package support

import (
	"bytes"
	"image"
	"image/png"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestSaveAndOpenKBImage(t *testing.T) {
	dir := t.TempDir()
	secret := "test-signing-secret-kb"

	var buf bytes.Buffer
	img := image.NewRGBA(image.Rect(0, 0, 8, 8))
	if err := png.Encode(&buf, img); err != nil {
		t.Fatal(err)
	}

	out, err := SaveKBImage(dir, "http://localhost:28471", secret, "shot.png", "image/png", bytes.NewReader(buf.Bytes()))
	if err != nil {
		t.Fatal(err)
	}
	if out.ContentType != "image/png" || out.Size <= 0 {
		t.Fatalf("ct=%s size=%d", out.ContentType, out.Size)
	}
	if !strings.HasPrefix(out.AdminURL, KBImageAdminURLPrefix) {
		t.Fatalf("admin url=%s", out.AdminURL)
	}
	if !strings.Contains(out.MarkdownURL, KBImagePublicPathPrefix) || !strings.Contains(out.MarkdownURL, "sig=") {
		t.Fatalf("markdown url=%s", out.MarkdownURL)
	}
	if _, err := os.Stat(filepath.Join(dir, kbMediaSubdir, out.Filename)); err != nil {
		t.Fatal(err)
	}

	f, ct, err := OpenKBImage(dir, out.Filename)
	if err != nil {
		t.Fatal(err)
	}
	defer f.Close()
	if ct != "image/png" {
		t.Fatalf("open ct=%s", ct)
	}

	idx := strings.Index(out.MarkdownURL, "sig=")
	if idx < 0 {
		t.Fatal("missing sig")
	}
	sig := out.MarkdownURL[idx+4:]
	if err := VerifyKBImageSig(secret, out.Filename, sig); err != nil {
		t.Fatalf("verify: %v", err)
	}
	if err := VerifyKBImageSig(secret, out.Filename, "deadbeef"); err != ErrKBImageBadSig {
		t.Fatalf("expected bad sig, got %v", err)
	}
}

func TestSaveKBImageRejectsBadType(t *testing.T) {
	dir := t.TempDir()
	_, err := SaveKBImage(dir, "http://localhost:28471", "secret", "x.txt", "text/plain", bytes.NewReader([]byte("not-an-image!!!!")))
	if err != ErrKBImageInvalidType {
		t.Fatalf("got %v", err)
	}
}

func TestResolveKBImagePathRejectsTraversal(t *testing.T) {
	dir := t.TempDir()
	_, err := ResolveKBImagePath(dir, "../etc/passwd")
	if err != ErrKBImageInvalidName {
		t.Fatalf("got %v", err)
	}
}