import 'package:flutter_test/flutter_test.dart';
import 'package:http/http.dart' as http;
import 'package:http/testing.dart';
import 'package:ikar/core/media/max_media_http.dart';

void main() {
  test('additional CA is restricted to HTTPS on ИКАР hosts', () {
    for (final url in ['https://fd2.oneme.ru/file', 'https://oneme.ru/']) {
      expect(MaxMediaHttpClient.usesAdditionalTrust(Uri.parse(url)), isTrue);
    }
    for (final url in [
      'http://fd2.oneme.ru/',
      'https://oneme.ru.evil.test/',
      'https://evil-oneme.ru/',
      'https://example.com/',
    ]) {
      expect(MaxMediaHttpClient.usesAdditionalTrust(Uri.parse(url)), isFalse);
    }
  });

  test('redirect reselects trust and drops origin credentials', () async {
    var trustedRequests = 0;
    final client = MaxMediaHttpClient(
      trusted: () async => MockClient((request) async {
        trustedRequests++;
        expect(request.followRedirects, isFalse);
        return http.Response(
          '',
          302,
          headers: {'location': 'https://example.com/file'},
        );
      }),
      standard: MockClient((request) async {
        expect(request.url.host, 'example.com');
        expect(request.headers.containsKey('authorization'), isFalse);
        return http.Response('%PDF-test', 200);
      }),
    );
    addTearDown(client.close);
    final response = await client.get(
      Uri.parse('https://fd2.oneme.ru/file'),
      headers: {'authorization': 'synthetic'},
    );
    expect(response.body, '%PDF-test');
    expect(trustedRequests, 1);
  });

  test('media redirects cannot downgrade TLS', () async {
    final client = MaxMediaHttpClient(
      trusted: () async => MockClient(
        (_) async => http.Response(
          '',
          302,
          headers: {'location': 'http://fd2.oneme.ru/file'},
        ),
      ),
    );
    addTearDown(client.close);
    await expectLater(
      client.get(Uri.parse('https://fd2.oneme.ru/file')),
      throwsA(isA<http.ClientException>()),
    );
  });
}