;; disfluid, implementation of the Solid specification
;; Copyright (C) 2020, 2021  Vivien Kraus

;; This program is free software: you can redistribute it and/or modify
;; it under the terms of the GNU Affero General Public License as
;; published by the Free Software Foundation, either version 3 of the
;; License, or (at your option) any later version.

;; This program is distributed in the hope that it will be useful,
;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;; GNU Affero General Public License for more details.

;; You should have received a copy of the GNU Affero General Public License
;; along with this program.  If not, see <https://www.gnu.org/licenses/>.

(define-module (tests authorization-endpoint-submit-form)
  #:use-module (webid-oidc authorization-endpoint)
  #:use-module (webid-oidc authorization-code)
  #:use-module (webid-oidc client-manifest)
  #:use-module (webid-oidc jwk)
  #:use-module (webid-oidc cache)
  #:use-module (webid-oidc jti)
  #:use-module (webid-oidc testing)
  #:use-module ((webid-oidc parameters) #:prefix p:)
  #:use-module (web uri)
  #:use-module (web request)
  #:use-module (web response)
  #:use-module (srfi srfi-19)
  #:use-module (web response)
  #:use-module (ice-9 optargs)
  #:use-module (ice-9 receive)
  #:use-module (oop goops)
  #:declarative? #t
  #:duplicates (merge-generics))

(with-test-environment
 "authorization-endpoint-submit-form"
 (lambda ()
   (define key (generate-key #:n-size 2048))
   (define subject (string->uri "https://authorization-endpoint-submit-form.scm/profile/card#me"))
   (define client (string->uri "https://authorization-endpoint-submit-form.scm/client/card#app"))
   (define redirect (string->uri "https://authorization-endpoint-submit-form.scm/client/redirect"))
   (define password "p4ssw0rd")
   (define encrypted-password (crypt password "$6$this.is.the.salt"))
   (define what-uri-to-expect client)
   (define served
     (receive (response response-body)
         (serve (make <client-manifest>
                  #:client-id client
                  #:redirect-uris (list redirect))
                (time-utc->date (make-time time-utc 0 3600)))
       (cons response response-body)))
   (define the-response (car served))
   (define the-response-body (cdr served))
   (define endpoint
     (make-authorization-endpoint
      subject encrypted-password key))
   (parameterize ((p:anonymous-http-request
                   (lambda* (uri #:key (headers '()) #:allow-other-keys)
                     (unless (equal? uri what-uri-to-expect)
                       (exit 2))
                     (values the-response the-response-body))))
     (use-cache
      (lambda ()
        (receive (response response-body)
            ;; The password is fake!
            (parameterize ((p:current-date 0))
              (endpoint
               (build-request (string->uri
                               (format #f "https://authorization-endpoint-submit-form.scm/authorize?client_id=~a&redirect_uri=~a"
                                       (uri-encode (uri->string client))
                                       (uri-encode (uri->string redirect))))
                              #:headers '((content-type application/x-www-form-urlencoded))
                              #:method 'POST
                              #:port #t)
               "password=fake"))
          (when (eq? (response-code response) 302)
            (exit 3)))
        (receive (response response-body)
            (parameterize ((p:current-date 0))
              (endpoint
               (build-request (string->uri
                               (format #f "https://authorization-endpoint-submit-form.scm/authorize?client_id=~a&redirect_uri=~a"
                                       (uri-encode (uri->string client))
                                       (uri-encode (uri->string redirect))))
                              #:headers '((content-type application/x-www-form-urlencoded))
                              #:method 'POST
                              #:port #t)
               "password=p4ssw0rd"))
          (unless (eq? (response-code response) 302)
            (exit 4))
          (let ((loc (response-location response)))
            (unless (uri? loc)
              (exit 5))
            (let ((loc-scheme (uri-scheme loc))
                  (loc-host (uri-host loc))
                  (loc-path (uri-path loc))
                  (loc-query (uri-query loc)))
              (unless (eq? loc-scheme 'https)
                (exit 6))
              (unless (string=? loc-host "authorization-endpoint-submit-form.scm")
                (exit 7))
              (unless (string=? loc-path "/client/redirect")
                (exit 8))
              (let* ((kv (string-split loc-query #\&))
                     (args (map (lambda (x)
                                  (map uri-decode (string-split x #\=)))
                                kv)))
                (unless (assoc-ref args "code")
                  (exit 9))
                (let ((parsed
                       (parameterize ((p:current-date 60))
                         (decode <authorization-code>
                                 (car (assoc-ref args "code"))
                                 #:issuer-key key))))
                  (unless parsed
                    (exit 10))))))))))))