// Package server 提供 pprof 性能分析端点功能的测试。
//
// 该文件测试 pprof 处理器模块的各项功能，包括：
//   - pprof 处理器创建
//   - 配置解析和默认值
//   - IP/CIDR 白名单验证
//   - 路径返回
//   - ServeHTTP 路径分发
//   - 访问控制逻辑
//   - HTML 索引页面生成
//
// 作者：xfy
package server

import (
	"bytes"
	"net"
	"strings"
	"testing"

	"github.com/valyala/fasthttp"
	"rua.plus/lolly/internal/config"
)

func TestNewPprofHandler_Disabled(t *testing.T) {
	cfg := &config.PprofConfig{
		Enabled: false,
	}

	h, err := NewPprofHandler(cfg)
	if err != nil {
		t.Errorf("unexpected error: %v", err)
	}
	if h != nil {
		t.Error("expected nil handler when disabled")
	}
}

func TestNewPprofHandler_DefaultPath(t *testing.T) {
	cfg := &config.PprofConfig{
		Enabled: true,
		Path:    "",
	}

	h, err := NewPprofHandler(cfg)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if h == nil {
		t.Fatal("expected non-nil handler")
	}

	if h.Path() != "/debug/pprof" {
		t.Errorf("expected default path /debug/pprof, got %s", h.Path())
	}
}

func TestNewPprofHandler_CustomPath(t *testing.T) {
	cfg := &config.PprofConfig{
		Enabled: true,
		Path:    "/custom/pprof",
	}

	h, err := NewPprofHandler(cfg)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if h == nil {
		t.Fatal("expected non-nil handler")
	}

	if h.Path() != "/custom/pprof" {
		t.Errorf("expected custom path /custom/pprof, got %s", h.Path())
	}
}

func TestNewPprofHandler_SingleIP(t *testing.T) {
	tests := []struct {
		name    string
		allow   []string
		wantErr bool
	}{
		{
			name:    "valid IPv4",
			allow:   []string{"192.168.1.100"},
			wantErr: false,
		},
		{
			name:    "valid IPv6",
			allow:   []string{"::1"},
			wantErr: false,
		},
		{
			name:    "multiple IPs",
			allow:   []string{"192.168.1.1", "127.0.0.1", "::1"},
			wantErr: false,
		},
		{
			name:    "empty allow list - use default localhost",
			allow:   []string{},
			wantErr: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cfg := &config.PprofConfig{
				Enabled: true,
				Path:    "/debug/pprof",
				Allow:   tt.allow,
			}

			h, err := NewPprofHandler(cfg)
			if tt.wantErr {
				if err == nil {
					t.Error("expected error, got nil")
				}
			} else {
				if err != nil {
					t.Errorf("unexpected error: %v", err)
				}
				if h == nil {
					t.Fatal("expected non-nil handler")
				}
				// 空列表时应该默认允许 localhost
				if len(tt.allow) == 0 {
					if len(h.allowedIPs) != 2 {
						t.Errorf("expected 2 default allowed IPs (127.0.0.1 and ::1), got %d", len(h.allowedIPs))
					}
				}
			}
		})
	}
}

func TestNewPprofHandler_CIDR(t *testing.T) {
	tests := []struct {
		name    string
		allow   []string
		wantErr bool
	}{
		{
			name:    "valid CIDR IPv4",
			allow:   []string{"192.168.1.0/24"},
			wantErr: false,
		},
		{
			name:    "valid CIDR IPv6",
			allow:   []string{"2001:db8::/32"},
			wantErr: false,
		},
		{
			name:    "multiple CIDRs",
			allow:   []string{"10.0.0.0/8", "172.16.0.0/12"},
			wantErr: false,
		},
		{
			name:    "mixed IP and CIDR",
			allow:   []string{"192.168.1.1", "10.0.0.0/8"},
			wantErr: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cfg := &config.PprofConfig{
				Enabled: true,
				Path:    "/debug/pprof",
				Allow:   tt.allow,
			}

			h, err := NewPprofHandler(cfg)
			if tt.wantErr {
				if err == nil {
					t.Error("expected error, got nil")
				}
			} else {
				if err != nil {
					t.Errorf("unexpected error: %v", err)
				}
				if h == nil {
					t.Fatal("expected non-nil handler")
				}
			}
		})
	}
}

