package api

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"
)

func TestRequireInternalAdminCredentialAcceptsHeaderAndRecordsOperator(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.GET("/internal", RequireInternalAdminCredential("secret"), func(ctx *gin.Context) {
		ctx.JSON(http.StatusOK, gin.H{"operator": InternalAdminOperator(ctx)})
	})

	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodGet, "/internal", nil)
	request.Header.Set(HeaderInternalAdminToken, "secret")
	request.Header.Set("X-AgentTeam-Ops-Operator-Email", "ops@example.com")
	router.ServeHTTP(recorder, request)

	require.Equal(t, http.StatusOK, recorder.Code)
	require.JSONEq(t, `{"operator":"ops@example.com"}`, recorder.Body.String())
}

func TestRequireInternalAdminCredentialAcceptsBearerToken(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.GET("/internal", RequireInternalAdminCredential("secret"), func(ctx *gin.Context) {
		ctx.Status(http.StatusNoContent)
	})

	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodGet, "/internal", nil)
	request.Header.Set("Authorization", "Bearer secret")
	router.ServeHTTP(recorder, request)

	require.Equal(t, http.StatusNoContent, recorder.Code)
}

func TestRequireInternalAdminCredentialRejectsInvalidToken(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.GET("/internal", RequireInternalAdminCredential("secret"), func(ctx *gin.Context) {
		ctx.Status(http.StatusNoContent)
	})

	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodGet, "/internal", nil)
	request.Header.Set(HeaderInternalAdminToken, "wrong")
	router.ServeHTTP(recorder, request)

	require.Equal(t, http.StatusUnauthorized, recorder.Code)
	require.JSONEq(t, `{"error":"Invalid internal admin credential"}`, recorder.Body.String())
}

func TestRequireInternalAdminCredentialRequiresConfiguredToken(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.GET("/internal", RequireInternalAdminCredential(" "), func(ctx *gin.Context) {
		ctx.Status(http.StatusNoContent)
	})

	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodGet, "/internal", nil)
	router.ServeHTTP(recorder, request)

	require.Equal(t, http.StatusServiceUnavailable, recorder.Code)
	require.JSONEq(t, `{"error":"Internal admin credential is not configured"}`, recorder.Body.String())
}