/*
 * Copyright 2021 - 2023 Sporta Technologies PVT LTD & the ZIO HTTP contributors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package zio.http.headers

import java.net.URI
import java.util.Base64

import zio.Scope
import zio.test._

import zio.http.Header.Authorization
import zio.http.Header.Authorization.{Basic, Digest}
import zio.http.ZIOHttpSpec

object AuthorizationSpec extends ZIOHttpSpec {
  private def encodeCredentials(username: String, password: String): String =
    Base64.getEncoder.encodeToString(s"$username:$password".getBytes)

  override def spec: Spec[TestEnvironment with Scope, Any] =
    suite("Authorization header suite")(
      test("parsing of invalid Authorization values") {
        assertTrue(
          Authorization.parse("").isLeft,
          Authorization.parse("something").isRight,
        )
      },
      test("parsing and encoding is symmetrical") {
        val value =
          Digest(
            "ae66e67d6b427bd3f120414a82e4acff38e8ecd9101d6c861229025f607a79dd",
            "488869477bf257147b804c45308cd62ac4e25eb717b12b298c79e62dcea254ec",
            "api@example.org",
            URI.create("/doe.json"),
            "HRPCssKJSGjCrkzDg8OhwpzCiGPChXYjwrI2QmXDnsOS",
            "SHA-512-256",
            "auth",
            "NTg6RKcb9boFIAS3KrFK9BGeh+iDa/sm6jUMp2wds69v",
            "7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v",
            1,
            userhash = true,
          )

        assertTrue(Authorization.parse(Authorization.render(value)) == Right(value))
      },
      test("parsing of Authorization header values") {
        val values = Map(
          """Digest username="Mufasa", realm="http-auth@example.org", uri="/dir/index.html", algorithm=SHA-256, """ +
            """nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v", nc=00000001, cnonce="f2/wE4q74E6zIJEtWaHKaf5wv/H5QzzpXusqGemxURZJ", """ +
            """qop=auth, response="753927fa0e85d155564e2e272a28d1802ca10daf4496794697cf8db5856cb6c1", """ +
            """opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS""""                -> Some(
              Digest(
                "753927fa0e85d155564e2e272a28d1802ca10daf4496794697cf8db5856cb6c1",
                "Mufasa",
                "http-auth@example.org",
                URI.create("/dir/index.html"),
                "FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS",
                "SHA-256",
                "auth",
                "f2/wE4q74E6zIJEtWaHKaf5wv/H5QzzpXusqGemxURZJ",
                "7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v",
                1,
                userhash = false,
              ),
            ),
          """Digest username*="Mufasa", realm="http-auth@example.org", uri="/dir/index.html", algorithm=SHA-256, """ +
            """nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v", nc=00000001, cnonce="f2/wE4q74E6zIJEtWaHKaf5wv/H5QzzpXusqGemxURZJ", """ +
            """qop=auth, response="753927fa0e85d155564e2e272a28d1802ca10daf4496794697cf8db5856cb6c1", """ +
            """opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS",userhash=false""" -> Some(
              Digest(
                "753927fa0e85d155564e2e272a28d1802ca10daf4496794697cf8db5856cb6c1",
                "Mufasa",
                "http-auth@example.org",
                URI.create("/dir/index.html"),
                "FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS",
                "SHA-256",
                "auth",
                "f2/wE4q74E6zIJEtWaHKaf5wv/H5QzzpXusqGemxURZJ",
                "7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v",
                1,
                userhash = false,
              ),
            ),
          """Digest username="test",username*="test2", realm="http-auth@example.org", uri="/dir/index.html", algorithm=SHA-256, """ +
            """nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v", nc=00000001, cnonce="f2/wE4q74E6zIJEtWaHKaf5wv/H5QzzpXusqGemxURZJ", """ +
            """qop=auth, response="753927fa0e85d155564e2e272a28d1802ca10daf4496794697cf8db5856cb6c1", """ +
            """opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS",userhash=false""" -> None,
        )
        values.foldLeft(assertTrue(true)) { case (acc, (header, expected)) =>
          acc && assertTrue(Authorization.parse(header).toOption == expected)
        }
      },
      test("Parsing an invalid basic auth header") {
        val auth = Authorization.parse("Basic not-base64")
        assertTrue(auth.isLeft)
      },
      test("should parse valid Basic Authorization header") {
        val encodedHeader = encodeCredentials("user", "pass")
        val result        = Authorization.parse(s"Basic $encodedHeader")
        assertTrue(result.isRight) && assertTrue(result.toOption.get == Basic("user", "pass"))
      },
      test("should parse header with multiple colons in password") {
        val encodedHeader = encodeCredentials("user", "pass:with:colon")
        val result        = Authorization.parse(s"Basic $encodedHeader")
        assertTrue(result.isRight) && assertTrue(result.toOption.get == Basic("user", "pass:with:colon"))
      },
    )
}
