local helpers = require "spec.helpers"

-- using the full path so that we don't have to modify package.path in
-- this context
local test_vault = require "spec.fixtures.custom_vaults.kong.vaults.test"

local CUSTOM_VAULTS = "./spec/fixtures/custom_vaults"
local CUSTOM_PLUGINS = "./spec/fixtures/custom_plugins"

local LUA_PATH = CUSTOM_VAULTS .. "/?.lua;" ..
                 CUSTOM_VAULTS .. "/?/init.lua;" ..
                 CUSTOM_PLUGINS .. "/?.lua;" ..
                 CUSTOM_PLUGINS .. "/?/init.lua;;"

local DUMMY_HEADER = "Dummy-Plugin"
local fmt = string.format

local json = require "cjson"



--- A vault test harness is a driver for vault backends, which implements
--- all the necessary glue for initializing a vault backend and performing
--- secret read/write operations.
---
--- All functions defined here are called as "methods" (e.g. harness:fn()), so
--- it is permitted to keep state on the harness object (self).
---
---@class vault_test_harness
---
---@field name string
---
--- this table is passed directly to kong.db.vaults:insert()
---@field config table
---
--- create_secret() is called once per test run for a given secret
---@field create_secret fun(self: vault_test_harness, secret: string, value: string, opts?: table)
---
--- update_secret() may be called more than once per test run for a given secret
---@field update_secret fun(self: vault_test_harness, secret: string, value: string, opts?: table)
---
--- setup() is called before kong is started and before any DB entities
--- have been created and is best used for things like validating backend
--- credentials and establishing a connection to a backend
---@field setup fun(self: vault_test_harness)
---
--- teardown() is exactly what you'd expect
---@field teardown fun(self: vault_test_harness)
---
--- fixtures() output is passed directly to `helpers.start_kong()`
---@field fixtures fun(self: vault_test_harness):table|nil
---
--- pause() is exactly what you'd expect
---@field pause fun(self: vault_test_harness)
---
---
---@field prefix   string   # generated by the test suite
---@field host     string   # generated by the test suite


---@type vault_test_harness[]
local VAULTS = {
  {
    name = "test",

    config = {
      default_value = "DEFAULT",
      default_value_ttl = 1,
    },

    create_secret = function(self, _, value)
      -- Currently, create_secret is called _before_ starting Kong.
      --
      -- This means our backend won't be available yet because it is
      -- piggy-backing on Kong as an HTTP mock fixture.
      --
      -- We can, however, inject a default value into our configuration.
      self.config.default_value = value
    end,

    update_secret = function(_, secret, value, opts)
      return test_vault.client.put(secret, value, opts)
    end,

    delete_secret = function(_, secret)
      return test_vault.client.delete(secret)
    end,

    fixtures = function()
      return {
        http_mock = {
          test_vault = test_vault.http_mock,
        }
      }
    end,

    pause = function(_)
      return test_vault.client.pause()
    end,
  },
}


local noop = function(...) end

for _, vault in ipairs(VAULTS) do
  -- fill out some values that we'll use in route/service/plugin config
  vault.prefix     = vault.name .. "-ttl-test"
  vault.host       = vault.name .. ".vault-ttl.test"

  -- ...and fill out non-required methods
  vault.setup      = vault.setup or noop
  vault.teardown   = vault.teardown or noop
  vault.fixtures   = vault.fixtures or noop
  vault.pause      = vault.pause or noop
end


for _, strategy in helpers.each_strategy() do
for _, vault in ipairs(VAULTS) do


describe("vault resurrect_ttl and rotation (#" .. strategy .. ") #" .. vault.name, function()
  local client
  local secret = "my-secret"


  local function http_get(path)
    path = path or "/"

    local res = client:get(path, {
      headers = {
        host = assert(vault.host),
      },
    })

    assert.response(res).has.status(200)

    return res
  end


  lazy_setup(function()
    helpers.setenv("KONG_LUA_PATH_OVERRIDE", LUA_PATH)
    helpers.setenv("KONG_VAULT_ROTATION_INTERVAL", "1")

    vault:setup()
    vault:create_secret(secret, "init")

    local bp = helpers.get_db_utils(strategy,
            { "vaults", "routes", "services", "plugins" },
            { "dummy" },
            { vault.name })


    assert(bp.vaults:insert({
      name     = vault.name,
      prefix   = vault.prefix,
      config   = vault.config,
    }))

    local route = assert(bp.routes:insert({
      name      = vault.host,
      hosts     = { vault.host },
      paths     = { "/" },
      service   = assert(bp.services:insert()),
    }))


