package va

import (
	"context"
	"strings"
	"testing"

	"github.com/letsencrypt/boulder/bdns"
	"github.com/letsencrypt/boulder/core"
	"github.com/letsencrypt/boulder/identifier"
	"github.com/miekg/dns"
)

type caaParamTagCaseDNS struct{ bdns.Client }

func (d *caaParamTagCaseDNS) LookupCAA(_ context.Context, domain string) (*bdns.Result[*dns.CAA], string, error) {
	var records []*dns.CAA
	trimmed := strings.TrimRight(domain, ".")
	record := &dns.CAA{Tag: "issue"}

	switch trimmed {
	case "caseparam.com":
		// mixed-case accounturi tag: intended to bind issuance to account 123.
		record.Value = "letsencrypt.org; AccountURI=https://letsencrypt.org/acct/reg/123; validationmethods=http-01"
		records = append(records, record)
	case "caseparam-control.com":
		// control: same semantics but with lowercase parameter tags.
		record.Value = "letsencrypt.org; accounturi=https://letsencrypt.org/acct/reg/123; validationmethods=http-01"
		records = append(records, record)
	case "casevm.com":
		// mixed-case validationmethods tag: intended to restrict issuance to dns-01 only.
		record.Value = "letsencrypt.org; ValidationMethods=dns-01"
		records = append(records, record)
	case "casevm-control.com":
		// control: lowercase validationmethods tag (dns-01 only).
		record.Value = "letsencrypt.org; validationmethods=dns-01"
		records = append(records, record)
	default:
		// no records
	}

	return &bdns.Result[*dns.CAA]{Final: records}, "caaParamTagCaseDNS", nil
}

func TestCAAParamTagCase_ControlBaseline_LowercaseAccountURI(t *testing.T) {
	t.Helper()

	// baseline: accounturi binding should fail closed when the account does not
	// match the configured accounturi parameter.
	va, _ := setup(nil, "", nil, &caaParamTagCaseDNS{})
	params := &caaParams{
		accountURIID:     321, // does not match the "acct/reg/123" restriction
		validationMethod: core.ChallengeTypeHTTP01,
	}

	err := va.checkCAA(ctx, identifier.NewDNS("caseparam-control.com"), params)
	if err == nil {
		t.Fatalf("unexpected caa allow for caseparam-control.com with mismatched accounturi (expected fail closed)")
	}

	t.Logf("[NC_MARKER]: lowercase accounturi enforces as expected")
}

func TestCAAParamTagCase_Canonical_AccountURICaseBypass(t *testing.T) {
	t.Helper()
	t.Logf("[CALLSITE_HIT]: checkCAA::parseCAARecord->caaAccountURIMatches")

	// current behavior: mixed-case parameter tags are treated as unknown, so
	// accounturi binding is skipped when the record uses "AccountURI=".
	va, _ := setup(nil, "", nil, &caaParamTagCaseDNS{})
	params := &caaParams{
		accountURIID:     321, // does not match the restriction
		validationMethod: core.ChallengeTypeHTTP01,
	}

	err := va.checkCAA(ctx, identifier.NewDNS("caseparam.com"), params)
	if err != nil {
		t.Fatalf("unexpected caa deny for caseparam.com (this indicates the behavior changed): %v", err)
	}

	t.Logf("[PROOF_MARKER]: mixed_case_accounturi_treated_as_absent=true")
	t.Logf("[IMPACT_MARKER]: account_binding_skipped=true requested_account=321 bound_account=123")
}

func TestCAAParamTagCase_ControlBaseline_LowercaseValidationMethods(t *testing.T) {
	t.Helper()

	// baseline: validationmethods binding should fail closed when the method does
	// not match the configured validationmethods parameter.
	va, _ := setup(nil, "", nil, &caaParamTagCaseDNS{})
	params := &caaParams{
		accountURIID:     123,
		validationMethod: core.ChallengeTypeHTTP01,
	}

	err := va.checkCAA(ctx, identifier.NewDNS("casevm-control.com"), params)
	if err == nil {
		t.Fatalf("unexpected caa allow for casevm-control.com with mismatched validation method (expected fail closed)")
	}

	t.Logf("[NC_MARKER]: lowercase validationmethods enforces as expected")
}

func TestCAAParamTagCase_Canonical_ValidationMethodsCaseBypass(t *testing.T) {
	t.Helper()
	t.Logf("[CALLSITE_HIT]: checkCAA::parseCAARecord->caaValidationMethodMatches")

	// current behavior: mixed-case parameter tags are treated as unknown, so the
	// validation method restriction is skipped when the record uses "ValidationMethods=".
	va, _ := setup(nil, "", nil, &caaParamTagCaseDNS{})
	params := &caaParams{
		accountURIID:     123,
		validationMethod: core.ChallengeTypeHTTP01,
	}

	err := va.checkCAA(ctx, identifier.NewDNS("casevm.com"), params)
	if err != nil {
		t.Fatalf("unexpected caa deny for casevm.com (this indicates the behavior changed): %v", err)
	}

	t.Logf("[PROOF_MARKER]: mixed_case_validationmethods_treated_as_absent=true intended=dns-01 used=http-01")
	t.Logf("[IMPACT_MARKER]: validation_method_restriction_skipped=true intended=dns-01 used=http-01")
}