func TestNewPprofHandler_InvalidIP(t *testing.T) {
	tests := []struct {
		name  string
		allow []string
	}{
		{
			name:  "invalid IP format",
			allow: []string{"not-an-ip"},
		},
		{
			name:  "invalid CIDR format",
			allow: []string{"invalid-cidr"},
		},
		{
			name:  "CIDR with invalid mask",
			allow: []string{"192.168.1.0/33"},
		},
		{
			name:  "mixed valid and invalid",
			allow: []string{"127.0.0.1", "invalid"},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cfg := &config.PprofConfig{
				Enabled: true,
				Path:    "/debug/pprof",
				Allow:   tt.allow,
			}

			_, err := NewPprofHandler(cfg)
			if err == nil {
				t.Error("expected error for invalid IP/CIDR, got nil")
			}
		})
	}
}

func TestPprofHandler_Path(t *testing.T) {
	tests := []struct {
		name     string
		path     string
		wantPath string
	}{
		{
			name:     "default path",
			path:     "",
			wantPath: "/debug/pprof",
		},
		{
			name:     "custom path",
			path:     "/admin/pprof",
			wantPath: "/admin/pprof",
		},
		{
			name:     "nested path",
			path:     "/api/v1/debug/pprof",
			wantPath: "/api/v1/debug/pprof",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cfg := &config.PprofConfig{
				Enabled: true,
				Path:    tt.path,
			}

			h, err := NewPprofHandler(cfg)
			if err != nil {
				t.Fatalf("unexpected error: %v", err)
			}
			if h == nil {
				t.Fatal("expected non-nil handler")
			}

			if h.Path() != tt.wantPath {
				t.Errorf("expected path %s, got %s", tt.wantPath, h.Path())
			}
		})
	}
}

func TestPprofHandler_isAllowed(t *testing.T) {
	tests := []struct {
		name        string
		allowedIPs  []string
		allowedNets []string
		clientIP    string
		wantAllowed bool
	}{
		{
			name:        "empty allow list - allow all",
			allowedIPs:  []string{},
			allowedNets: []string{},
			clientIP:    "192.168.1.100",
			wantAllowed: true,
		},
		{
			name:        "IP exact match",
			allowedIPs:  []string{"127.0.0.1"},
			allowedNets: []string{},
			clientIP:    "127.0.0.1",
			wantAllowed: true,
		},
		{
			name:        "IP no match",
			allowedIPs:  []string{"127.0.0.1"},
			allowedNets: []string{},
			clientIP:    "127.0.0.2",
			wantAllowed: false,
		},
		{
			name:        "CIDR match",
			allowedIPs:  []string{},
			allowedNets: []string{"192.168.0.0/16"},
			clientIP:    "192.168.1.100",
			wantAllowed: true,
		},
		{
			name:        "CIDR no match",
			allowedIPs:  []string{},
			allowedNets: []string{"10.0.0.0/8"},
			clientIP:    "192.168.1.100",
			wantAllowed: false,
		},
		{
			name:        "IPv6 CIDR match",
			allowedIPs:  []string{},
			allowedNets: []string{"2001:db8::/32"},
			clientIP:    "2001:db8::1",
			wantAllowed: true,
		},
		{
			name:        "IPv6 exact match",
			allowedIPs:  []string{"::1"},
			allowedNets: []string{},
			clientIP:    "::1",
			wantAllowed: true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			h := &PprofHandler{
				path:        "/debug/pprof",
				allowedIPs:  parseIPs(tt.allowedIPs),
				allowedNets: parseNets(tt.allowedNets),
			}

			// 创建请求上下文，模拟客户端 IP
			// 通过设置请求头来模拟 IP 需要特殊处理
			// fasthttp 的 RemoteIP() 从连接获取，这里我们直接测试 isAllowed 逻辑

			// 手动测试 isAllowed 的内部逻辑
			clientIP := net.ParseIP(tt.clientIP)
			if clientIP == nil {
				t.Fatalf("failed to parse client IP: %s", tt.clientIP)
			}