    -- used by the plugin config test case
    assert(bp.plugins:insert({
      name = "dummy",
      config = {
        resp_header_value = fmt("{vault://%s/%s?ttl=%d&resurrect_ttl=%d}",
                                vault.prefix, secret, 2, 2),
      },
      route = { id = route.id },
    }))

    assert(helpers.start_kong({
      database       = strategy,
      nginx_conf     = "spec/fixtures/custom_nginx.template",
      vaults         = vault.name,
      plugins        = "dummy",
      log_level      = "info",
    }, nil, nil, vault:fixtures() ))

    client = helpers.proxy_client()
  end)


  lazy_teardown(function()
    if client then
      client:close()
    end

    helpers.stop_kong()
    vault:teardown()

    helpers.unsetenv("KONG_LUA_PATH_OVERRIDE")
  end)


  it("resurrects plugin config references when secret is deleted (backend: #" .. vault.name .. ")", function()
    local function check_plugin_secret(expect, ttl, leeway)
    leeway = leeway or 0.25 -- 25%

    local timeout = ttl + (ttl * leeway)

    assert
            .with_timeout(timeout)
            .with_step(0.5)
            .eventually(function()
      local res = http_get("/")
      local value
      if expect == "" then
        value = res.headers[DUMMY_HEADER] or ""
        if value == "" then
          return true
        end

      else
        value = assert.response(res).has.header(DUMMY_HEADER)
        if value == expect then
          return true
        end
      end

      return nil, { expected = expect, got = value }
    end)
    .is_truthy("expected plugin secret to be updated to '" .. tostring(expect) .. "' "
            .. "within " .. tostring(timeout) .. " seconds")
  end

    vault:update_secret(secret, "old", { ttl = 2, resurrect_ttl = 2 })
    check_plugin_secret("old", 5)
    vault:delete_secret(secret)
    ngx.sleep(2.5)
    check_plugin_secret("old", 5)
    check_plugin_secret("", 5)
  end)
end)


describe("#multiworker vault resurrect_ttl and rotation (#" .. strategy .. ") #" .. vault.name, function()
  local client, admin_client
  local secret = "my-secret"

  lazy_setup(function()
    helpers.setenv("KONG_LUA_PATH_OVERRIDE", LUA_PATH)
    helpers.setenv("KONG_VAULT_ROTATION_INTERVAL", "1")

    vault:setup()
    vault:create_secret(secret, "init")

    local bp = helpers.get_db_utils(strategy,
            { "vaults", "routes", "services", "plugins" },
            { "dummy" },
            { vault.name })


    assert(bp.vaults:insert({
      name     = vault.name,
      prefix   = vault.prefix,
      config   = vault.config,
    }))

    local route = assert(bp.routes:insert({
      name      = vault.host,
      hosts     = { vault.host },
      paths     = { "/" },
      service   = assert(bp.services:insert()),
    }))


    assert(bp.plugins:insert({
      name = "post-function",
      config = {
        access = {fmt([[
        local value, err = kong.vault.get("{vault://%s/%s?ttl=%d&resurrect_ttl=%d}")
        if value then
          kong.response.exit(200, {["value"]=value, ["pid"]=ngx.worker.pid()}, {["Content-Type"]="application/json"})
        end
        ]], vault.prefix, secret, 2, 5),}
      },
      route = { id = route.id },
    }))

    assert(helpers.start_kong({
      database       = strategy,
      nginx_conf     = "spec/fixtures/custom_nginx.template",
      vaults         = vault.name,
      plugins        = "post-function",
      log_level      = "debug",
      dedicated_config_processing = false,
      -- nginx_worker_processes = 2,
      nginx_main_worker_processes = 2,
    }, nil, nil, vault:fixtures() ))

    client = helpers.proxy_client()
    admin_client = helpers.admin_client()
  end)


  lazy_teardown(function()
    if client then
      client:close()
    end

    if admin_client then
      admin_client:close()
    end

    helpers.stop_kong()
    vault:teardown()

    helpers.unsetenv("KONG_LUA_PATH_OVERRIDE")
  end)


  it("resurrects secret value from shared dict when secret is deleted (backend: #" .. vault.name .. ")", function()
    -- fetch all worker pids
    local status_ret = admin_client:get("/")
    local body = assert.res_status(200, status_ret)
    local json_body = json.decode(body)
    assert.truthy(json_body)
    local worker_pids = json_body.pids.workers
    assert.truthy(#worker_pids == 2)

    local worker_secret_hits = {}
    for _, worker_pid in ipairs(worker_pids) do
      worker_secret_hits[tostring(worker_pid)] = false
    end

    vault:update_secret(secret, "old", { ttl = 2, resurrect_ttl = 5 })

    -- trigger post-function in one of the workers
    local res = client:get("/", {headers = {host = assert(vault.host)}})
    local body = assert.res_status(200, res)
    local json_body = json.decode(body)
    assert.same("old", json_body.value)
    worker_secret_hits[tostring(json_body.pid)] = true

    vault:pause()

    -- let ttl pass and try to trigger post-function in all workers
    -- check all of them can resurrect the secret from shared dict
    ngx.sleep(3)

    assert.with_timeout(5).with_step(0.1).eventually(
      function()
        -- avoid connection reuse so that we can hit all workers
        local new_client = helpers.proxy_client()
        local res = new_client:get("/", {headers = {host = assert(vault.host)}})
        local body = assert.res_status(200, res)
        local json_body = json.decode(body)
        new_client:close()
        assert.same("old", json_body.value)
        worker_secret_hits[tostring(json_body.pid)] = true

        for k, v in pairs(worker_secret_hits) do
          if not v then
            return false, "worker pid " .. k .. " did not hit the secret"
          end
        end

        return true
      end
    ).is_truthy("expected all workers to resurrect the secret from shared dict")
  end)
end)


end -- each vault backend
end -- each strategy