package adminapi

import (
	"context"
	"strings"
	"testing"
)

type memSecrets map[string]string

func (m memSecrets) SetClusterSecret(_ context.Context, name, value string) error {
	m[name] = value
	return nil
}

func TestSignInIsShownTriedAndItsSecretsKept(t *testing.T) {
	a, _ := setup(t, testModels())
	kept := memSecrets{}
	var tried string
	a.SetAuth(&AuthAdmin{
		Status: func() AuthView { return AuthView{LDAP: &LDAPView{URLs: []string{"ldaps://dc1"}}} },
		TestLDAP: func(_ context.Context, settings, password string) ([]CheckView, error) {
			tried = settings + "|" + password
			return []CheckView{{Step: "ldaps://dc1", OK: true}, {Step: "people", OK: false, Detail: "no one"}}, nil
		},
		Secrets: kept,
	})
	var v AuthView
	if code := call(t, a, "GET", "/api/v1/auth", "", &v); code != 200 || v.LDAP == nil {
		t.Fatalf("status: %d %+v", code, v)
	}
	// One step failing fails the whole.
	var tv LDAPTestView
	if code := call(t, a, "POST", "/api/v1/auth/ldap/test", `{"settings":"urls: [ldaps://dc1]","password":"pw"}`, &tv); code != 200 ||
		tv.OK || len(tv.Checks) != 2 || tried != "urls: [ldaps://dc1]|pw" {
		t.Errorf("test: %d %+v %q", code, tv, tried)
	}
	var ref map[string]string
	if code := call(t, a, "PUT", "/api/v1/auth/secrets/ldap-bind", `{"value":"s3cret"}`, &ref); code != 200 ||
		kept["auth/ldap-bind"] != "s3cret" || ref["ref"] != "store:auth/ldap-bind" {
		t.Errorf("secret: %d %v %v", code, kept, ref)
	}
	// Only the sign-in secrets, and never an empty one.
	if code := call(t, a, "PUT", "/api/v1/auth/secrets/engine-key", `{"value":"x"}`, nil); code != 404 {
		t.Errorf("another secret: %d", code)
	}
	if code := call(t, a, "PUT", "/api/v1/auth/secrets/ldap-bind", `{"value":"  "}`, nil); code != 400 {
		t.Errorf("an empty secret: %d", code)
	}
	if strings.Contains(kept["auth/ldap-bind"], " ") {
		t.Error("an empty secret replaced the kept one")
	}
}