package oidc_test

import (
	"context"
	"errors"
	"testing"
	"time"

	"github.com/stretchr/testify/require"

	"git.d-ma.be/mathias/tapir/internal/web/oidc"
)

func testConfig(issuer string) oidc.Config {
	return oidc.Config{
		Issuer:        issuer,
		ClientID:      testClientID,
		ClientSecret:  "test-client-secret",
		RedirectURL:   "http://tapir.test/auth/callback",
		SessionSecret: "test-session-secret-please-change",
	}
}

// #59: a discovery 503 at start-up is retried instead of failing New.
func TestNewRetriesDiscoveryAfter503UntilIssuerAnswers(t *testing.T) {
	f := newFakeIssuer(t)
	f.unavailableFor = 2

	auth, err := oidc.New(context.Background(), testConfig(f.server.URL),
		oidc.WithDiscoveryRetry(5, time.Millisecond))

	require.NoError(t, err)
	require.NotNil(t, auth)
	require.Equal(t, int32(3), f.discoveryHits.Load())
}

func TestNewReturnsDiscoveryErrorAfterAttemptsExhausted(t *testing.T) {
	f := newFakeIssuer(t)
	f.unavailableFor = 1000

	_, err := oidc.New(context.Background(), testConfig(f.server.URL),
		oidc.WithDiscoveryRetry(3, time.Millisecond))

	require.ErrorContains(t, err, "503")
	require.Equal(t, int32(3), f.discoveryHits.Load())
}

func TestNewStopsDiscoveryBackoffWhenContextCancelled(t *testing.T) {
	f := newFakeIssuer(t)
	f.unavailableFor = 1000
	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
	defer cancel()

	start := time.Now()
	_, err := oidc.New(ctx, testConfig(f.server.URL),
		oidc.WithDiscoveryRetry(5, time.Hour))

	require.True(t, errors.Is(err, context.DeadlineExceeded), "err = %v", err)
	require.Less(t, time.Since(start), 5*time.Second)
	require.Equal(t, int32(1), f.discoveryHits.Load())
}