package api

import (
	"context"
	"net/http"
	"net/http/httptest"
	"testing"

	"geniusrun/backend/internal/auth"
)

func TestResolveUser_AttachesResolvedUserWhenProvisioned(t *testing.T) {
	s, db := newTestServer(t)
	userID, err := db.ProvisionUser(context.Background(), "test-user", "Test User")
	if err != nil {
		t.Fatalf("ProvisionUser: %v", err)
	}

	var gotUserID int64
	var gotOK bool
	handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		u, ok := userFromContext(r.Context())
		gotUserID, gotOK = u.ID, ok
	})))

	rec := doJSON(t, handler, http.MethodGet, "/", nil) // doJSON's test cookie carries Sub: "test-user"
	_ = rec
	if !gotOK || gotUserID != userID {
		t.Fatalf("resolveUser: ok=%v userID=%d, want ok=true userID=%d", gotOK, gotUserID, userID)
	}
}

func TestResolveUser_LeavesContextEmptyWhenNotProvisioned(t *testing.T) {
	s, _ := newTestServer(t)

	var gotOK bool
	handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		_, gotOK = userFromContext(r.Context())
	})))

	doJSON(t, handler, http.MethodGet, "/", nil) // "test-user" sub, never provisioned in this test
	if gotOK {
		t.Fatal("expected userFromContext to report not-found for an unprovisioned sub")
	}
}

func TestRequireProvisionedUser_RejectsWhenNoUserResolved(t *testing.T) {
	handler := requireProvisionedUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		t.Fatal("handler should not be reached")
	}))
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	rec := httptest.NewRecorder()
	handler.ServeHTTP(rec, req)
	if rec.Code != http.StatusForbidden {
		t.Fatalf("status = %d, want 403", rec.Code)
	}
}