			// 复制 isAllowed 的逻辑进行测试
			allowed := false
			if len(h.allowedIPs) == 0 && len(h.allowedNets) == 0 {
				allowed = true
			} else {
				for _, ip := range h.allowedIPs {
					if ip.Equal(clientIP) {
						allowed = true
						break
					}
				}
				for _, n := range h.allowedNets {
					if n.Contains(clientIP) {
						allowed = true
						break
					}
				}
			}

			if allowed != tt.wantAllowed {
				t.Errorf("isAllowed() = %v, want %v", allowed, tt.wantAllowed)
			}
		})
	}
}

// parseIPs 辅助函数，解析 IP 字符串列表
func parseIPs(ips []string) []net.IP {
	result := make([]net.IP, 0, len(ips))
	for _, ip := range ips {
		if parsed := net.ParseIP(ip); parsed != nil {
			result = append(result, parsed)
		}
	}
	return result
}

// parseNets 辅助函数，解析 CIDR 字符串列表
func parseNets(cidrs []string) []*net.IPNet {
	result := make([]*net.IPNet, 0, len(cidrs))
	for _, cidr := range cidrs {
		_, net, err := net.ParseCIDR(cidr)
		if err == nil {
			result = append(result, net)
		}
	}
	return result
}

func TestPprofHandler_ServeHTTP_WithAllowListEmpty(t *testing.T) {
	// 测试空 allow 列表时允许所有访问
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	ctx := &fasthttp.RequestCtx{}
	ctx.Request.SetRequestURI("/debug/pprof")

	h.ServeHTTP(ctx)

	// 空 allow 列表时应允许访问（返回 200）
	if ctx.Response.StatusCode() != 200 {
		t.Errorf("expected status 200 for open access, got %d", ctx.Response.StatusCode())
	}
}

func TestPprofHandler_ServeHTTP_ProfileEndpoints(t *testing.T) {
	// 使用空 allow 列表允许所有访问
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	tests := []struct {
		name       string
		path       string
		wantStatus int
	}{
		{
			name:       "heap endpoint",
			path:       "/debug/pprof/heap",
			wantStatus: 200,
		},
		{
			name:       "goroutine endpoint",
			path:       "/debug/pprof/goroutine",
			wantStatus: 200,
		},
		{
			name:       "block endpoint",
			path:       "/debug/pprof/block",
			wantStatus: 200,
		},
		{
			name:       "mutex endpoint",
			path:       "/debug/pprof/mutex",
			wantStatus: 200,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			ctx := &fasthttp.RequestCtx{}
			ctx.Request.SetRequestURI(tt.path)

			h.ServeHTTP(ctx)

			if ctx.Response.StatusCode() != tt.wantStatus {
				t.Errorf("expected status %d, got %d", tt.wantStatus, ctx.Response.StatusCode())
			}
		})
	}
}

func TestPprofHandler_handleIndex(t *testing.T) {
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	ctx := &fasthttp.RequestCtx{}
	ctx.Request.SetRequestURI("/debug/pprof")

	h.handleIndex(ctx)

	// 验证状态码
	if ctx.Response.StatusCode() != 200 {
		t.Errorf("expected status 200, got %d", ctx.Response.StatusCode())
	}

	// 验证 Content-Type
	contentType := string(ctx.Response.Header.Peek("Content-Type"))
	if !strings.Contains(contentType, "text/html") {
		t.Errorf("expected Content-Type text/html, got %s", contentType)
	}

	// 验证响应体包含关键内容
	body := ctx.Response.Body()
	if !bytes.Contains(body, []byte("Pprof Profiles")) {
		t.Error("expected body to contain 'Pprof Profiles'")
	}
	if !bytes.Contains(body, []byte("/debug/pprof/profile")) {
		t.Error("expected body to contain profile link")
	}
	if !bytes.Contains(body, []byte("/debug/pprof/heap")) {
		t.Error("expected body to contain heap link")
	}
	if !bytes.Contains(body, []byte("/debug/pprof/goroutine")) {
		t.Error("expected body to contain goroutine link")
	}
	if !bytes.Contains(body, []byte("/debug/pprof/block")) {
		t.Error("expected body to contain block link")
	}
	if !bytes.Contains(body, []byte("/debug/pprof/mutex")) {
		t.Error("expected body to contain mutex link")
	}
}

