//go:build integration

package rest_test

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/nexuscrm/backend/internal/interfaces/rest"
	"github.com/nexuscrm/shared/pkg/constants"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestOAuthHandler_UserInfo(t *testing.T) {
	sm, _, r := SetupHandlerHelper(t)
	oauthHandler := rest.NewOAuthHandler(sm)

	// Register Route
	r.GET("/services/oauth2/userinfo", oauthHandler.UserInfo)

	// Execute
	req, _ := http.NewRequest(http.MethodGet, "/services/oauth2/userinfo", nil)
	w := httptest.NewRecorder()
	r.ServeHTTP(w, req)

	// Assert
	assert.Equal(t, http.StatusOK, w.Code)

	var resp map[string]interface{}
	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))

	// Verify Standard OIDC Claims
	assert.Equal(t, "test-admin", resp["sub"])
	assert.Equal(t, "test-admin", resp["user_id"])
	assert.Equal(t, "Test Admin", resp["name"])
	assert.Equal(t, "admin@test.com", resp["email"])
	assert.Equal(t, true, resp["email_verified"])
	assert.Equal(t, "00D000000000001", resp["organization_id"])

	// Verify Custom Claims
	assert.Equal(t, constants.ProfileSystemAdmin, resp["profile_id"])
	assert.NotNil(t, resp["permissions"])
}

func TestOAuthHandler_UserInfo_Unauthenticated(t *testing.T) {
	sm, _, _ := SetupHandlerHelper(t)
	oauthHandler := rest.NewOAuthHandler(sm)

	// Setup Router WITHOUT Auth Middleware
	gin.SetMode(gin.TestMode)
	r := gin.New()
	r.Use(gin.Recovery())
	r.GET("/services/oauth2/userinfo", oauthHandler.UserInfo)

	// Execute without setting ContextKeyUser
	req, _ := http.NewRequest(http.MethodGet, "/services/oauth2/userinfo", nil)
	w := httptest.NewRecorder()
	r.ServeHTTP(w, req)

	// Assert — MustGetUser panics on nil user; Recovery middleware returns 500
	assert.Equal(t, http.StatusInternalServerError, w.Code)
}