package handler

import (
	"context"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"

	vulnservice "security-center-backend/internal/modules/vuln/service"
	"security-center-backend/internal/service/jwt"
)

func TestUpdateConfigRequiresManagePermission(t *testing.T) {
	gin.SetMode(gin.TestMode)
	svc := vulnservice.New(nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil)
	handler := New(svc, nil, nil)
	req := httptest.NewRequest(
		http.MethodPost,
		"/api/v1/vulnerabilities/config",
		strings.NewReader(`{"submission_required_fields":["application"]}`),
	)
	req.Header.Set("Content-Type", "application/json")
	rec := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(rec)
	c.Request = req
	c.Set("current_user", &jwt.Claims{
		UserID:      1,
		Email:       "viewer@example.com",
		Permissions: []string{"vuln:view_findings"},
	})

	handler.UpdateConfig(c)

	require.Equal(t, http.StatusOK, rec.Code)
	require.Contains(t, rec.Body.String(), `"code":403`)
	require.Contains(t, rec.Body.String(), "insufficient permissions")
}

func TestUpdateConfigValidatesSubmissionRequirementsBeforeSLAUpdate(t *testing.T) {
	gin.SetMode(gin.TestMode)
	svc := vulnservice.New(nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil)
	handler := New(svc, nil, nil)
	req := httptest.NewRequest(
		http.MethodPost,
		"/api/v1/vulnerabilities/config",
		strings.NewReader(`{"sla_rules":{"critical":99},"submission_required_fields":["not_a_field"]}`),
	)
	req.Header.Set("Content-Type", "application/json")
	rec := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(rec)
	c.Request = req
	c.Set("current_user", &jwt.Claims{
		UserID:      1,
		Email:       "manager@example.com",
		Permissions: []string{"vuln:manage_findings"},
	})

	handler.UpdateConfig(c)

	require.Equal(t, http.StatusOK, rec.Code)
	require.Contains(t, rec.Body.String(), `"code":400`)
	require.Contains(t, rec.Body.String(), "unknown submission required field: not_a_field")
	config, err := svc.GetConfiguration(context.Background())
	require.NoError(t, err)
	require.Equal(t, 24, config.SLARules["critical"])
}