package app

import (
	"context"
	"errors"
	"io"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"sync"
	"testing"
	"time"

	"github.com/bnema/zerowrap"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	adminhttp "github.com/bnema/gordon/internal/adapters/in/http/admin"
	pkiadapter "github.com/bnema/gordon/internal/adapters/out/pki"
	inmocks "github.com/bnema/gordon/internal/boundaries/in/mocks"
	out "github.com/bnema/gordon/internal/boundaries/out"
	"github.com/bnema/gordon/internal/domain"
	proxyusecase "github.com/bnema/gordon/internal/usecase/proxy"
	traffic "github.com/bnema/gordon/internal/usecase/traffic"
)

func newNotFoundProxyService(t *testing.T) *proxyusecase.Service {
	t.Helper()
	configSvc := inmocks.NewMockConfigService(t)
	configSvc.EXPECT().GetExternalRoutes().Return(map[string]string{}).Maybe()
	return proxyusecase.NewService(configSvc, proxyusecase.Config{})
}

// testAccessLogWriter is a thread-safe mock AccessLogWriter for tests.
type testAccessLogWriter struct {
	mu      sync.Mutex
	entries []out.AccessLogEntry
}

func (w *testAccessLogWriter) Write(entry out.AccessLogEntry) error {
	w.mu.Lock()
	defer w.mu.Unlock()
	w.entries = append(w.entries, entry)
	return nil
}

func (w *testAccessLogWriter) snapshot() []out.AccessLogEntry {
	w.mu.Lock()
	defer w.mu.Unlock()
	result := make([]out.AccessLogEntry, len(w.entries))
	copy(result, w.entries)
	return result
}

func TestCreateAuthService_Disabled_ReturnsNilServices(t *testing.T) {
	t.Parallel()

	cfg := Config{}
	cfg.Auth.Enabled = false

	store, authSvc, err := createAuthService(context.Background(), cfg, zerowrap.Default())
	if err != nil {
		t.Fatalf("expected no error when auth is disabled, got %v", err)
	}
	if store != nil {
		t.Fatalf("expected nil token store when auth is disabled")
	}
	if authSvc != nil {
		t.Fatalf("expected nil auth service when auth is disabled")
	}
}

func TestCreateHTTPHandlers_LocalMode_DisablesAdminRoutes(t *testing.T) {
	t.Parallel()

	cfg := Config{}
	cfg.Auth.Enabled = false

	svc := &services{adminHandler: &adminhttp.Handler{}}
	registryHandler, _, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/admin/status", nil)
	req.RemoteAddr = "192.0.2.10:12345"

	rec := httptest.NewRecorder()
	registryHandler.ServeHTTP(rec, req)

	if rec.Code != http.StatusNotFound {
		t.Fatalf("expected status %d, got %d", http.StatusNotFound, rec.Code)
	}
}

func TestCreateHTTPHandlers_LocalMode_RestrictsRegistryToLoopback(t *testing.T) {
	t.Parallel()

	cfg := Config{}
	cfg.Auth.Enabled = false

	registryHandler, _, _ := createHTTPHandlers(&services{}, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/v2/test/manifests/latest", nil)
	req.RemoteAddr = "192.0.2.20:12345"

	rec := httptest.NewRecorder()
	registryHandler.ServeHTTP(rec, req)

	if rec.Code != http.StatusForbidden {
		t.Fatalf("expected status %d, got %d", http.StatusForbidden, rec.Code)
	}
}

// newTestCA creates a temporary CA adapter for integration tests.
func newTestCA(t *testing.T) *pkiadapter.CA {
	t.Helper()
	ca, err := pkiadapter.NewCA(t.TempDir(), zerowrap.Default())
	require.NoError(t, err)
	return ca
}

// newOnboardingConfig returns a Config with trusted proxy CIDRs and TLS enabled.
func newOnboardingConfig() Config {
	cfg := Config{}
	cfg.Server.Port = 8088
	cfg.Server.TLSPort = 8443
	cfg.Server.ProxyAllowedIPs = []string{"173.245.48.0/20"} // Cloudflare sample
	cfg.EntryPoints = map[string]traffic.EntryPointConfig{
		traffic.DefaultEdgeEntryPointName: {Address: ":8443", Protocol: domain.EntryPointProtocolSmartTCP},
	}
	return cfg
}

