"""Local UI dependencies are served without exposing project data."""
import http.client
import threading
from http.server import ThreadingHTTPServer

import pytest

from omni import serve


@pytest.fixture
def static_server(tmp_path, monkeypatch):
    web = tmp_path / "web"
    vendor = web / "vendor" / "tabler"
    vendor.mkdir(parents=True)
    (vendor / "tabler.min.css").write_text("body{color:#123}", encoding="utf-8")
    (vendor / "tabler.min.js").write_text("window.tabler={};", encoding="utf-8")
    (web / "index.html").write_text("<html>panel</html>", encoding="utf-8")
    (web / "private.js").write_text("private", encoding="utf-8")
    (vendor / "secret.json").write_text('{"secret":"test-only"}', encoding="utf-8")
    (tmp_path / "outside.js").write_text("outside", encoding="utf-8")
    monkeypatch.setattr(serve, "WEB", web)
    server = ThreadingHTTPServer(("127.0.0.1", 0), serve.Handler)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()

    def get(path):
        connection = http.client.HTTPConnection("127.0.0.1", server.server_port, timeout=5)
        try:
            connection.request("GET", path)
            response = connection.getresponse()
            return response.status, dict(response.getheaders()), response.read()
        finally:
            connection.close()

    try:
        yield get
    finally:
        server.shutdown()
        server.server_close()
        thread.join(timeout=5)


@pytest.mark.parametrize("name,ctype,expected", [
    ("tabler.min.css", "text/css; charset=utf-8", b"body{color:#123}"),
    ("tabler.min.js", "text/javascript; charset=utf-8", b"window.tabler={};"),
])
def test_local_template_assets(static_server, name, ctype, expected):
    status, headers, body = static_server("/assets/vendor/tabler/" + name + "?v=1.7.1")
    assert status == 200 and body == expected
    assert headers["Content-Type"] == ctype
    assert headers["X-Content-Type-Options"] == "nosniff"
    assert int(headers["Content-Length"]) == len(expected)


@pytest.mark.parametrize("path", [
    "/assets/vendor/tabler/missing.js",
    "/assets/vendor/tabler/",
    "/assets/vendor/tabler/secret.json",
    "/assets/private.js",
    "/assets/index.html",
    "/assets/vendor/../../private.js",
    "/assets/vendor/%2e%2e/%2e%2e/outside.js",
    "/assets/%2foutside.js",
    "/assets/vendor/..%5c..%5cprivate.js",
    "/assets/vendor/%00.js",
])
def test_assets_reject_private_files_and_traversal(static_server, path):
    status, _, body = static_server(path)
    assert status == 404
    assert body == b"not found"


def test_index_still_served(static_server):
    status, headers, body = static_server("/")
    assert status == 200 and body == b"<html>panel</html>"
    assert headers["Content-Type"].startswith("text/html")