package api

import (
	"encoding/json"
	"net/http"
	"testing"

	authmock "geniusrun/backend/internal/auth/mock"
	"geniusrun/backend/internal/garmin"
	"geniusrun/backend/internal/store"
)

type configTestResponse struct {
	Application []struct {
		Key         string `json:"key"`
		Value       string `json:"value"`
		Default     string `json:"default"`
		Overridden  bool   `json:"overridden"`
		Description string `json:"description"`
	} `json:"application"`
	Environment []struct {
		Name  string `json:"name"`
		Value string `json:"value"`
	} `json:"environment"`
}

func TestConfig_GetDefaultsAndEnvSnapshot(t *testing.T) {
	s, _, _ := newTestServer(t)
	s.EnvVars = []EnvVar{{Name: "GENIUSRUN_OIDC_CLIENT_SECRET", Value: "•••• (set)"}}

	rec := doJSON(t, s.Router(), http.MethodGet, "/api/config", nil)
	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
	}
	var resp configTestResponse
	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
		t.Fatalf("unmarshal: %v", err)
	}
	if len(resp.Application) != 1 {
		t.Fatalf("expected 1 app-config entry, got %d", len(resp.Application))
	}
	e := resp.Application[0]
	if e.Key != "session.duration" || e.Value != "720" || e.Default != "720" || e.Overridden || e.Description == "" {
		t.Fatalf("unexpected default entry: %+v", e)
	}
	if len(resp.Environment) != 1 || resp.Environment[0].Value != "•••• (set)" {
		t.Fatalf("env snapshot not passed through: %+v", resp.Environment)
	}
}

func TestConfig_PutPersistsValidatesAllOrNothing(t *testing.T) {
	s, _, _ := newTestServer(t)
	router := s.Router()

	rec := doJSON(t, router, http.MethodPut, "/api/config", map[string]string{"session.duration": "168"})
	if rec.Code != http.StatusOK {
		t.Fatalf("valid PUT status = %d, body = %s", rec.Code, rec.Body.String())
	}
	var resp configTestResponse
	json.Unmarshal(rec.Body.Bytes(), &resp)
	if resp.Application[0].Value != "168" || !resp.Application[0].Overridden {
		t.Fatalf("override not reflected: %+v", resp.Application[0])
	}

	if rec = doJSON(t, router, http.MethodPut, "/api/config", map[string]string{"bogus.key": "1"}); rec.Code != http.StatusBadRequest {
		t.Fatalf("unknown key status = %d, want 400", rec.Code)
	}
	rec = doJSON(t, router, http.MethodPut, "/api/config", map[string]string{"session.duration": "zero"})
	if rec.Code != http.StatusBadRequest {
		t.Fatalf("invalid value status = %d, want 400", rec.Code)
	}
	rec = doJSON(t, router, http.MethodGet, "/api/config", nil)
	json.Unmarshal(rec.Body.Bytes(), &resp)
	if resp.Application[0].Value != "168" {
		t.Fatalf("rejected PUT still changed the value: %+v", resp.Application[0])
	}
}

// Same gate as every data route: an unprovisioned session gets 403, per
// the repo's adversarial-isolation testing convention.
func TestConfig_RequiresProvisionedUser(t *testing.T) {
	db, err := store.Open(t.TempDir() + "/config_gate_test.db")
	if err != nil {
		t.Fatalf("store.Open: %v", err)
	}
	defer db.Close()
	m := &garmin.MockClient{}
	s := NewServer(db, func(garmin.ClientConfig) garmin.Client { return m }, garmin.ClientConfig{}, garmin.SyncConfig{}, &authmock.Verifier{}, testSessionConfig)

	if rec := doJSON(t, s.Router(), http.MethodGet, "/api/config", nil); rec.Code != http.StatusForbidden {
		t.Fatalf("GET status = %d, want 403", rec.Code)
	}
	if rec := doJSON(t, s.Router(), http.MethodPut, "/api/config", map[string]string{"session.duration": "1"}); rec.Code != http.StatusForbidden {
		t.Fatalf("PUT status = %d, want 403", rec.Code)
	}
}