// directAddr is an IP outside the trusted proxy CIDR range.
const directAddr = "203.0.113.10:12345"

// trustedProxyAddr is an IP inside the 173.245.48.0/20 range.
const trustedProxyAddr = "173.245.48.5:12345"

func TestCreateHTTPHandlers_DirectHTTPOnboarding_AllPaths(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name        string
		path        string
		wantCode    int
		wantContent string // substring check
		wantType    string // Content-Type substring
	}{
		{name: ".well-known/gordon/ serves onboarding", path: "/.well-known/gordon/", wantCode: http.StatusOK, wantContent: "Trust CA Certificate", wantType: "text/html"},
		{name: ".well-known/gordon/ca serves onboarding", path: "/.well-known/gordon/ca", wantCode: http.StatusOK, wantContent: "Trust CA Certificate", wantType: "text/html"},
		{name: ".well-known/gordon/ca.crt serves CA cert", path: "/.well-known/gordon/ca.crt", wantCode: http.StatusOK, wantContent: "BEGIN CERTIFICATE", wantType: "application/x-x509-ca-cert"},
		{name: ".well-known/gordon/ca.mobileconfig serves mobileconfig", path: "/.well-known/gordon/ca.mobileconfig", wantCode: http.StatusOK, wantContent: "<?xml", wantType: "application/x-apple-aspen-config"},
		{name: "root returns forbidden", path: "/", wantCode: http.StatusForbidden, wantContent: "Only certificate onboarding is available", wantType: "text/plain"},
		{name: "former /ca alias returns forbidden", path: "/ca", wantCode: http.StatusForbidden, wantContent: "Only certificate onboarding is available", wantType: "text/plain"},
		{name: "former /ca.crt alias returns forbidden", path: "/ca.crt", wantCode: http.StatusForbidden, wantContent: "Only certificate onboarding is available", wantType: "text/plain"},
		{name: "former /ca.mobileconfig alias returns forbidden", path: "/ca.mobileconfig", wantCode: http.StatusForbidden, wantContent: "Only certificate onboarding is available", wantType: "text/plain"},
		{name: "unknown path returns forbidden", path: "/web", wantCode: http.StatusForbidden, wantContent: "Only certificate onboarding is available", wantType: "text/plain"},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			ca := newTestCA(t)
			cfg := newOnboardingConfig()
			svc := &services{caAdapter: ca}

			_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

			req := httptest.NewRequest(http.MethodGet, tc.path, nil)
			req.RemoteAddr = directAddr
			req.Host = "app.example.com"
			rec := httptest.NewRecorder()
			httpHandler.ServeHTTP(rec, req)

			assert.Equal(t, tc.wantCode, rec.Code, "%s: status code", tc.name)
			if tc.wantType != "" {
				assert.Contains(t, rec.Header().Get("Content-Type"), tc.wantType, "%s: content type", tc.name)
			}
			if tc.wantContent != "" {
				assert.Contains(t, rec.Body.String(), tc.wantContent, "%s: body content", tc.name)
			}
		})
	}
}

func TestCreateHTTPHandlers_TrustedProxyHTTP_DoesNotServeOnboarding(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.RemoteAddr = trustedProxyAddr
	req.Host = "app.example.com"
	rec := httptest.NewRecorder()
	httpHandler.ServeHTTP(rec, req)

	// Trusted proxy traffic should NOT get the onboarding page.
	// It should flow through to the normal proxy handler (which returns 502/404/etc,
	// but definitely not onboarding HTML).
	assert.NotContains(t, rec.Body.String(), "Trust CA Certificate")
}

func TestCreateHTTPHandlers_TrustedProxyWellKnownCACertPath_DoesNotServeOnboardingResource(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/.well-known/gordon/ca.crt", nil)
	req.RemoteAddr = trustedProxyAddr
	req.Host = "app.example.com"
	rec := httptest.NewRecorder()
	httpHandler.ServeHTTP(rec, req)

