module remote

import time

// The vectors below come from two independent sources:
//
//   1. the official AWS `get-vanilla` case from the SigV4 test suite, whose
//      signature is published with the specification;
//   2. an S3-shaped conditional PUT, computed by a separate implementation
//      written from the same specification in another language.
//
// Between them they cover the canonical request, the key derivation chain, the
// string-to-sign and the header set that S3 actually sends.
fn example_time() time.Time {
	return time.Time{
		year:     2015
		month:    8
		day:      30
		hour:     12
		minute:   36
		second:   0
		is_local: false
	}
}

fn test_the_official_aws_get_vanilla_vector() {
	signer := Signer{
		access_key:   'AKIDEXAMPLE'
		secret_key:   'wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY'
		region:       'us-east-1'
		service:      'service'
		sign_payload: false
	}
	headers := signer.sign('GET', 'https://example.amazonaws.com/', '', map[string]string{},
		[]u8{}, example_time())
	assert headers['authorization'] == 'AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31'
	assert headers['host'] == 'example.amazonaws.com'
	assert headers['x-amz-date'] == '20150830T123600Z'
}

fn test_an_s3_conditional_put_signs_the_payload_and_the_condition() {
	signer := Signer{
		access_key: 'SCWACCESSKEY'
		secret_key: 'scw-secret-key'
		region:     'fr-par'
		service:    s3_service
	}
	headers := signer.sign('PUT', 'https://s3.fr-par.scw.cloud/bucket/repo/objects/abc', '', {
		'If-None-Match': '*'
	}, 'compressed-bytes'.bytes(), time.Time{
		year:     2026
		month:    9
		day:      23
		hour:     12
		minute:   0
		second:   0
		is_local: false
	})
	assert headers['authorization'] == 'AWS4-HMAC-SHA256 Credential=SCWACCESSKEY/20260923/fr-par/s3/aws4_request, SignedHeaders=host;if-none-match;x-amz-content-sha256;x-amz-date, Signature=9790aa767fc3e4c36fce70c92476933a90b401200068f06c340bf1108435580a'
	// The body is part of the signature: a different payload must change it.
	other := signer.sign('PUT', 'https://s3.fr-par.scw.cloud/bucket/repo/objects/abc', '', {
		'If-None-Match': '*'
	}, 'different-bytes'.bytes(), time.Time{
		year:     2026
		month:    9
		day:      23
		hour:     12
		minute:   0
		second:   0
		is_local: false
	})
	assert other['authorization'] != headers['authorization']
}

fn test_urls_are_split_into_host_and_encoded_path() {
	parts := split_url('https://s3.fr-par.scw.cloud/bucket/repo/objects/abc')
	assert parts.host == 's3.fr-par.scw.cloud'
	assert parts.path == '/bucket/repo/objects/abc'

	// Slashes in the key stay slashes; anything else is encoded.
	spaces := split_url('https://example.com/bucket/a file.txt')
	assert spaces.path == '/bucket/a%20file.txt'

	// An endpoint with a path prefix keeps it.
	prefixed := split_url('https://example.com/prefix/bucket/key?x=1')
	assert prefixed.host == 'example.com'
	assert prefixed.path == '/prefix/bucket/key'
}

fn test_canonical_query_is_sorted_and_encoded() {
	assert canonical_query('') == ''
	// The query arrives raw, so a slash in a key is encoded here and only here.
	assert canonical_query('prefix=b/a&list-type=2') == 'list-type=2&prefix=b%2Fa'
	assert canonical_query('prefix=repo/objects/x&continuation-token=a=b') == 'continuation-token=a%3Db&prefix=repo%2Fobjects%2Fx'
	assert canonical_query('prefix=a b') == 'prefix=a%20b'
}

fn test_etags_lose_their_quotes() {
	assert clean_etag('"3b1f"') == '3b1f'
	assert clean_etag('  "abc123"  ') == 'abc123'
	assert clean_etag('abc123') == 'abc123'
	assert clean_etag('') == ''
}

fn test_list_objects_responses_are_read() {
	body := '<ListBucketResult><IsTruncated>false</IsTruncated>' +
		'<Contents><Key>repo/objects/aaa</Key></Contents>' +
		'<Contents><Key>repo/objects/bbb</Key></Contents></ListBucketResult>'
	assert elements(body, 'Key') == ['repo/objects/aaa', 'repo/objects/bbb']
	assert first_element(body, 'NextContinuationToken') == none
	assert !body.contains('<IsTruncated>true</IsTruncated>')

	paged := '<ListBucketResult><IsTruncated>true</IsTruncated>' +
		'<NextContinuationToken>aGVsbG8=</NextContinuationToken>' +
		'<Contents><Key>repo/objects/c&amp;c</Key></Contents></ListBucketResult>'
	assert first_element(paged, 'NextContinuationToken') or { '' } == 'aGVsbG8='
	assert elements(paged, 'Key') == ['repo/objects/c&c']
	assert paged.contains('<IsTruncated>true</IsTruncated>')
}

fn test_the_constructor_refuses_settings_that_cannot_work() {
	if _ := new_s3('', 'bucket', 'region', 'ak', 'sk') {
		assert false, 'a missing endpoint must be refused'
	}
	if _ := new_s3('s3.fr-par.scw.cloud', 'bucket', 'region', 'ak', 'sk') {
		assert false, 'an endpoint without a scheme must be refused'
	}
	if _ := new_s3('https://s3.fr-par.scw.cloud', 'bucket', 'region', '', '') {
		assert false, 'missing keys must be refused'
	}
	backend := new_s3('https://s3.fr-par.scw.cloud/', 'bucket', 'fr-par', 'ak', 'sk')!
	assert backend.root == 'https://s3.fr-par.scw.cloud'
	assert backend.url_for('repo/objects/abc', '') == 'https://s3.fr-par.scw.cloud/bucket/repo/objects/abc'
	assert backend.url_for('', 'list-type=2&prefix=x') == 'https://s3.fr-par.scw.cloud/bucket?list-type=2&prefix=x'
}