using System.Net;
using Microsoft.AspNetCore.HttpOverrides;
using Omika.Api;

namespace Omika.Tests.Api;

/// <summary>
/// Tests de la configuration ForwardedHeaders (reverse proxy Apache local).
/// Vérifient le contenu exact des options (en-têtes, ForwardLimit, KnownProxies)
/// et l'absence de toute configuration « trust-all » (symétrie conservée,
/// KnownNetworks jamais vidé, aucun proxy non-loopback).
/// </summary>
public class ForwardedHeadersConfigurationTests
{
    [Fact]
    public void CreateOptions_ConfiguresForwardedHeaders()
    {
        var options = ForwardedHeadersConfiguration.CreateOptions();

        Assert.Equal(
            ForwardedHeaders.XForwardedFor
                | ForwardedHeaders.XForwardedProto
                | ForwardedHeaders.XForwardedHost,
            options.ForwardedHeaders);
    }

    [Fact]
    public void CreateOptions_SetsForwardLimitToOne()
    {
        var options = ForwardedHeadersConfiguration.CreateOptions();

        Assert.Equal(1, options.ForwardLimit);
    }

    [Fact]
    public void CreateOptions_AddsIpv4LoopbackAsKnownProxy()
    {
        var options = ForwardedHeadersConfiguration.CreateOptions();

        Assert.Contains(IPAddress.Loopback, options.KnownProxies);
    }

    [Fact]
    public void CreateOptions_AddsIpv6LoopbackAsKnownProxy()
    {
        var options = ForwardedHeadersConfiguration.CreateOptions();

        Assert.Contains(IPAddress.IPv6Loopback, options.KnownProxies);
    }

    [Fact]
    public void CreateOptions_OnlyTrustsLoopbackProxies()
    {
        var options = ForwardedHeadersConfiguration.CreateOptions();

        // Aucun wildcard (0.0.0.0 / [::]) : uniquement le proxy Apache local.
        Assert.DoesNotContain(IPAddress.Any, options.KnownProxies);
        Assert.DoesNotContain(IPAddress.IPv6Any, options.KnownProxies);
        Assert.All(options.KnownProxies, ip => Assert.True(IPAddress.IsLoopback(ip)));
    }

    [Fact]
    public void CreateOptions_KeepsRequireHeaderSymmetryEnabled()
    {
        var options = ForwardedHeadersConfiguration.CreateOptions();

        // La symétrie des en-têtes reste activée (défaut sécurisé) : jamais
        // désactivée pour une configuration permissive globale.
        Assert.True(options.RequireHeaderSymmetry);
    }

    [Fact]
    public void CreateOptions_DoesNotClearKnownNetworks()
    {
        var options = ForwardedHeadersConfiguration.CreateOptions();

        // KnownIPNetworks (anciennement KnownNetworks) conserve ses réseaux par
        // défaut (loopback) : jamais vidé.
        Assert.NotEmpty(options.KnownIPNetworks);
        // La confiance réseau reste bornée au loopback (127.0.0.1/8 et ::1/128).
        Assert.All(options.KnownIPNetworks, network => Assert.True(IPAddress.IsLoopback(network.BaseAddress)));
    }
}