	// Trusted proxy traffic must NOT leak the internal CA cert.
	assert.NotEqual(t, "application/x-x509-ca-cert", rec.Header().Get("Content-Type"))
	assert.NotContains(t, rec.Body.String(), "BEGIN CERTIFICATE")
}

func TestCreateHTTPHandlers_ForceHTTPSRedirect_DoesNotBypassDirectOnboarding(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	cfg.Server.ForceHTTPSRedirect = true
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/.well-known/gordon/", nil)
	req.RemoteAddr = directAddr
	req.Host = "app.example.com"
	rec := httptest.NewRecorder()
	httpHandler.ServeHTTP(rec, req)

	// Direct onboarding must win over force_https_redirect.
	assert.Equal(t, http.StatusOK, rec.Code)
	assert.Contains(t, rec.Body.String(), "Trust CA Certificate")
}

// stubAppTargets is a fixed proxy.TargetProvider for handler tests.
type stubAppTargets map[string]domain.AppBackend

func (s stubAppTargets) LookupHost(host string) (domain.AppBackend, bool) {
	backend, ok := s[host]
	return backend, ok
}

func TestCreateHTTPHandlers_RedirectUsesSelectedEntrypointPorts(t *testing.T) {
	t.Parallel()
	cfg := Config{}
	cfg.Server.Port = 8088
	cfg.Server.TLSPort = 8443
	cfg.Server.ForceHTTPSRedirect = true
	cfg.EntryPoints = map[string]traffic.EntryPointConfig{
		traffic.DefaultEdgeEntryPointName: {Address: ":9443", Protocol: domain.EntryPointProtocolSmartTCP},
	}
	configSvc := inmocks.NewMockConfigService(t)
	configSvc.EXPECT().GetExternalRoutes().Return(map[string]string{}).Maybe()
	proxySvc := proxyusecase.NewService(configSvc, proxyusecase.Config{})
	// app.example.com serves from the ACTIVE-derived index in this test.
	proxySvc.WithAppTargets(stubAppTargets(map[string]domain.AppBackend{
		"app.example.com": {Host: "127.0.0.1", Port: 18080, ContainerPort: 8080, ContainerID: "c-app"},
	}))
	svc := &services{proxySvc: proxySvc}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/path", nil)
	req.RemoteAddr = directAddr
	req.Host = "app.example.com:9443"
	rec := httptest.NewRecorder()
	httpHandler.ServeHTTP(rec, req)

	assert.Equal(t, http.StatusPermanentRedirect, rec.Code)
	assert.Equal(t, "https://app.example.com:9443/path", rec.Header().Get("Location"))
}

func TestCreateHTTPHandlers_OnboardingUsesSelectedEntrypointPorts(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	cfg.EntryPoints = map[string]traffic.EntryPointConfig{
		"public": {Address: ":9443", Protocol: domain.EntryPointProtocolSmartTCP},
	}
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/.well-known/gordon/", nil)
	req.RemoteAddr = directAddr
	req.Host = "app.example.com:9443"
	rec := httptest.NewRecorder()
	httpHandler.ServeHTTP(rec, req)

	assert.Equal(t, http.StatusOK, rec.Code)
	assert.Contains(t, rec.Body.String(), "https://app.example.com:9443/")
}

func TestCreateHTTPHandlers_HTTPSOnboarding_RemainsAvailableOnGordonDomain(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	cfg.Server.GordonDomain = "gordon.example.com"
	svc := &services{caAdapter: ca, proxySvc: newNotFoundProxyService(t)}

	_, _, httpsHandler := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	for _, host := range []string{"gordon.example.com", "Gordon.Example.Com.:8443"} {
		req := httptest.NewRequest(http.MethodGet, "/.well-known/gordon/ca", nil)
		req.RemoteAddr = directAddr
		req.Host = host
		rec := httptest.NewRecorder()
		httpsHandler.ServeHTTP(rec, req)

		assert.Equal(t, http.StatusOK, rec.Code, "host %s", host)
		assert.Contains(t, rec.Body.String(), "Trust CA Certificate", "host %s", host)
	}
}

func TestCreateHTTPHandlers_HTTPSOnboarding_DoesNotPreemptAppHostCAPath(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	cfg.Server.GordonDomain = "gordon.example.com"
	svc := &services{caAdapter: ca, proxySvc: newNotFoundProxyService(t)}

