package api

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"fmt"
	"net/http"
	"strings"
	"testing"
	"time"

	"github.com/go-acme/lego/v4/acme"
)

const letsEncryptURLHTTP = "http://acme-v02.api.letsencrypt.org/directory"
const letsEncryptURLHTTPS = "https://acme-v02.api.letsencrypt.org/directory"

func changeToHTTP(url *string) {
	if strings.HasPrefix(*url, "https:") {
		*url = "http" + (*url)[len("https"):]
	}
}

func changeToHTTPS(url *string) {
	if strings.HasPrefix(*url, "http:") {
		*url = "https" + (*url)[len("http"):]
	}
}

func TestHTTPURLs(t *testing.T) {
	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Fatalf("error generating a private key: %v", err)
	}

	func() {
		t.Log("testing that Discover enforces https")
		_, err := New(&http.Client{
			Transport: &httpsOnlyRoundTripper{inner: http.DefaultTransport},
			Timeout:   20 * time.Second,
		}, "", letsEncryptURLHTTP, "", privateKey)
		if err != nil {
			t.Errorf("New error: %v", err)
		}
	}()

	core, err := New(&http.Client{
		Transport: &httpsOnlyRoundTripper{inner: http.DefaultTransport},
		Timeout:   20 * time.Second,
	}, "", letsEncryptURLHTTPS, "", privateKey)
	if err != nil {
		t.Fatalf("New error: %v", err)
	}

	func() {
		t.Log("testing that account creation enforces https")

		// Simulate a misconfigured CA that gives out HTTP directory URLs and when
		// we're done change it back to HTTPS to test the rest.
		changeToHTTP(&core.directory.NewAccountURL)
		defer changeToHTTPS(&core.directory.NewAccountURL)

		_, err := core.Accounts.New(acme.Account{
			TermsOfServiceAgreed: true,
			Contact:              []string{},
		})
		if err != nil {
			t.Errorf("core.Accounts.New error: %v", err)
		}
	}()

	_, err = core.Accounts.New(acme.Account{
		TermsOfServiceAgreed: true,
		Contact:              []string{},
	})
	if err != nil {
		t.Fatalf("core.Accounts.New error: %v", err)
	}
}

type httpsOnlyRoundTripper struct {
	inner http.RoundTripper
}

func (r *httpsOnlyRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
	if req.URL.Scheme != "https" {
		return nil, fmt.Errorf("non-https request is being sent")
	}
	return r.inner.RoundTrip(req)
}