttpOnly cookie
// that the paste view reads for the one-time created banner.

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestCreateSetsDeletionTokenCookie(t *testing.T) {
	s := testServer(t)
	h := s.routes()

	// JSON create
	body := `{"content":"hello #143 cookie"}`
	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != 201 {
		t.Fatalf("json create: got %d", rec.Code)
	}
	found := false
	for _, c := range rec.Result().Cookies() {
		if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
			found = true
			if !c.HttpOnly {
				t.Error("tok_ cookie not HttpOnly")
			}
			if c.MaxAge != 60 {
				t.Errorf("tok_ cookie MaxAge = %d, want 60", c.MaxAge)
			}
		}
	}
	if !found {
		t.Error("json create did not set tok_<id> cookie (#143)")
	}

	// multipart create
	var buf strings.Builder
	boundary := "----qa143"
	buf.WriteString("--" + boundary + "\r\n")
	buf.WriteString("Content-Disposition: form-data; name=\"content\"\r\n\r\n")
	buf.WriteString("multipart #143\r\n")
	buf.WriteString("--" + boundary + "--\r\n")
	req2 := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(buf.String()))
	req2.Header.Set("Content-Type", "multipart/form-data; boundary="+boundary)
	rec2 := httptest.NewRecorder()
	h.ServeHTTP(rec2, req2)
	if rec2.Code != 201 {
		t.Fatalf("multipart create: got %d body=%s", rec2.Code, rec2.Body.String())
	}
	found = false
	for _, c := range rec2.Result().Cookies() {
		if strings.HasPrefix(c.Name, "tok_") && c.Value != "" {
			found = true
		}
	}
	if !found {
		t.Error("multipart create did not set tok_<id> cookie (#143)")
	}
}

func TestCreatedBannerViaCookie(t *testing.T) {
	s := testServer(t)
	h := s.routes()
	body := `{"content":"banner flow #143"}`
	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != 201 {
		t.Fatalf("create: got %d", rec.Code)
	}
	var id, tok string
	for _, c := range rec.Result().Cookies() {
		if strings.HasPrefix(c.Name, "tok_") {
			id = strings.TrimPrefix(c.Name, "tok_")
			tok = c.Value
		}
	}
	if id == "" || tok == "" {
		t.Fatal("no tok_ cookie from create")
	}
	// follow the redirect the browser would make: GET /<id>?created=1 with the cookie
	req2 := httptest.NewRequest("GET", "/"+id+"?created=1", nil)
	req2.AddCookie(&http.Cookie{Name: "tok_" + id, Value: tok})
	rec2 := httptest.NewRecorder()
	h.ServeHTTP(rec2, req2)
	if rec2.Code != 200 {
		t.Fatalf("paste view: got %d", rec2.Code)
	}
	if !strings.Contains(rec2.Body.String(), tok) {
		t.Error("created banner does not show the deletion token (#143 cookie flow broken)")
	}
}