	_, _, httpsHandler := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/.well-known/gordon/ca", nil)
	req.RemoteAddr = directAddr
	req.Host = "app.example.com"
	rec := httptest.NewRecorder()
	httpsHandler.ServeHTTP(rec, req)

	assert.Equal(t, http.StatusNotFound, rec.Code)
	assert.NotContains(t, rec.Body.String(), "Trust CA Certificate")

	normalizedReq := httptest.NewRequest(http.MethodGet, "/.well-known/gordon/ca", nil)
	normalizedReq.RemoteAddr = directAddr
	normalizedReq.Host = "Gordon.Example.Com.:8443"
	normalizedRec := httptest.NewRecorder()
	httpsHandler.ServeHTTP(normalizedRec, normalizedReq)

	assert.Equal(t, http.StatusOK, normalizedRec.Code)
	assert.Contains(t, normalizedRec.Body.String(), "Trust CA Certificate")
}

func TestCreateHTTPHandlers_HTTPSOnboarding_HEADRoutesRemainAvailable(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	cfg.Server.GordonDomain = "gordon.example.com"
	svc := &services{caAdapter: ca, proxySvc: newNotFoundProxyService(t)}

	_, _, httpsHandler := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	// Use httptest.NewServer so Go's net/http server strips the body for HEAD.
	// httptest.NewRecorder does not apply server-level HEAD body stripping.
	ts := httptest.NewServer(httpsHandler)
	defer ts.Close()

	for _, path := range []string{"/.well-known/gordon/ca", "/.well-known/gordon/ca.crt", "/.well-known/gordon/ca.mobileconfig"} {
		req, err := http.NewRequest(http.MethodHead, ts.URL+path, nil)
		require.NoError(t, err)
		req.Host = "Gordon.Example.Com.:8443"
		resp, err := ts.Client().Do(req)
		require.NoError(t, err)

		body, err := io.ReadAll(resp.Body)
		require.NoError(t, err)
		require.NoError(t, resp.Body.Close())

		assert.Equal(t, http.StatusOK, resp.StatusCode, "HEAD %s should return 200", path)
		assert.Empty(t, body, "HEAD %s should have empty body", path)
	}
}

func TestCreateHTTPHandlers_DirectHTTPOnboarding_HEADRoutesRemainAvailable(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		r.RemoteAddr = directAddr
		r.Host = "app.example.com"
		httpHandler.ServeHTTP(w, r)
	}))
	defer ts.Close()

	for _, tc := range []struct {
		path        string
		contentType string
	}{
		{path: "/.well-known/gordon/ca", contentType: "text/html"},
		{path: "/.well-known/gordon/ca.crt", contentType: "application/x-x509-ca-cert"},
	} {
		resp, err := ts.Client().Head(ts.URL + tc.path)
		require.NoError(t, err)

		body, err := io.ReadAll(resp.Body)
		require.NoError(t, err)
		require.NoError(t, resp.Body.Close())

		assert.Equal(t, http.StatusOK, resp.StatusCode, "HEAD %s should return 200", tc.path)
		assert.Contains(t, resp.Header.Get("Content-Type"), tc.contentType)
		assert.Empty(t, body, "HEAD %s should have empty body", tc.path)
	}
}

func TestCreateHTTPHandlers_DirectHTTPForbiddenHEAD_ReturnsForbidden(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		r.RemoteAddr = directAddr
		r.Host = "app.example.com"
		httpHandler.ServeHTTP(w, r)
	}))
	defer ts.Close()

	resp, err := ts.Client().Head(ts.URL + "/web")
	require.NoError(t, err)

	body, err := io.ReadAll(resp.Body)
	require.NoError(t, err)
	require.NoError(t, resp.Body.Close())