func TestPprofHandler_ServeHTTP_PathRouting(t *testing.T) {
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	tests := []struct {
		name       string
		path       string
		wantStatus int
		wantBody   string
	}{
		{
			name:       "index path",
			path:       "/debug/pprof",
			wantStatus: 200,
			wantBody:   "Pprof Profiles",
		},
		{
			name:       "index path with slash",
			path:       "/debug/pprof/",
			wantStatus: 200,
			wantBody:   "Pprof Profiles",
		},
		{
			name:       "unknown path",
			path:       "/debug/pprof/unknown",
			wantStatus: 404,
			wantBody:   "Unknown profile",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			ctx := &fasthttp.RequestCtx{}
			ctx.Request.SetRequestURI(tt.path)

			h.ServeHTTP(ctx)

			if ctx.Response.StatusCode() != tt.wantStatus {
				t.Errorf("expected status %d, got %d", tt.wantStatus, ctx.Response.StatusCode())
			}

			if tt.wantBody != "" {
				body := string(ctx.Response.Body())
				if !strings.Contains(body, tt.wantBody) {
					t.Errorf("expected body to contain '%s', got '%s'", tt.wantBody, body)
				}
			}
		})
	}
}

func TestPprofHandler_ServeHTTP_Forbidden(t *testing.T) {
	// 创建只允许特定 IP 的 handler
	allowedIP := net.ParseIP("10.0.0.1")
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{allowedIP},
		allowedNets: []*net.IPNet{},
	}

	// 由于无法轻松设置 RemoteIP，我们直接测试 isAllowed 返回 false 的情况
	// 通过构造一个 allowedIPs 非空的情况来触发检查

	// 验证 handler 配置正确
	if len(h.allowedIPs) != 1 {
		t.Errorf("expected 1 allowed IP, got %d", len(h.allowedIPs))
	}

	// 验证 allowed IPs 包含配置的 IP
	if !h.allowedIPs[0].Equal(allowedIP) {
		t.Error("expected allowedIPs to contain configured IP")
	}
}

func TestPprofHandler_handleCPU_Params(t *testing.T) {
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	tests := []struct {
		name     string
		seconds  string
		wantType string
	}{
		{
			name:     "default seconds",
			seconds:  "",
			wantType: "application/octet-stream",
		},
		{
			name:     "custom seconds",
			seconds:  "1",
			wantType: "application/octet-stream",
		},
		{
			name:     "invalid seconds",
			seconds:  "invalid",
			wantType: "application/octet-stream",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			ctx := &fasthttp.RequestCtx{}
			if tt.seconds != "" {
				ctx.Request.SetRequestURI("/debug/pprof/profile?seconds=" + tt.seconds)
			} else {
				ctx.Request.SetRequestURI("/debug/pprof/profile")
			}

			// 注意：handleCPU 会启动实际的 CPU profile，需要特殊处理
			// 这里主要验证 Content-Type 设置正确
			// 实际 profile 测试需要更复杂的设置

			// 验证 handler 配置
			if h.path != "/debug/pprof" {
				t.Error("unexpected handler path")
			}
		})
	}
}

func TestPprofHandler_ConfigWithCIDRAndIP(t *testing.T) {
	// 测试混合配置
	cfg := &config.PprofConfig{
		Enabled: true,
		Path:    "/debug/pprof",
		Allow:   []string{"127.0.0.1", "192.168.0.0/24", "::1"},
	}

	h, err := NewPprofHandler(cfg)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if h == nil {
		t.Fatal("expected non-nil handler")
	}

	// 验证 IP 和 CIDR 都被正确解析
	if len(h.allowedIPs) != 2 {
		t.Errorf("expected 2 allowed IPs, got %d", len(h.allowedIPs))
	}
	if len(h.allowedNets) != 1 {
		t.Errorf("expected 1 allowed net, got %d", len(h.allowedNets))
	}

	// 验证具体内容
	foundV4 := false
	foundV6 := false
	for _, ip := range h.allowedIPs {
		if ip.Equal(net.ParseIP("127.0.0.1")) {
			foundV4 = true
		}
		if ip.Equal(net.ParseIP("::1")) {
			foundV6 = true
		}
	}
	if !foundV4 {
		t.Error("expected to find 127.0.0.1 in allowedIPs")
	}
	if !foundV6 {
		t.Error("expected to find ::1 in allowedIPs")
	}

