package api

import (
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"testing"

	"geniusrun/backend/internal/auth"
	authmock "geniusrun/backend/internal/auth/mock"
	"geniusrun/backend/internal/garmin"
	"geniusrun/backend/internal/store"
)

func TestResolveUser_AttachesResolvedUserWhenProvisioned(t *testing.T) {
	s, _, userID := newTestServer(t)

	var gotUserID int64
	var gotOK bool
	handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		u, ok := userFromContext(r.Context())
		gotUserID, gotOK = u.ID, ok
	})))

	rec := doJSON(t, handler, http.MethodGet, "/", nil) // doJSON's test cookie carries Sub: "test-user"
	_ = rec
	if !gotOK || gotUserID != userID {
		t.Fatalf("resolveUser: ok=%v userID=%d, want ok=true userID=%d", gotOK, gotUserID, userID)
	}
}

func TestResolveUser_LeavesContextEmptyWhenNotProvisioned(t *testing.T) {
	// Deliberately not newTestServer(t): that helper auto-provisions the
	// "test-user" sub that doJSON's cookie always carries, which would
	// defeat the point of this test. Build a server against a bare DB
	// instead, same pattern as setup_test.go's unprovisioned-session tests.
	db, err := store.Open(filepath.Join(t.TempDir(), "geniusrun_test.db"))
	if err != nil {
		t.Fatalf("store.Open: %v", err)
	}
	t.Cleanup(func() { db.Close() })
	m := &garmin.MockClient{}
	s := NewServer(db, func(garmin.ClientConfig) garmin.Client { return m }, garmin.ClientConfig{}, garmin.SyncConfig{}, &authmock.Verifier{}, testSessionConfig)

	var gotOK bool
	handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		_, gotOK = userFromContext(r.Context())
	})))

	doJSON(t, handler, http.MethodGet, "/", nil) // "test-user" sub, never provisioned in this test
	if gotOK {
		t.Fatal("expected userFromContext to report not-found for an unprovisioned sub")
	}
}

func TestRequireProvisionedUser_RejectsWhenNoUserResolved(t *testing.T) {
	handler := requireProvisionedUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		t.Fatal("handler should not be reached")
	}))
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	rec := httptest.NewRecorder()
	handler.ServeHTTP(rec, req)
	if rec.Code != http.StatusForbidden {
		t.Fatalf("status = %d, want 403", rec.Code)
	}
}