	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
	assert.Empty(t, body, "HEAD 403 should have empty body")
}

func TestCreateHTTPHandlers_DirectHTTPACMEChallenge_Returns404(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/.well-known/acme-challenge/test-token", nil)
	req.RemoteAddr = directAddr
	req.Host = "app.example.com"
	rec := httptest.NewRecorder()
	httpHandler.ServeHTTP(rec, req)

	assert.Equal(t, http.StatusNotFound, rec.Code)
}

func TestCreateHTTPHandlers_TLSDisabled_DoesNotServeHTTPOnboarding(t *testing.T) {
	t.Parallel()
	ca := newTestCA(t)
	cfg := newOnboardingConfig()
	cfg.EntryPoints = nil // TLS disabled: no TLS-capable traffic entrypoint
	svc := &services{caAdapter: ca}

	_, httpHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), nil)

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.RemoteAddr = directAddr
	req.Host = "app.example.com"
	rec := httptest.NewRecorder()
	httpHandler.ServeHTTP(rec, req)

	// With TLS disabled, onboarding should NOT be served.
	assert.NotContains(t, rec.Body.String(), "Trust CA Certificate")
}

type recordingPublicTLSRuntime struct {
	reconcileCalls int
	loopCalls      int
	reconcileErr   error
}

func (r *recordingPublicTLSRuntime) Reconcile(context.Context) error {
	r.reconcileCalls++
	return r.reconcileErr
}

func (r *recordingPublicTLSRuntime) StartRenewalLoop(context.Context, time.Duration) <-chan struct{} {
	r.loopCalls++
	done := make(chan struct{})
	close(done)
	return done
}

func TestStartPublicTLSRuntime_ReconcilesAndStartsRenewalLoop(t *testing.T) {
	t.Parallel()

	runtime := &recordingPublicTLSRuntime{}
	err := startPublicTLSRuntime(context.Background(), runtime, zerowrap.Default())

	require.NoError(t, err)
	assert.Equal(t, 1, runtime.reconcileCalls)
	assert.Equal(t, 1, runtime.loopCalls)
}

func TestStartPublicTLSRuntime_NilSvc(t *testing.T) {
	t.Parallel()

	err := startPublicTLSRuntime(context.Background(), nil, zerowrap.Default())
	require.NoError(t, err)
}

func TestStartPublicTLSRuntime_StartsRenewalLoopWhenReconcileFails(t *testing.T) {
	t.Parallel()

	runtime := &recordingPublicTLSRuntime{reconcileErr: errors.New("boom")}
	err := startPublicTLSRuntime(context.Background(), runtime, zerowrap.Default())

	require.Error(t, err)
	assert.Equal(t, 1, runtime.reconcileCalls)
	assert.Equal(t, 1, runtime.loopCalls)
}

func TestCreateHTTPHandlers_TLSConfiguredWithoutCA_FailsStartup(t *testing.T) {
	t.Parallel()
	// Verify that initPKI returns an error when TLS is enabled but CA init fails.
	// We test this by providing a non-writable data dir.
	si := &serviceInit{
		ctx: context.Background(),
		cfg: Config{},
		log: zerowrap.Default(),
		svc: &services{},
	}
	si.cfg.EntryPoints = map[string]traffic.EntryPointConfig{
		traffic.DefaultEdgeEntryPointName: {Address: ":443", Protocol: domain.EntryPointProtocolSmartTCP},
	}
	dataDir := t.TempDir()
	blockingPath := filepath.Join(dataDir, "not-a-directory")
	require.NoError(t, os.WriteFile(blockingPath, []byte("blocking file"), 0600))
	// Point data dir to a file path so PKI directory creation fails portably.
	si.cfg.Server.DataDir = blockingPath

	err := si.initPKI()
	assert.Error(t, err, "initPKI should fail when CA cannot be initialized")
}

func TestBuildRegistryCIDRAllowlistMiddleware_InvalidEntries_DenyAll(t *testing.T) {
	t.Parallel()