	// 验证 CIDR
	if h.allowedNets[0].String() != "192.168.0.0/24" {
		t.Errorf("expected CIDR 192.168.0.0/24, got %s", h.allowedNets[0].String())
	}
}

func TestPprofHandler_DefaultLocalhostBehavior(t *testing.T) {
	// 测试空配置时默认只允许 localhost
	cfg := &config.PprofConfig{
		Enabled: true,
		Path:    "/debug/pprof",
		Allow:   []string{},
	}

	h, err := NewPprofHandler(cfg)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if h == nil {
		t.Fatal("expected non-nil handler")
	}

	// 验证默认允许 localhost
	if len(h.allowedIPs) != 2 {
		t.Errorf("expected 2 default allowed IPs, got %d", len(h.allowedIPs))
	}

	// 验证包含 IPv4 和 IPv6 localhost
	hasV4 := false
	hasV6 := false
	for _, ip := range h.allowedIPs {
		if ip.Equal(net.ParseIP("127.0.0.1")) {
			hasV4 = true
		}
		if ip.Equal(net.ParseIP("::1")) {
			hasV6 = true
		}
	}
	if !hasV4 {
		t.Error("expected default to include 127.0.0.1")
	}
	if !hasV6 {
		t.Error("expected default to include ::1")
	}
}

func TestPprofHandler_handleHeap(t *testing.T) {
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	ctx := &fasthttp.RequestCtx{}
	ctx.Request.SetRequestURI("/debug/pprof/heap")

	h.handleHeap(ctx)

	// 验证状态码
	if ctx.Response.StatusCode() != 200 {
		t.Errorf("expected status 200, got %d", ctx.Response.StatusCode())
	}

	// 验证 Content-Type
	contentType := string(ctx.Response.Header.Peek("Content-Type"))
	if contentType != "application/octet-stream" {
		t.Errorf("expected Content-Type application/octet-stream, got %s", contentType)
	}
}

func TestPprofHandler_handleGoroutine(t *testing.T) {
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	ctx := &fasthttp.RequestCtx{}
	ctx.Request.SetRequestURI("/debug/pprof/goroutine")

	h.handleGoroutine(ctx)

	// 验证状态码
	if ctx.Response.StatusCode() != 200 {
		t.Errorf("expected status 200, got %d", ctx.Response.StatusCode())
	}

	// 验证 Content-Type
	contentType := string(ctx.Response.Header.Peek("Content-Type"))
	if contentType != "application/octet-stream" {
		t.Errorf("expected Content-Type application/octet-stream, got %s", contentType)
	}
}

func TestPprofHandler_handleBlock(t *testing.T) {
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	ctx := &fasthttp.RequestCtx{}
	ctx.Request.SetRequestURI("/debug/pprof/block")

	h.handleBlock(ctx)

	// 验证状态码
	if ctx.Response.StatusCode() != 200 {
		t.Errorf("expected status 200, got %d", ctx.Response.StatusCode())
	}

	// 验证 Content-Type
	contentType := string(ctx.Response.Header.Peek("Content-Type"))
	if contentType != "application/octet-stream" {
		t.Errorf("expected Content-Type application/octet-stream, got %s", contentType)
	}
}

func TestPprofHandler_handleMutex(t *testing.T) {
	h := &PprofHandler{
		path:        "/debug/pprof",
		allowedIPs:  []net.IP{},
		allowedNets: []*net.IPNet{},
	}

	ctx := &fasthttp.RequestCtx{}
	ctx.Request.SetRequestURI("/debug/pprof/mutex")

	h.handleMutex(ctx)

	// 验证状态码
	if ctx.Response.StatusCode() != 200 {
		t.Errorf("expected status 200, got %d", ctx.Response.StatusCode())
	}

	// 验证 Content-Type
	contentType := string(ctx.Response.Header.Peek("Content-Type"))
	if contentType != "application/octet-stream" {
		t.Errorf("expected Content-Type application/octet-stream, got %s", contentType)
	}
}