gateways_test.go

package firezone_test

import (
	"context"
	"net/http"
	"testing"

	firezone "github.com/firezone/firezone-sdk-go"
	"github.com/firezone/firezone-sdk-go/internal/testutil"
)

func TestGatewaysService_Provision(t *testing.T) {
	var gotMethod, gotPath string
	var gotBody map[string]any
	client := testutil.NewClient(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		gotMethod, gotPath = r.Method, r.URL.Path
		decodeJSONBody(t, r, &gotBody)
		testutil.JSONResponse(http.StatusCreated, map[string]any{
			"data": map[string]any{
				"id": "gw-1", "name": "gw-nyc-1", "ipv4": "", "ipv6": "", "online": false,
				"token": "one-time-secret",
			},
		})(w, r)
	}))

	provisioned, err := client.Sites.Gateways("site-1").Provision(context.Background(), &firezone.ProvisionGatewayRequest{Name: "gw-nyc-1"})
	if err != nil {
		t.Fatalf("Provision returned error: %v", err)
	}

	if gotMethod != http.MethodPost || gotPath != "/sites/site-1/gateways" {
		t.Errorf("request = %s %s, want POST /sites/site-1/gateways", gotMethod, gotPath)
	}
	reqGateway, ok := gotBody["gateway"].(map[string]any)
	if !ok || reqGateway["name"] != "gw-nyc-1" {
		t.Errorf("body[gateway] = %v, want {name: gw-nyc-1}", gotBody["gateway"])
	}

	if provisioned.ID != "gw-1" || provisioned.Name != "gw-nyc-1" {
		t.Errorf("provisioned = %+v, want ID=gw-1 Name=gw-nyc-1", provisioned)
	}
	if provisioned.Online {
		t.Error("provisioned.Online = true, want false (never connected)")
	}
	if provisioned.Token != "one-time-secret" {
		t.Errorf("provisioned.Token = %q, want one-time-secret", provisioned.Token)
	}
}

func TestGatewaysService_Provision_AutoGeneratedName(t *testing.T) {
	var gotBody map[string]any
	client := testutil.NewClient(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		decodeJSONBody(t, r, &gotBody)
		testutil.JSONResponse(http.StatusCreated, map[string]any{
			"data": map[string]any{"id": "gw-1", "name": "random-name", "online": false, "token": "secret"},
		})(w, r)
	}))

	// Passing nil Name (empty request) matches the API's own default:
	// a random name is generated when omitted.
	provisioned, err := client.Sites.Gateways("site-1").Provision(context.Background(), &firezone.ProvisionGatewayRequest{})
	if err != nil {
		t.Fatalf("Provision returned error: %v", err)
	}
	if _, hasName := gotBody["gateway"].(map[string]any)["name"]; hasName {
		t.Error("body.gateway.name was sent even though empty, want omitted")
	}
	if provisioned.Name != "random-name" {
		t.Errorf("provisioned.Name = %q, want random-name", provisioned.Name)
	}
}

func TestGatewaysService_Get_NoTokenField(t *testing.T) {
	// Get returns *Gateway, which has no Token field at all - the type
	// system itself prevents a caller from expecting a token after a
	// refresh. This test just documents/locks in that Get's return type
	// is Gateway, not ProvisionedGateway.
	client := testutil.NewClient(t, testutil.JSONResponse(http.StatusOK, map[string]any{
		"data": map[string]any{"id": "gw-1", "name": "gw-nyc-1", "online": true},
	}))

	gateway, err := client.Sites.Gateways("site-1").Get(context.Background(), "gw-1")
	if err != nil {
		t.Fatalf("Get returned error: %v", err)
	}
	if gateway.ID != "gw-1" || !gateway.Online {
		t.Errorf("gateway = %+v, want ID=gw-1 Online=true", gateway)
	}
}

func TestGatewaysService_Update_Rename(t *testing.T) {
	var gotMethod, gotPath string
	client := testutil.NewClient(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		gotMethod, gotPath = r.Method, r.URL.Path
		testutil.JSONResponse(http.StatusOK, map[string]any{
			"data": map[string]any{"id": "gw-1", "name": "renamed", "online": false},
		})(w, r)
	}))

	gateway, err := client.Sites.Gateways("site-1").Update(context.Background(), "gw-1", &firezone.UpdateGatewayRequest{Name: "renamed"})
	if err != nil {
		t.Fatalf("Update returned error: %v", err)
	}
	if gotMethod != http.MethodPatch || gotPath != "/sites/site-1/gateways/gw-1" {
		t.Errorf("request = %s %s, want PATCH /sites/site-1/gateways/gw-1", gotMethod, gotPath)
	}
	if gateway.Name != "renamed" {
		t.Errorf("gateway.Name = %q, want renamed", gateway.Name)
	}
}

func TestGatewaysService_List_Filters(t *testing.T) {
	tests := []struct {
		name      string
		opts      *firezone.GatewayListOptions
		wantQuery string
	}{
		{name: "by name", opts: &firezone.GatewayListOptions{Name: "gw-us-east-1"}, wantQuery: "name=gw-us-east-1"},
		{name: "by ipv4", opts: &firezone.GatewayListOptions{IPv4: "100.64.0.1"}, wantQuery: "ipv4=100.64.0.1"},
		{name: "by ipv6", opts: &firezone.GatewayListOptions{IPv6: "fd00::1"}, wantQuery: "ipv6=fd00%3A%3A1"},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			var gotQuery string
			client := testutil.NewClient(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				gotQuery = r.URL.RawQuery
				testutil.JSONResponse(http.StatusOK, map[string]any{
					"data":     []map[string]any{},
					"metadata": map[string]any{"count": 0, "limit": 50, "next_page": "", "prev_page": ""},
				})(w, r)
			}))