	cfg := Config{}
	cfg.Server.RegistryAllowedIPs = []string{"not-a-cidr"}

	mw := buildRegistryCIDRAllowlistMiddleware(cfg, nil, zerowrap.Default())
	if mw == nil {
		t.Fatal("expected non-nil allowlist middleware")
	}

	handler := mw(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))

	req := httptest.NewRequest(http.MethodGet, "/v2/test/manifests/latest", nil)
	req.RemoteAddr = "127.0.0.1:12345"

	rec := httptest.NewRecorder()
	handler.ServeHTTP(rec, req)

	if rec.Code != http.StatusForbidden {
		t.Fatalf("expected status %d, got %d", http.StatusForbidden, rec.Code)
	}
}

// TestAccessLog_AdminRemoteRequest_ReachesAuth verifies that authenticated-mode
// admin routes are reachable remotely and delegated to the auth middleware.
func TestAccessLog_AdminRemoteRequest_ReachesAuth(t *testing.T) {
	t.Parallel()

	cfg := Config{}
	cfg.Auth.Enabled = true

	svc := &services{adminHandler: &adminhttp.Handler{}}
	aw := &testAccessLogWriter{}
	registryHandler, _, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), aw)

	req := httptest.NewRequest(http.MethodGet, "/admin/status", nil)
	req.RemoteAddr = "192.0.2.10:12345"

	rec := httptest.NewRecorder()
	registryHandler.ServeHTTP(rec, req)

	require.Equal(t, http.StatusServiceUnavailable, rec.Code)
	assert.JSONEq(t, `{"error":"authentication service unavailable"}`, rec.Body.String())
	entries := aw.snapshot()
	require.Len(t, entries, 1)
	assert.Equal(t, http.StatusServiceUnavailable, entries[0].Status)
	assert.Equal(t, "/admin/status", entries[0].Path)
}

// TestAccessLog_RegistryRejectedByLoopbackOnly_IsLogged verifies that requests
// to /v2/ blocked by loopbackOnly() in local mode still produce an access-log entry.
func TestAccessLog_RegistryRejectedByLoopbackOnly_IsLogged(t *testing.T) {
	t.Parallel()

	cfg := Config{}
	cfg.Auth.Enabled = false // local mode: /v2/ is wrapped by loopbackOnly()

	svc := &services{}
	aw := &testAccessLogWriter{}
	registryHandler, _, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), aw)

	// Non-loopback IP — loopbackOnly() rejects with 403.
	req := httptest.NewRequest(http.MethodGet, "/v2/", nil)
	req.RemoteAddr = "192.0.2.20:12345"

	rec := httptest.NewRecorder()
	registryHandler.ServeHTTP(rec, req)

	require.Equal(t, http.StatusForbidden, rec.Code)
	entries := aw.snapshot()
	require.Len(t, entries, 1, "access log must capture the loopback-rejected registry request")
	assert.Equal(t, http.StatusForbidden, entries[0].Status)
}

// TestAccessLog_DenyAllProxy_IsLogged verifies that requests rejected by the
// fail-closed denyAllHandler (triggered by an all-invalid proxy_allowed_ips
// config) still produce an access-log entry.
func TestAccessLog_DenyAllProxy_IsLogged(t *testing.T) {
	t.Parallel()

	cfg := Config{}
	// All-invalid entries cause buildProxyCIDRAllowlistMiddleware to return
	// denyAllHandler, which wraps the proxy mux unconditionally with 403.
	cfg.Server.ProxyAllowedIPs = []string{"not-a-valid-ip"}

	svc := &services{}
	aw := &testAccessLogWriter{}
	_, httpProxyHandler, _ := createHTTPHandlers(svc, cfg, zerowrap.Default(), aw)

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.RemoteAddr = "203.0.113.5:54321"

	rec := httptest.NewRecorder()
	httpProxyHandler.ServeHTTP(rec, req)

	require.Equal(t, http.StatusForbidden, rec.Code)
	entries := aw.snapshot()
	require.Len(t, entries, 1, "access log must capture the fail-closed proxy denial")
	assert.Equal(t, http.StatusForbidden, entries[0].Status)
}