package auth_test

import (
	"net/http/httptest"
	"testing"

	"github.com/gofiber/fiber/v2"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"github.com/techxcar/backend/internal/auth"
)

func TestRequireAuth_missingHeader(t *testing.T) {
	app := fiber.New()
	app.Get("/protected", auth.RequireAuth(testSecret), func(c *fiber.Ctx) error {
		return c.SendString("ok")
	})

	req := httptest.NewRequest("GET", "/protected", nil)
	resp, err := app.Test(req)
	require.NoError(t, err)
	assert.Equal(t, 401, resp.StatusCode)
}

func TestRequireAuth_validToken(t *testing.T) {
	token, _ := auth.GenerateAccessToken("user-1", "tenant-1", "manager", testSecret)

	app := fiber.New()
	app.Get("/protected", auth.RequireAuth(testSecret), func(c *fiber.Ctx) error {
		claims := c.Locals("claims").(*auth.Claims)
		return c.SendString(claims.UserID)
	})

	req := httptest.NewRequest("GET", "/protected", nil)
	req.Header.Set("Authorization", "Bearer "+token)
	resp, err := app.Test(req)
	require.NoError(t, err)
	assert.Equal(t, 200, resp.StatusCode)
}

func TestRequireAuth_invalidToken(t *testing.T) {
	app := fiber.New()
	app.Get("/protected", auth.RequireAuth(testSecret), func(c *fiber.Ctx) error {
		return c.SendString("ok")
	})

	req := httptest.NewRequest("GET", "/protected", nil)
	req.Header.Set("Authorization", "Bearer invalid.token.here")
	resp, err := app.Test(req)
	require.NoError(t, err)
	assert.Equal(t, 401, resp.StatusCode)
}

func TestRequireRole_allowed(t *testing.T) {
	token, _ := auth.GenerateAccessToken("user-1", "", "super_admin", testSecret)

	app := fiber.New()
	app.Get("/admin",
		auth.RequireAuth(testSecret),
		auth.RequireRole("super_admin"),
		func(c *fiber.Ctx) error { return c.SendString("ok") },
	)

	req := httptest.NewRequest("GET", "/admin", nil)
	req.Header.Set("Authorization", "Bearer "+token)
	resp, err := app.Test(req)
	require.NoError(t, err)
	assert.Equal(t, 200, resp.StatusCode)
}

func TestRequireRole_forbidden(t *testing.T) {
	token, _ := auth.GenerateAccessToken("user-1", "t-1", "technician", testSecret)

	app := fiber.New()
	app.Get("/admin",
		auth.RequireAuth(testSecret),
		auth.RequireRole("super_admin", "tenant_admin"),
		func(c *fiber.Ctx) error { return c.SendString("ok") },
	)

	req := httptest.NewRequest("GET", "/admin", nil)
	req.Header.Set("Authorization", "Bearer "+token)
	resp, err := app.Test(req)
	require.NoError(t, err)
	assert.Equal(t, 403, resp.StatusCode)
}

func TestRequireRole_allowsMatchingRole(t *testing.T) {
	app := fiber.New()
	app.Use(func(c *fiber.Ctx) error {
		c.Locals("claims", &auth.Claims{Role: "tenant_admin"})
		return c.Next()
	})
	app.Get("/test", auth.RequireRole("tenant_admin"), func(c *fiber.Ctx) error {
		return c.SendStatus(200)
	})
	req := httptest.NewRequest("GET", "/test", nil)
	resp, err := app.Test(req)
	assert.NoError(t, err)
	assert.Equal(t, 200, resp.StatusCode)
}

func TestRequireRole_rejectsMismatch(t *testing.T) {
	app := fiber.New()
	app.Use(func(c *fiber.Ctx) error {
		c.Locals("claims", &auth.Claims{Role: "technician"})
		return c.Next()
	})
	app.Get("/test", auth.RequireRole("super_admin"), func(c *fiber.Ctx) error {
		return c.SendStatus(200)
	})
	req := httptest.NewRequest("GET", "/test", nil)
	resp, err := app.Test(req)
	assert.NoError(t, err)
	assert.Equal(t, 403, resp.StatusCode)
}