			_, err := client.Sites.Gateways("site-1").List(context.Background(), tt.opts)
			if err != nil {
				t.Fatalf("List returned error: %v", err)
			}
			if gotQuery != tt.wantQuery {
				t.Errorf("query = %q, want %q", gotQuery, tt.wantQuery)
			}
		})
	}
}

// TestGatewaysService_Get_RotationState covers the fields that let a
// caller tell "rotation pending" from "rotation complete". A rotation
// is invisible without them: the API deletes the previous token once
// the replacement is confirmed, so a Gateway that never picks its
// replacement up is stranded with no other signal.
func TestGatewaysService_Get_RotationState(t *testing.T) {
	tests := []struct {
		name        string
		data        map[string]any
		wantTokenID string
		wantPending bool
	}{
		{
			name: "connected, no rotation pending",
			data: map[string]any{
				"id": "gw-1", "name": "gw-nyc-1", "online": true,
				"gateway_token_id": "tok-1",
			},
			wantTokenID: "tok-1",
			wantPending: false,
		},
		{
			name: "rotation pending",
			data: map[string]any{
				"id": "gw-1", "name": "gw-nyc-1", "online": true,
				"gateway_token_id": "tok-1",
				"rotated_at":       "2026-01-01T00:00:00Z",
			},
			wantTokenID: "tok-1",
			wantPending: true,
		},
		{
			// A Gateway that has never connected reports neither field.
			name:        "never connected",
			data:        map[string]any{"id": "gw-1", "name": "gw-nyc-1", "online": false},
			wantTokenID: "",
			wantPending: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			client := testutil.NewClient(t, testutil.JSONResponse(http.StatusOK, map[string]any{
				"data": tt.data,
			}))

			gateway, err := client.Sites.Gateways("site-1").Get(context.Background(), "gw-1")
			if err != nil {
				t.Fatalf("Get returned error: %v", err)
			}

			if gateway.GatewayTokenID != tt.wantTokenID {
				t.Errorf("GatewayTokenID = %q, want %q", gateway.GatewayTokenID, tt.wantTokenID)
			}
			if got := gateway.RotationPending(); got != tt.wantPending {
				t.Errorf("RotationPending() = %v, want %v (RotatedAt: %v)",
					got, tt.wantPending, gateway.RotatedAt)
			}
			// RotatedAt is a pointer so "never rotated" stays
			// distinguishable from the zero time rather than collapsing
			// into it - RotationPending depends on that.
			if tt.wantPending && gateway.RotatedAt == nil {
				t.Error("RotatedAt = nil, want a timestamp")
			}
			if !tt.wantPending && gateway.RotatedAt != nil {
				t.Errorf("RotatedAt = %v, want nil", gateway.RotatedAt)
			}
		})
	}
}

// TestProvisionedGateway_NoRotationPending guards the newly provisioned
// case: Provision embeds Gateway, so the rotation fields come along, and
// a brand-new Gateway must never look like it has a rotation pending.
func TestProvisionedGateway_NoRotationPending(t *testing.T) {
	client := testutil.NewClient(t, testutil.JSONResponse(http.StatusCreated, map[string]any{
		"data": map[string]any{"id": "gw-1", "name": "gw-nyc-1", "token": "secret"},
	}))

	provisioned, err := client.Sites.Gateways("site-1").
		Provision(context.Background(), &firezone.ProvisionGatewayRequest{Name: "gw-nyc-1"})
	if err != nil {
		t.Fatalf("Provision returned error: %v", err)
	}

	if provisioned.Token != "secret" {
		t.Errorf("Token = %q, want secret", provisioned.Token)
	}
	if provisioned.RotationPending() {
		t.Error("RotationPending() = true on a newly provisioned Gateway, want false")
	}
}

func TestGatewaysService_RotateToken(t *testing.T) {
	var gotMethod, gotPath string
	client := testutil.NewClient(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		gotMethod, gotPath = r.Method, r.URL.Path
		testutil.JSONResponse(http.StatusCreated, map[string]any{
			"data": map[string]any{"id": "tok-2", "token": "new-secret"},
		})(w, r)
	}))

	rotated, err := client.Sites.Gateways("site-1").RotateToken(context.Background(), "gw-1")
	if err != nil {
		t.Fatalf("RotateToken returned error: %v", err)
	}

	if gotMethod != http.MethodPost || gotPath != "/sites/site-1/gateways/gw-1/token/rotate" {
		t.Errorf("request = %s %s, want POST /sites/site-1/gateways/gw-1/token/rotate",
			gotMethod, gotPath)
	}
	if rotated.ID != "tok-2" || rotated.Token != "new-secret" {
		t.Errorf("rotated = %+v, want ID=tok-2 Token=new-secret", rotated)
	}
}

func TestGatewaysService_RotateToken_NotFound(t *testing.T) {
	client := testutil.NewClient(t, testutil.ProblemResponse(http.StatusNotFound, "not found"))

	_, err := client.Sites.Gateways("site-1").RotateToken(context.Background(), "missing")
	if !firezone.IsNotFound(err) {
		t.Fatalf("IsNotFound(err) = false, want true (err: %v)", err)
	}
}