// Package mock provides a fake auth.Verifier for tests that need to exercise
// internal/api's session endpoints and RequireSession gating without a real
// Keycloak instance.
package mock

import (
	"context"
	"net/url"

	"geniusrun/backend/internal/auth"
)

// Verifier is a fake auth.Verifier returning canned results supplied by the
// test/caller.
type Verifier struct {
	AuthURL          string
	Txn              auth.TxnState
	CallbackResult   auth.LoginResult
	CallbackErr      error
	EndSessionResult string // if empty, EndSessionURL returns postLogoutRedirectURL unchanged
}

var _ auth.Verifier = (*Verifier)(nil)

func (v *Verifier) BeginLogin() (string, auth.TxnState, error) {
	return v.AuthURL, v.Txn, nil
}

func (v *Verifier) HandleCallback(ctx context.Context, txn auth.TxnState, query url.Values) (auth.LoginResult, error) {
	if v.CallbackErr != nil {
		return auth.LoginResult{}, v.CallbackErr
	}
	return v.CallbackResult, nil
}

func (v *Verifier) EndSessionURL(postLogoutRedirectURL string) string {
	if v.EndSessionResult != "" {
		return v.EndSessionResult
	}
	return postLogoutRedirectURL
}